[gentoo-hardened] How to protect from /tmp hardlink/symlink attacks?

I hope its ok to ask a noob question?

I saw this portage bug (marked critical) and wondered
if the default installation of either grsecurity or
selinux flavor of hardened Gentoo would protect .. 

http://bugs.gentoo.org/show_bug.cgi?id=21923

Then I am curious what would be the recommended path
to add protection, if the default setup did not
protect from this class of exploits?  It seems tricky
to me, since ordinary users generally are allowed to
write to /tmp, and the security context / userid of
the portage user would allow emerge's to scribble in
places that ordinary users should not.

It seems non-trivial to setup a separate /tmp for
every user, so what is the best way to avoid
hardlink/symlink exploits via /tmp?

--
gentoo-hardened@g.o mailing list