Arch Linux

jumperes

Member

Registered: 2026-08-10

Posts: 1

Polyinstantiated /tmp

I tried setting up polyinstantiated /tmp on Arch Linux. I couldn't find any guide about this specific to Arch Linux. Pretty much all I could find was from RHEL docs.
The process involves configuring /etc/security/namespaces.conf and making sure pam calls pam_namespace.so. The document mentions putting this call in /etc/pam.d/login:

session required pam_namespace.so

I did this and ran into this issue where anything started by the systemd user manager was still using the global /tmp. This issue was actually fixed upstream by adding a call to pam_namespace into systemd's pam module systemd-user. However on Arch Linux this upstream config file is replaced by Arch's own version which does not have a call to pam_namespace.

Here's a list of solutions I came up with for this situation. I am unsure what's the right thing to do since I'm out of my depth here.

1. If I add "session required pam_namespace.so" to /etc/pam.d/login and the systemd-user module, /tmp is polyinstantiated properly for local logins. The biggest problem is that the systemd-user file is not in /etc/pam.d but in /usr/lib/pam.d.
a. If I override the file in /etc/pam.d it doesn't get updated with the systemd package. (I guess I could use a pacman hook that automatically patches the file when it gets updated.)
b. Arch packagers could include pam_namespace in their version of the systemd-user pam module. /usr/lib/pam.d/systemd-run0 does contain a call to pam_namespace, so why not systemd-user too?

2. The RHEL docs mention to also put the call to pam_namespace to the modules for su, sudo, ssh and sshd as needed which I could do but I also noticed that on Arch Linux login, remote, runuser and sshd include system-login directly or indirectly.
Would it be better to put pam_namespace in just the system-login, sudo and the systemd-user modules?
- I still have to deal with the systemd-user module being in /usr/lib/pam.d

3. "session include system-auth" seems to be in all modules of interest (login, sudo, sshd, systemd-user) either directly or indirectly. If pam_namespace is called multiple times the new instance of /tmp will be nested inside the previous instance. However this appears to be fixed by providing the argument unmnt_remnt to pam_namespace. In /etc/pam.d/system-auth:

session required pam_namespace.so unmnt_remnt

Is this a sane option? This would especially avoid having to touch /usr/lib/pam.d/systemd-user.
Downsides I can think of:
- The commit message of the fix to systemd's upstream pam states "not suitable for inclusion in the shared part of the stack (e.g. @system-auth on Fedora/RHEL systems), because for example su/sudo/runuser should not include them." (Although I don't think this is an issue? At least for me. /etc/security/namespaces.conf allows whilelisting specific users so a sudo targeting the whitelisted root account will be unaffected anyways. And a su, sudo or runuser targeting an unprivileged user should be polyinstantiated as far as I'm concerned.)
- This would also affect other services like crond, system-services, chpasswd, newusers and passwd. I have no clue which side-effects this has.

Last edited by jumperes (2026-08-10 20:11:39)