Polyinstantiated /tmp
Daniel J Walsh
dwalsh at redhat.com
Mon Nov 1 12:37:20 UTC 2010
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 10/31/2010 03:07 PM, Matt McCutchen wrote:
> On Wed, 2010-10-20 at 08:13 -0400, Daniel J Walsh wrote:
>> I have been trying to get system processes to stop using /tmp for years.
>>
>> http://danwalsh.livejournal.com/11467.html
>>
>> As some one who lives with polyinstatiated namespace /tmp, The only
>> problem I know of now is handing of kerberos tickets. Whenever a system
>> process (root) needs to communicate with a user via /tmp. namespace
>> /tmp breaks it. sssd can not create kerberos tickets in my /tmp and
>> gssd can not find my kerberos tickets in /tmp. I believe the solution
>> to both is to move the tickets to be managed by sssd and leave /tmp to
>> users.
>>
>> BTW, X has solved this problem a couple of years ago by using virtual
>> namespace for its sockets.
>
> In the abstract namespace, don't you have the same problem where if the
> real X server dies for any reason, other users can create a socket at
> the same path and mess with your applications?
>
Yes although there, you can only create sockets.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkzOtIAACgkQrlYvE4MpobPXgQCdH+Z26zudSVlF/SqhuXLdFJcE
NHsAoNGkABKeaSxJ67kXjnuYM5tG1Nkr
=qB2z
-----END PGP SIGNATURE-----
More information about the devel
mailing list