/tmp etc. separation through polyinstantiation by using namespaces.conf

Phabricator Tickets
1

Information

ID: 948
PHID: PHID-TASK-s3idxehkmm2ljm6iptx5
Author: Patrick
Status at Migration Time: open
Priority at Migration Time: Normal

Description

https://forums.whonix.org/t/etc-security-hardening/8592/6

Quote @madaidan

namespaces.conf looks really interesting. We can give users their own view of certain directories. e.g. we can add

/tmp     /tmp-inst/       	level      root,adm

Which would show all users (except root and adm) only their own private /tmp which is really a copy of /tmp-inst/ that is mounted over /tmp for that user.

https://linux.die.net/man/5/namespace.conf

https://linux.die.net/man/8/pam_namespace

I can’t seem to enable the pam_namespace module to use this though.

Needs #research how to use this.

Comments