Re: proposal: per-user temporary directories on by default?

[Tollef Fog Heen <tfheen@raw.no>]

* Kevin Kreamer 


[...]

| Ok, I've done some thinking on this as well, and this is what I've
| come up with.  I don't think making sure that the base directory is
| owned by root will protect you, as that would still allow an
| attacker to put a tmpdir in most system areas.  What we really need
| is to make sure that the tmpdir is created where the admin wants, not
| where the user wants.

Indeed, you are right.  Having it be 711 + owned by root would make
it pretty safe, though I don't want to do that, since suddenly
/var/run/sudo or something would be 711 and then you'd have a _big_
problem. 

| Since the helper has to be setuid, and has to runnable by anyone
| (since the PAM stuff uses the permissions of whoever is logging in),
| we can't pass the path into the helper.  It has to already know where
| to make the path.  So, it seems to me that the best approach is to
| have both pam_tmpdir.so and the helper read the configuration file
| independently to find out where to put the tmpdir.  However, since
| the helper won't know what service is being used, and therefore won't
| know which pam.d file to read, we'll have to use a completely
| independent config file (/etc/pam-tmpdir.conf or something like that).

Either that, or pass the service name on the command line.  it's
significantly less work to parse one's own configuration file than
parsing the PAM config file, so having a separate config file for
libpam-tmpdir might make sense.

-- 
Tollef Fog Heen                                                        ,''`.
UNIX is user friendly, it's just picky about who its friends are      : :' :
                                                                      `. `' 
                                                                        `-