I am starting a fresh install of Ubuntu MATE 24.04.5.
I instinctively believe that a dedicated /tmp partition would offer some significant benefits, from the standpoint of disk fragmentation, not counting what I have seen mentionned as security benefits, by assigning its own mount options to restrict some behaviours.
For a Desktop installation (no server action here), would anyone with such experience have recommendations regarding the need for, and meeting sensible limitations, of both
a minimum GB size, and
a maximum GB size ?
Would having a 20GB partition be reasonable … or is that grossly oversize?
Not having really done monitoring of the usage, I have no clue. Application profile (in order of decreasing usage) is
bash
GVim
Firefox
home-built IPTABLES firewall, using IPsets for while-/black-lists to block out designated country IP ranges
Well, my instinctive belief is that benefits of using a dedicated HD partition as /tmp are disputable at least.
First, /tmp content is not supposed to survive reboots. AFAIK, it is cleared automagically. N.B. /var/tmp preserves files across reboots.
Next to that, any more or less decent application clears its temporary files on exit.
I believe a user can not predict volume of temporary files. The most difficult case is estimation of image/audio/video editing applications’ needs.
Let me disagree, please. Limiting an application access to a (single shared) /tmp directory is not a trivial task. Ok, let’s assume that /tmp is ‘secured’. Fine, and what about other home directories of the user who launched the application in question? IMHO, the proper answer to security question would be sandboxing/containerisation.
Time to time I see posts which mention information security problems. Usually I refrain myself from discussing them. And now for some obscure reasons I can not help a desire to discuss some points from the article mentioned by @tkn.
The first point is to protect root filesystem free space from exhaustion. The next point is to prevent apps from creating dev files and running code/scripts with elevated (suid) privileges. Ok.
You see, information security is about finding a balance between (1) actual risk, (2) time, effort and money being invested in risk mitigation and (3) desired and/or actual result. So far, so good.
It’s time to find out how often these risks materialise? I’m afraid that 99.99% of users would answer “Well… never?”
Next to it, I’d like to mention that ‘/tmp’ is not the only r/w/x directory available for application. Actually, any user-invoked application is being executed with the user’s privileges and can use user’s home directory.
Finally, filesystem reserves some disk space for root user. That is when OS reports that disk is full, then root still can always ssh-in or login locally to take care.
Thank you, Eugene. After reviewing this and the othe reference from Thom, I believe the status quo, /tmp as a directory on root partition, should persist.
