[gentoo-dev] /var/tmp world rwx?

[Kevin N. Carpenter]

I've been playing around with using tmpfs for /tmp and had it mounted 
with my standard "noexec,nodev,nosuid" anti-hack security options.  This 
works fine for VI or other normal tools.

I wanted Portage to use it as well, to symbolically linked /var/tmp to /tmp.

That broke emerge.  The "noexec" option prevents any builds from 
working.  That made me check one of my unmodified gentoo systems where I 
spotted that /var/tmp was world read/execute.  That's a security problem.

Any reason that /var/tmp can't be root read/execute only?

Kevin C.


--
gentoo-dev@g.o mailing list