Re: enhance security via private TMP/TMPDIR by default

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Wed, 2005-05-18 at 18:48 -0400, Bill Nottingham wrote:
> Colin Walters (walters@xxxxxxxxxx) said: 
> > On Wed, 2005-05-18 at 20:15 +0200, Enrico Scholz wrote:
> > 
> > > This CLONE_NEWNS and (related) 'mount --bind' operations are not very
> > > well supported by the kernel:
> > > 
> > > * there does not exist a way to enter an already existing namespace; so,
> > >   e.g. two different ssh sessions would have different /tmp directories
> > 
> > Right, but that shouldn't be a problem since you can share data via your
> > home directory or a specially-designated scratch area, etc.
> 
> Well, there's agent sockets and the like in your tmp dir.

Sure.  But you weren't expecting to share an agent between separate ssh
logins, were you?  Defining a per-machine "session" gets terribly
hackish, as the Gentoo keychain program shows.  You get into this whole
mess of trying to get some way of communicating data between independent
logins, which gets a lot more difficult than "stuff it in ~/.foo" with
fun things like NFS /home in the mix.  /tmp is problematic since you
can't use well-known filenames.  You basically end up having to
trawl /tmp looking for an active socket or something, or try
~/.foo/$hostname/bar, and $hostname has its own problems...





-- 
fedora-devel-list mailing list
fedora-devel-list@xxxxxxxxxx
http://www.redhat.com/mailman/listinfo/fedora-devel-list

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Fedora Announce]     [Fedora Kernel]     [Fedora Testing]     [Fedora Formulas]     [Fedora PHP Devel]     [Kernel Development]     [Fedora Legacy]     [Fedora Maintainers]     [Fedora Desktop]     [PAM]     [Red Hat Development]     [Gimp]     [Yosemite News]
  Powered by Linux