Polyinstantiated /tmp and /var/tmp - proof of concept

category: notez · date: 2018-01-02 · author: LALA

noteHistorical technical note from 2018. Environment-specific identifiers and credentials have been anonymized. Commands reflect the technology and operating-system generation used at the time and should be reviewed before reuse on a current system.

This proof of concept demonstrates per-user temporary-directory isolation using PAM mount namespaces.

Purpose

On a shared administrative host, per-user temporary directories reduce accidental cross-user exposure through predictable temporary filenames and poorly permissioned application data.

Create private backing directories:

bash

$ mkdir --mode=000 /tmp-inst
$ mkdir --mode=000 /var/tmp/tmp-inst

Example /etc/security/namespace.conf:

output 2 lines

/tmp     /tmp-inst/          level   root,adm
/var/tmp /var/tmp/tmp-inst/  level   root,adm

Ensure the relevant PAM service includes:

output 1 line

session required pam_namespace.so

The exact PAM stack varies by distribution. For SSH access, verify the SSH PAM stack rather than assuming /etc/pam.d/login is sufficient.

SELinux

Where supported by policy:

bash

$ setsebool -P polyinstantiation_enabled on

Prefer persistent file-context rules with semanage fcontext plus restorecon over chcon.

Test

Open two sessions as different users and verify that a file created as /tmp/example in one session is not visible in the other. Also confirm that system services and maintenance jobs are not unintentionally isolated.

Persistent SELinux labels

Example pattern:

bash

$ semanage fcontext -a -e /tmp /tmp-inst
$ semanage fcontext -a -e /var/tmp /var/tmp/tmp-inst
$ restorecon -RFv /tmp-inst /var/tmp/tmp-inst

References

pam_namespace(8): https://man7.org/linux/man-pages/man8/pam_namespace.8.html
Red Hat SELinux documentation: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/using_selinux/
mount_namespaces(7): https://man7.org/linux/man-pages/man7/mount_namespaces.7.html

Current practice (checked 2026-10)

noteThe article above is kept as it was written in 2018. This section lists what has changed since and what to do instead today.

Still valid: the pam_namespace setup above is unchanged. The two namespace.conf lines are the examples from namespace.conf(5), and the instance parents must still have mode 000.
Less manual work on RHEL-family systems: checked on Oracle Linux 10, the same lines ship commented out in /etc/security/namespace.conf, pam_namespace.so is already in the login, sshd and gdm PAM stacks, and pam_namespace.service (pam_namespace_helper) creates the configured parent directories at boot.
Method without SELinux: level and context are only available with SELinux. On a host without SELinux use user; tmpdir (instance removed when the session closes) and tmpfs are further methods.
Patch level: pam_namespace had a local privilege escalation, CVE-2025-6020, fixed in Linux-PAM 1.7.1. Make sure the installed PAM package carries that fix before relying on polyinstantiation on a shared host.

Sources: