I know that 1777 is the default mode of /tmp on many Linux distros.

I haven't been able to find much online, but I'm wondering if making /tmp group- and/or world-readable is really necessary.

Can anyone suggest a reason that using a mode of 1733 (drwx-wx-wt) might not be acceptable?


For temporary files created by applications, it won't make much of a difference: they almost always use a protected subdirectory with 0700, or at least a mktemp-generated filename. But for temporary files created by the user, it's a major inconvenience – you no longer know what you've put in there, even if you want to just remove it.

If you really want to isolate different users' files in /tmp, do that through namespaces: pam_namespace.so can create a fully separate view of /tmp for every user, and PrivateTmp= can do the same for systemd-managed services. (A special filesystem similar to bindfs could also provide this, especially for non-Linux operating systems.)

  • This is perfect, thank you so much for the recommendation! – Jared Brandt Aug 5 '18 at 0:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.