In this lesson, you will learn how to apply specific filesystem flags to /tmp and /var/tmp to prevent users from hijacking or snooping on each other’s temporary files.
The Problem with Shared Storage
In a multi-user environment, the /tmp directory is a "global" space where any user can create files. Without strict controls, a malicious user could perform a "symlink attack," creating a symbolic link in /tmp that points to a sensitive system file (like /etc/passwd). If a privileged process writes data to that location, it might accidentally overwrite critical configuration files.
The Sticky Bit Solution
To prevent this, Linux relies on a specialized permission flag known as the "Sticky Bit" (represented by the t character). When the sticky bit is set on a directory, it ensures that even if a user has write and execute permissions on that directory, they can only delete or rename files that they personally own.
You can check if your /tmp directory has this protection enabled by running ls -ld /tmp:
drwxrwxrwt 15 root root 4096 Oct 25 10:00 /tmp
Notice the final character in the permissions string is t instead of x. This confirms the sticky bit is active.
Hardening with Mount Options
Beyond the sticky bit, you can further restrict temporary storage by applying specific mount flags at the filesystem level. For instance, you can mount /tmp with the noexec flag to prevent attackers from executing malicious binaries directly from temporary storage, and the nosuid flag to ignore SUID bits on files within that directory.
To see how your /tmp is currently mounted, run:
mount | grep /tmp
If you ever need to manually secure a temporary partition (though most modern distributions handle this automatically), you would use the chmod +t command to set the sticky bit and verify your /etc/fstab configuration includes nosuid, nodev, and noexec options for shared temporary mount points. By restricting who can manipulate files and preventing the execution of code from these volatile areas, you create a much safer baseline for all system users.
Key Takeaway: Use the sticky bit (+t) to ensure users can only delete their own files in shared directories, and combine this with noexec and nosuid mount flags to stop unauthorized code execution.