Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I stumbled upon this page : http://www.wlug.org.nz/PerUserTempDirs

Suggesting to create/replace a few scripts; the latest step is more confusing :

Now once you have that in place, invoke the following script instead of login(1):

 #!/bin/sh
 mkdir -m 700 /tmp-safe/user/"$1" /tmp/"$1"
 chown "$1":  /tmp-safe/user/"$1" /tmp/"$1"
 mount --bind /tmp-safe/user/"$1" /tmp/"$1" || exit 1
 exec /bin/login "$@"

Since users login with ssh, i 'think' that /bin/login is never executed. What script should I modify to be able to re-mount /tmp for the user ?

share|improve this question
    
Uhhh.... that may not work as you expect. mount --bind is systemwide, it does not result in each user having their own view of /tmp. –  MikeyB Oct 9 '09 at 16:15
add comment

2 Answers

up vote 2 down vote accepted

The problem with pam_mktemp is, there are lots of software with hardcoded /tmp, and they do not honor the TMPDIR variable.

"Namespaces" feature in recent kernels can be used for this, as explained in a blog post by a Gentoo developer.

share|improve this answer
add comment

A better approach is to use pam_mktemp. This will create a per-user directory under /tmp when a user logs in via any pam service and updates TMP and TMPDIR to use that. This does rely on programs being written to not assume /tmp.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.