Polyinstantiated /tmp and /var/tmp - deployment notes

category: notez · date: 2018-01-03 · author: LALA

noteHistorical technical note from 2018. Environment-specific identifiers and credentials have been anonymized. Commands reflect the technology and operating-system generation used at the time and should be reviewed before reuse on a current system.

This deployment note extends the proof of concept with boot-time mount propagation and antivirus considerations. Those additions are environment-specific and should be treated separately from the core pam_namespace configuration.

Purpose

On a shared administrative host, per-user temporary directories reduce accidental cross-user exposure through predictable temporary filenames and poorly permissioned application data.

Create private backing directories:

bash

$ mkdir --mode=000 /tmp-inst
$ mkdir --mode=000 /var/tmp/tmp-inst

Example /etc/security/namespace.conf:

output 2 lines

/tmp     /tmp-inst/          level   root,adm
/var/tmp /var/tmp/tmp-inst/  level   root,adm

Ensure the relevant PAM service includes:

output 1 line

session required pam_namespace.so

The exact PAM stack varies by distribution. For SSH access, verify the SSH PAM stack rather than assuming /etc/pam.d/login is sufficient.

SELinux

Where supported by policy:

bash

$ setsebool -P polyinstantiation_enabled on

Prefer persistent file-context rules with semanage fcontext plus restorecon over chcon.

Test

Open two sessions as different users and verify that a file created as /tmp/example in one session is not visible in the other. Also confirm that system services and maintenance jobs are not unintentionally isolated.

Persistent SELinux labels

Example pattern:

bash

$ semanage fcontext -a -e /tmp /tmp-inst
$ semanage fcontext -a -e /var/tmp /var/tmp/tmp-inst
$ restorecon -RFv /tmp-inst /var/tmp/tmp-inst

Mount propagation

If another mount tree must be visible inside all user namespaces, configure that mount as shared before the PAM sessions are created. Prefer a systemd mount/unit dependency over rc.local.

bash

$ mount --bind /srv/shared /srv/shared
$ mount --make-rshared /srv/shared

Use rshared only when recursive propagation is actually required.

Antivirus

The historical environment added backing directories to ClamAV on-access scanning. Current ClamAV syntax and fanotify requirements vary by release, so consult the installed version documentation rather than copying old OnAccessIncludePath directives blindly.

References

pam_namespace(8): https://man7.org/linux/man-pages/man8/pam_namespace.8.html
Red Hat SELinux documentation: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/using_selinux/
mount_namespaces(7): https://man7.org/linux/man-pages/man7/mount_namespaces.7.html
ClamAV documentation: https://docs.clamav.net/