summaryrefslogtreecommitdiff
path: root/tmpfiles.d
diff options
context:
space:
mode:
authorZbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>2013-03-20 01:38:28 -0400
committerZbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>2013-03-20 14:08:41 -0400
commitd34cd374905a40e65769351a2808b741b5418bf1 (patch)
tree5dbd6761c13de63a6d5b1c0733d82990abb46aef /tmpfiles.d
parent1f048a6b6bcc30d2e157711b3d231d7a944e6ffb (diff)
Make PrivateTmp dirs also inaccessible from the outside
Currently, PrivateTmp=yes means that the service cannot see the /tmp shared by rest of the system and is isolated from other services using PrivateTmp, but users can access and modify /tmp as seen by the service. Move the private /tmp and /var/tmp directories into a 0077-mode directory. This way unpriviledged users on the system cannot see (or modify) /tmp as seen by the service.
Diffstat (limited to 'tmpfiles.d')
-rw-r--r--tmpfiles.d/tmp.conf6
1 files changed, 4 insertions, 2 deletions
diff --git a/tmpfiles.d/tmp.conf b/tmpfiles.d/tmp.conf
index ef5a9f0f2c..3b534a1f75 100644
--- a/tmpfiles.d/tmp.conf
+++ b/tmpfiles.d/tmp.conf
@@ -12,5 +12,7 @@ d /tmp 1777 root root 10d
d /var/tmp 1777 root root 30d
# Exclude namespace mountpoints created with PrivateTmp=yes
-X /tmp/systemd-private-*
-X /var/tmp/systemd-private-*
+x /tmp/systemd-private-*
+x /var/tmp/systemd-private-*
+X /tmp/systemd-private-*/tmp
+X /var/tmp/systemd-private-*/tmp