Polyinstantiation of /tmp and /var/tmp and CGroups....
Kurt Seifried
kseifried at redhat.com
Wed Apr 3 15:51:37 UTC 2013
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 04/03/2013 07:22 AM, Trevor Vaughan wrote:
> All,
>
> Should we be requiring polyinstation of /tmp and /var/tmp for users
> via PAM?
We've (Red Hat) been doing this in our OpenShift software for some
time. It prevents a lot of grief as you can imagine and seems to not
really cause much in the way of problems.
> I had forgotten about this until reading a recent post.
>
> I feel that this would be a good idea in general, but may cause
> issues in terms of legitimate file sharing and end up with more
> users making their home directories 755 (or more ridiculous).
There are better/more secure ways to share files, but you can also
make per user /tmp default to a private one and have a public
/tmp-public for example that users can explicitly use to share files.
> Also, should we be binding users to any particular CGroup limits by
> default?
>
> Thanks,
>
> Trevor
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJRXFAIAAoJEBYNRVNeJnmTdPoP/ip2x6T1q9rsxc5IBsOzvTVN
I5RnaSMZSoK6ZqDu+pjxPI4EWL0bK8pHRveIQkxFaWmpq+vK7Ul6zHGr4tkn2t0A
yZM3c9a/HjHJXLdhW90jO7u/wnHAZdUq2kCnyVsbkIPNm+tHH5kJVeswKzpZMqED
SxfcsM9tV5LWhD9FRe8Q1N3ds0i7959OuXMmY3/abEwFScaf92ww1ClZzMWorXsY
WHsnt4cL7tAmP7SiHzMTNtPM3K8yn14jtxj3yJwZmRvkDcZ2jB7kyv9kEVAvkcXS
MY61N5VifDtbnWtm+fgOL06XVFKUQzEwQblnQWVSvRwcRVeVepsPLimV2G32gPFH
GykqkpvLgK99gvlpLF/58i/QzzDbGoPKEk3FByLNxIiFj//PDNkAhVWF1wZ3uoGy
rwW7m8Hj4WY+1I+1N6cIZkKs3Hffv9Sn9Xfs7hHBiGi/KvNkfndkIXwA0NfJu1oF
E1n3EkyerewdF08E2hy1QOwkv+bEUzdxi968zVPAB6uPS3RHmI7o7qQAC4iw5EHx
DPHVxd4uOp4n4zXSb0yXFd6LJrD1RymnB4q/YGDdLIYKOTNWImN9GCllYOotnjWQ
PqC6yj2av18H+U9Bq5G/4HuOtI2Ltc5c1GrHlT0uV2YyC6aGSPOW5Y/5MC4XiI7s
jelhpeOKye/DWo6/qaWj
=jILV
-----END PGP SIGNATURE-----
More information about the scap-security-guide
mailing list