Systemd Private Tmp Folders - Revision history

Beard: Created page with "In systemd, services can be configured to have a private tmp folder. This can be confusing if you don't know about it. For example, Apache may have a private tmp folder of
2019-07-01T20:52:17Z

Created page with "In systemd, services can be configured to have a private tmp folder. This can be confusing if you don't know about it. For example, Apache may have a private tmp folder of <c..."

New page
In systemd, services can be configured to have a private tmp folder. This can be confusing if you don't know about it.

For example, Apache may have a private tmp folder of <code>/tmp/systemd-private-<GIBERISH>-apache2.service-<GIBERISH></code>, and if you use PHP to create a file <code>/tmp/test.txt</code> it will actually end up in <code>/tmp/systemd-private-<GIBERISH>-apache2.service-<GIBERISH><b>/tmp/test.txt</b></code>.

This is configured in the service file. In Debian-based systems, it's <code>/lib/systemd/system/SERVICENAME.service</code> and in other systems it's <code>/usr/lib/systemd/system/SERVICENAME.service</code>.

This is what my Apache service file looks like:
<source lang="cfg">
[Unit]
Description=The Apache HTTP Server
After=network.target remote-fs.target nss-lookup.target

[Service]
Type=forking
Environment=APACHE_STARTED_BY_SYSTEMD=true
ExecStart=/usr/sbin/apachectl start
ExecStop=/usr/sbin/apachectl stop
ExecReload=/usr/sbin/apachectl graceful
PrivateTmp=true
Restart=on-abort

[Install]
WantedBy=multi-user.target
</source>

You can see the value <code lang="cfg">PrivateTmp=true</code> configures Apache to use a private tmp. If you change that to <code>false</code> and restart the Apache service, then when you refer to <code>/tmp/test.txt</code> in PHP, it will actually be in that location in the file system.

I would avoid changing this, however, because using a private tmp is more secure. You could easily find the temp file from a bash script like this instead of referring to it directly:
<source lang="shell">
tempfile="$(find /tmp/ -name test.txt)"
</source>