I'm wondering if /tmp should be owned by root, or rather nobody? Now with safe mode there are some conflicts, but I am worried about security if I change it to be owned by nobody...
Any advice will be very appreciated.
It should be owned by root, but must be readable and writable by anyone with one important factor: the sticky bit on the directory must be set in order to make it an append-only directory. In other words, only users who own a file inside the /tmp
directory and have read/write permissions can remove or rename the file. You may read the man page for sticky(8)
for more information on what the sticky bit is.
/tmp
it's usually safer to mount it noexec so no malicious scripts can be injected and executed.
Mar 29, 2011 at 7:36
Can a file be owned by nobody? What OS are you using?
Under Linux, /tmp
is owned by root, is world-writable and has the sticky bit set. It means that anyone can create files but only the owner (or root) can remove them. It should be similar on most Unix systems, though.
Yes, it should be owned by root, but it should also be world writable with sticky bit, so that other programs can use it as a temp directory and files created there are owned by the creator. I'm not sure of the standard practice these days, but I would also recommend making /tmp its own partition, and not part of the root partition, so that if it gets filled up it doesn't hose the root partition.