Improve security with polyinstantiation

If you’re concerned about protecting world-writeable shared directories such as /tmp or /var/tmp from abuse, a Linux® Pluggable Authentication Module (PAM) can help you. The pam_namespace module creates a separate namespace for users on your system when they login. This separation is enforced by the Linux operating system so that users are protected from several types of security attacks. This article for Linux system administrators lays out the steps to enable namespaces with PAM.


To improve security, it’s often wise to use more than one method of protection (also called “defense in depth”). That way, if one method is breached, another method remains operational and prevents further intrusion. This article describes a way to add another layer of depth to your security strategy: using PAM topolyinstantiate world-writeable shared directories. This means that a new instance of a directory, such as /tmp, is created for each user.

Polyinstantiation of world-writeable directories prevents the following types of attacks, as Russell Coker illustrates in “Polyinstantiation of directories in an SELinux system” (see Resources):

  • Race-condition attacks with symbolic links
  • Exposing a file name considered secret information or useful to an attacker
  • Attacks by one user on another user
  • Attacks by a user on a daemon
  • Attacks by a non-root daemon on a user

However, polyinstantiation does NOT prevent these types of attacks:

  • Attacks by a root daemon on a user
  • Attacks by root (account or escalated privilege) on any user

How PAM and polyinstantiation work

PAM creates a polyinstantiated private /tmp directory at login time within a system instance directory; this redirection is transparent to the user logging in. The user sees a standard /tmp directory and can read and write to it normally. That user cannot see any other user’s (including root’s) /tmp space or the actual /tmp file system.

Polyinstantiated user directories are neither hidden nor protected from the root user. If you are interested in that level of protection, SELinux can help. The configuration examples provided here should work whether or not you have enabled SELinux. See Resources for links to more information about using SELinux.

Enabling polyinstantiation

This section shows you how to enable polyinstantiation of /tmp and /var/tmp directories for users on your system. It also describes the optional configuration steps necessary to accommodate X Windows or a graphical display manager. I used Red Hat Enterprise Linux 5.1 (RHEL 5.1) to write this article, but you can try the procedures described here on any Linux distribution that includes the pam_namespace module.

First we’ll edit namespace.conf.

Edit namespace.conf

The first file you’ll edit is /etc/security/namespace.conf, which controls the pam_namespace module. In this file, list the directories that you want PAM to polyinstantiate on login. Some example directories are listed in the file included with PAM and are commented out. Type man namespace.conf to view a comprehensive manual page. The syntax for each line in this file is polydir instance_prefix method list_of_uids.

Briefly, here is what these variables represent:

  • polydir is the absolute pathname of the directory to polyinstantiate.
  • instance_prefix is the base directory of the new polyinstantiated user directory.
  • method can be userlevel, or context.
  • list_of_uids is a list of user names for which PAM will NOT polyinstantiate their directories.

In this example, you are not using SELinux, so you must specify the user for the method. You can use the variables $USER and $HOME within the configuration file if needed.

Listing 1 creates a private /tmp and /var/tmp namespace instance for each user on the system except root and adm.

Listing 1. /etc/security/namespace.conf

The /tmp and /var/tmp directories do not have to be located on separate filesystems; they can be directories on a single file system. The directories /tmp/tmp-inst and /var/tmp/tmp-inst must be created once, manually, with file mode 000 before polyinstantiation will work. If the directories are not created correctly, logins will fail.

Type the following commands while logged in as the root user to create these directories:

Modify PAM

Next, modify the PAM configuration files to add the module to the list of required modules to run on login from the console and from the secure shell. Edit the /etc/pam.d/login and /etc/pam.d/sshd files to place the module on the last line in each file. Listing 2 and Listing 3 show where to add the module in /etc/pam.d/login and /etc/pam.d/sshd, respectively:

Listing 2. Adding the PAM module to /etc/pam.d/login
Listing 3. Adding the PAM module to /etc/pam.d/sshd

Enable X Windows

Because of the way the X Window system uses temporary directories, graphical sessions might fail for users with a polyinstantiated /tmp directory. PAM executes the contents of the /etc/security/namespace.init file during login if pam_namespace is specified in any files in the /etc/pam.d directory. Use this file to make the necessary changes to allow X Windows to start correctly. A default namespace.init file is included with RHEL 5.1, but I have modified it slightly in Listing 4.

Listing 4. Enables X Windows to start correctly

Configure the Gnome Display Manager

Configuring the Gnome Display Manager (GDM) is easy. Add the module to the list of required modules in the /etc/pam.d/gdm file. Listing 5 shows an example.

Listing 5. Configuring the Gnome Display Manager

If you are using the X Display Manager (XDM) instead of GDM, configure the /etc/pam.d/xdm file in the same way. Now both the graphical logins and the command-line logins result in polyinstantiated /tmp and /var/tmp directories.

Finishing up: Allowing for errors

If PAM encounters an error when running the module, the login session for the user trying to login will fail. Until you are sure that things are operating as you intend, allow logins to continue in case of an error. To enable the ignore_config_error option, add it to the end of the line in each file in the /etc/pam.d directory where you added the module.

For example, in the /etc/pam.d/login file, edit the line containing the module as follows:

session required ignore_config_error

For a complete list of options, see the pam_namespace manual page. After a user logs in, check the file /var/log/secure for errors. When you are satisfied that your PAM configuration is correct, remove the ignore_config_error option.

Finishing up: Results

After you have modified and saved the configuration files, choose a non-root user account to test and log out all instances of that user from the system. Log in again and a new polyinstantiated /tmp and /var/tmp directory will be created for that user. Listing 6 and Listing 7 show what this looks like on the system and from the user’s perspective. In this example, the username is robb.

Listing 6. Console session from the user’s perspective
Listing 7. Console session on the system as root

Because of polyinstantiation, robb’s /tmp directory is isolated in a separate directory under /tmp/tmp-inst/, and robb cannot see the system /tmp directory or any files within it.


While polyinstantiation will not prevent every type of attack, it is a useful addition to your security toolkit that is straightforward to configure. Feel free to experiment by polyinstantiating other directories such as /home. With the ignore_config_error option, mistakes are not fatal, but don’t forget to remove that option after you have finished testing your configuration.

0 (0)
Article Rating (No Votes)
Rate this article
There are no attachments for this article.
There are no comments for this article. Be the first to post a comment.
Full Name
Email Address
Security Code Security Code
Related Articles RSS Feed
Learn how to align an SSD on Linux
Viewed 11884 times since Fri, May 15, 2020
LVM: Recovering Physical Volume Metadata
Viewed 12900 times since Sat, Jun 2, 2018
ZFS: Remove an existing zfs filesystem
Viewed 1917 times since Sun, Jun 3, 2018
LVM basic
Viewed 2012 times since Sat, Jun 2, 2018
OEL 7 – How to disable IPv6 on Oracle Linux 7 – Follow Up
Viewed 9205 times since Wed, Jul 25, 2018
stunnel Securing telnet connections with stunnel
Viewed 1276 times since Sun, Dec 6, 2020
Tip: SSD and Linux. Enable TRIM and check if it works
Viewed 7252 times since Fri, May 15, 2020
How to encrypt a partition with DM-Crypt LUKS on Linux
Viewed 7970 times since Fri, Jul 13, 2018
Linux Linux Network Statistics Tools / Commands
Viewed 8854 times since Mon, Sep 21, 2020
SSH: Execute Remote Command or Script – Linux
Viewed 2123 times since Mon, Feb 18, 2019