Why bind-mount /var/tmp to /tmp?

Question

I've read in several places that it is recommended to bind-mount /var/tmp to /tmp. This can be done by adding the following line to /etc/fstab:

/tmp /var/tmp none rw,noexec,nosuid,nodev,bind 0 0

How can this be beneficial? In other words why should we bind-mount /var/tmp to /tmp ?

Solution 1

The Filesystem HierarchyStandard says:

• /tmp/ Temporary files. Often not preserved between system reboots.
• /var/tmp/ Temporary files to be preserved between reboots.

For example: if an processus is launched every 5 minutes and needs to store some data between every launch, it will rather store them in /var/tmp/.

Solution 2

There may be some system safety reason for bind-mounting /var/tmp.

By mounting /var/tmp, the path /var/tmp will stop being an ordinary subdirectory within the / root filesystem and become a distinctly mounted filesystem. This mounting would - as indicated by your example fstab line -

/tmp /var/tmp none rw,noexec,nosuid,nodev,bind 0 0

enable us to trigger some safety related mount options like nosuid and noexec which would act as some additional safety mechanism to avoid the execution of any potentially distrusted temporary data in the /var/tmp path.

Comments

[DevSolar]

But that would also work if you simply had /var/tmp reside on an individual partition. It's not really related to bind-mounting /var/tmp to /tmp...

[humanityANDpeace]

@DevSolar Of course the answer is only one suggested motive for bind-mounting /var/tmp to tmp. The /etc/fstab code of the OP contained the nosuid,noexec and nodev flags and this suggested the motive which I presented as one potential reason. Consider that /tmp and /var/tmp are likely places where attackers might have write access. Therefore bind-mounting the directory can tighten security a bit more. This is why I used bind-mounts.

[humanityANDpeace]

@DevSolar Your suggestion about the option for an individual partition provokes an additional reason for the OP's question. /tmp might reside on a faster device as the / root filesystem (and by this also the /var directory) and the of the given fstab line wanted to have any temporary data using the same (i.e. faster) device as /tmp. Possibly there are still some other conceivable reasons we have not thought about. If you can find one that is in very closely linked to the /var/tmp and /tmp directories I'd be glad to learn.