Skip to content
ATO Pathways
  Log In

Configure Polyinstantiation of /var/tmp Directories

An XCCDF Rule

Description

To configure polyinstantiated /tmp directories, first create the parent directories which will hold the polyinstantiation child directories. Use the following command: 

$ sudo mkdir --mode 000 /var/tmp/tmp-inst
Then, add the following entry to /etc/security/namespace.conf: 
/var/tmp /var/tmp/tmp-inst/    level      root,adm

Rationale

Polyinstantiation of temporary directories is a proactive security measure which reduces chances of attacks that are made possible by /var/tmp directories being world-writable.

ID
xccdf_org.ssgproject.content_rule_accounts_polyinstantiated_var_tmp
Severity
Low
References
Updated



Remediation - Shell Script


# shellcheck disable=SC2174
mkdir -p --mode 000 /var/tmp/tmp-inst
chmod 000 /var/tmp/tmp-inst
chcon --reference=/var/tmp /var/tmp/tmp-inst

Remediation - Ansible

- name: Create /var/tmp/tmp-inst directory
  file:
    path: /var/tmp/tmp-inst
    state: directory
    mode: '000'
    seuser: system_u