Install libpam-tmpdir (private per-session TMPDIR)
libpam-tmpdir provides pam_tmpdir.so, a PAM session module that creates a per-user directory (/tmp/user/<uid>, mode 0700) at session open and points TMPDIR and TMP at it. Users therefore stop sharing one world-writable /tmp, which removes the ground for the classic symlink and predictable-filename races between local accounts. No standard mandates it: Pavois carries it as a Debian defence-in-depth practice, and it only pays off on hosts with several human users.
Checked against what is installed or registered, packages present/absent, account databases.
What Pavois checks
Pavois asserts that libpam-tmpdir is present in the dpkg inventory. This is an inventory-state control: it proves the module is installed, not that it sits in the PAM stack, and not that a given process honours TMPDIR. On Debian the package's pam-auth-update profile normally adds session optional pam_tmpdir.so to /etc/pam.d/common-session, but a stack rebuilt by hand or a profile disabled afterwards still passes this rule while every session keeps using the shared /tmp. Confirm the effective TMPDIR on a fresh login (see Verify).
describe package('libpam-tmpdir') do
it { should be_installed }
endHow to verify it is applied
Run dpkg -l libpam-tmpdir and confirm the state column reads ii:
ii libpam-tmpdir 0.09+nmu1 amd64 automatically create a private tmp dir for each user
Then prove it is effective: grep pam_tmpdir /etc/pam.d/common-session must return a session optional pam_tmpdir.so line, and a new SSH login must show the private directory:
$ echo $TMPDIR
/tmp/user/1000
$ ls -ld /tmp/user/1000
drwx------ 2 alice alice 40 Jul 14 09:12 /tmp/user/1000
Inspect & investigate
No logs of its own. pam_tmpdir is a library invoked inside the PAM session stack: it writes no file and produces no event when it works. Only its failures surface, as PAM messages in /var/log/auth.log (journalctl), for instance when the module cannot create the directory. The logs will never tell you whether a process actually used the private directory: the only observable evidence is the environment of a live session (cat /proc/<pid>/environ) and the content of /tmp/user/.
Remediation
The Pavois harden plan installs the libpam-tmpdir package with the system package manager (package resource, action install). Activation is left to the package's own pam-auth-update profile, which Debian and Ubuntu enable at install time; Pavois does not rewrite the PAM stack, precisely because an edit there is the fastest way to lock everyone out of a host.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | libpam-tmpdir |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without it, every account writes into the same /tmp: the sticky bit stops one user deleting another's files, but it does not stop a hostile local user from pre-creating a predictable filename, or a symlink pointing at a victim's file, and letting a careless program follow it. The protection is nonetheless partial, and it is fair to say so: only processes started inside a PAM session inherit TMPDIR, so system services, cron jobs and anything launched by systemd keep using /tmp, and any program with a hardcoded /tmp/... path ignores the variable outright. Side effects to expect: scripts that assume TMPDIR is /tmp (or that a temporary file is visible to another user) break; a sudo or su transition may carry the caller's TMPDIR into the target's environment unless env_reset clears it, which would leave root writing into a user-owned directory; and if /tmp is a tmpfs, the per-user directories consume that same limited size budget.