Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I stumbled upon this page :

Suggesting to create/replace a few scripts; the latest step is more confusing :

Now once you have that in place, invoke the following script instead of login(1):

 mkdir -m 700 /tmp-safe/user/"$1" /tmp/"$1"
 chown "$1":  /tmp-safe/user/"$1" /tmp/"$1"
 mount --bind /tmp-safe/user/"$1" /tmp/"$1" || exit 1
 exec /bin/login "$@"

Since users login with ssh, i 'think' that /bin/login is never executed. What script should I modify to be able to re-mount /tmp for the user ?

share|improve this question
Uhhh.... that may not work as you expect. mount --bind is systemwide, it does not result in each user having their own view of /tmp. – MikeyB Oct 9 '09 at 16:15
up vote 2 down vote accepted

The problem with pam_mktemp is, there are lots of software with hardcoded /tmp, and they do not honor the TMPDIR variable.

"Namespaces" feature in recent kernels can be used for this, as explained in a blog post by a Gentoo developer.

share|improve this answer

A better approach is to use pam_mktemp. This will create a per-user directory under /tmp when a user logs in via any pam service and updates TMP and TMPDIR to use that. This does rely on programs being written to not assume /tmp.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.