Proposing Fedora Feature for private /tmp and /var/tmp for all systemd services in Fedora 17.
Lennart Poettering
mzerqung at 0pointer.de
Tue Nov 8 01:13:36 UTC 2011
On Mon, 07.11.11 15:25, Chris Adams (cmadams at hiwaay.net) wrote:
> Once upon a time, Daniel J Walsh <dwalsh at redhat.com> said:
> > I think this is a question for lennart, I am not sure how he sets them
> > up. If I was setting them up, I would probably set them up by default
> > under /run/SERVICE/tmp and bind mount over /tmp or something like
> > that. And I would figure the root user could see them. If he is only
> > mounting as tmpfs then I don't think the admin could easily get into
> > the namespaces to see them.
>
> I would be against something that hides stuff from root. That's a
> recipie for disaster.
Yes, I agree.
By placing the private /tmp dirs beneath the real /tmp we tried to make
sure that the private /tmp for the services are visible to the admin
inside /tmp, are subject to automatic /tmp cleaning and are attributed
to the quota settings the admin might have set on /tmp.
Lennart
--
Lennart Poettering - Red Hat, Inc.
More information about the devel
mailing list