Polyinstantiation of /tmp and /var/tmp and CGroups....

Kurt Seifried kseifried at redhat.com
Wed Apr 3 15:51:37 UTC 2013


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 04/03/2013 07:22 AM, Trevor Vaughan wrote:
> All,
> 
> Should we be requiring polyinstation of /tmp and /var/tmp for users
> via PAM?

We've (Red Hat) been doing this in our OpenShift software for some
time. It prevents a lot of grief as you can imagine and seems to not
really cause much in the way of problems.

> I had forgotten about this until reading a recent post.
> 
> I feel that this would be a good idea in general, but may cause
> issues in terms of legitimate file sharing and end up with more
> users making their home directories 755 (or more ridiculous).

There are better/more secure ways to share files, but you can also
make per user /tmp default to a private one and have a public
/tmp-public for example that users can explicitly use to share files.

> Also, should we be binding users to any particular CGroup limits by
> default?
> 
> Thanks,
> 
> Trevor


- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJRXFAIAAoJEBYNRVNeJnmTdPoP/ip2x6T1q9rsxc5IBsOzvTVN
I5RnaSMZSoK6ZqDu+pjxPI4EWL0bK8pHRveIQkxFaWmpq+vK7Ul6zHGr4tkn2t0A
yZM3c9a/HjHJXLdhW90jO7u/wnHAZdUq2kCnyVsbkIPNm+tHH5kJVeswKzpZMqED
SxfcsM9tV5LWhD9FRe8Q1N3ds0i7959OuXMmY3/abEwFScaf92ww1ClZzMWorXsY
WHsnt4cL7tAmP7SiHzMTNtPM3K8yn14jtxj3yJwZmRvkDcZ2jB7kyv9kEVAvkcXS
MY61N5VifDtbnWtm+fgOL06XVFKUQzEwQblnQWVSvRwcRVeVepsPLimV2G32gPFH
GykqkpvLgK99gvlpLF/58i/QzzDbGoPKEk3FByLNxIiFj//PDNkAhVWF1wZ3uoGy
rwW7m8Hj4WY+1I+1N6cIZkKs3Hffv9Sn9Xfs7hHBiGi/KvNkfndkIXwA0NfJu1oF
E1n3EkyerewdF08E2hy1QOwkv+bEUzdxi968zVPAB6uPS3RHmI7o7qQAC4iw5EHx
DPHVxd4uOp4n4zXSb0yXFd6LJrD1RymnB4q/YGDdLIYKOTNWImN9GCllYOotnjWQ
PqC6yj2av18H+U9Bq5G/4HuOtI2Ltc5c1GrHlT0uV2YyC6aGSPOW5Y/5MC4XiI7s
jelhpeOKye/DWo6/qaWj
=jILV
-----END PGP SIGNATURE-----


More information about the scap-security-guide mailing list