13

For some reason, when I try to save a file (generated by PHP under /www/appname/module) - it is saved under

/tmp/systemd-private-015eb2e9f67b4eef862c68e99fe0ba30-apache2.service-9h6i08

and when aiming files to get saved under

/tmp/somename

files get saved under

/tmp/systemd-private-015eb2e9f67b4eef862c68e99fe0ba30-apache2.service-9h6i08/tmp/somename.

How do i disable this feature and just save files "regularly" to the /tmp directory?

What is the purpose of this default feature anyway?

Rick Sanchez
  • 241

2 Answers2

11

That is a systemd security setting that creates a service specific private temp directory.

Your apache systemd unit will file have a setting: 

...
[Service]
ExecStart=...
PrivateTmp=yes
...

This option will ensure that the /tmp directory the service will see is private and isolated from the host system's /tmp. /tmp traditionally has been a shared space for all local services and users. Over the years it has been a major source of security problems for a multitude of services. Symlink attacks and DoS vulnerabilities due to guessable /tmp temporary files are common. By isolating the service's /tmpfrom the rest of the host, such vulnerabilities become moot.
Source: http://0pointer.de/blog/projects/security.html

You can configure multiple services to share a PrivateTmp with JoinsNamespaceOf= which may be desirable to setting PrivateTmp=no

HBruijn
  • 80,330
  • 24
  • 138
  • 209
0

My PrivateTmp said true, not yes. Changed it to false. Not sure if it takes other values like "no", "false", etc.

Note I needed to systemctl daemon-reload after changing the service unit then systemctl restart apache2.

Andrew DeFaria
  • 101