Polyinstantiated /tmp and /var/tmp - proof of concept

category: notez · date: 2018-01-02 · author: LALA

noteHistorical technical note from 2018. Environment-specific identifiers and credentials have been anonymized. Commands reflect the technology and operating-system generation used at the time and should be reviewed before reuse on a current system.

This proof of concept demonstrates per-user temporary-directory isolation using PAM mount namespaces.

Purpose

On a shared administrative host, per-user temporary directories reduce accidental cross-user exposure through predictable temporary filenames and poorly permissioned application data.

Create private backing directories:

bash

$ mkdir --mode=000 /tmp-inst
$ mkdir --mode=000 /var/tmp/tmp-inst

Example /etc/security/namespace.conf:

output 2 lines

/tmp     /tmp-inst/          level   root,adm
/var/tmp /var/tmp/tmp-inst/  level   root,adm

Ensure the relevant PAM service includes:

output 1 line

session required pam_namespace.so

The exact PAM stack varies by distribution. For SSH access, verify the SSH PAM stack rather than assuming /etc/pam.d/login is sufficient.

SELinux

Where supported by policy:

bash

$ setsebool -P polyinstantiation_enabled on

Prefer persistent file-context rules with semanage fcontext plus restorecon over chcon.

Test

Open two sessions as different users and verify that a file created as /tmp/example in one session is not visible in the other. Also confirm that system services and maintenance jobs are not unintentionally isolated.

Persistent SELinux labels

Example pattern:

bash

$ semanage fcontext -a -e /tmp /tmp-inst
$ semanage fcontext -a -e /var/tmp /var/tmp/tmp-inst
$ restorecon -RFv /tmp-inst /var/tmp/tmp-inst

References

pam_namespace(8): https://man7.org/linux/man-pages/man8/pam_namespace.8.html
Red Hat SELinux documentation: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/using_selinux/
mount_namespaces(7): https://man7.org/linux/man-pages/man7/mount_namespaces.7.html