# /etc/security/namespace.conf

[0] Fix | Delete

#

[1] Fix | Delete

# See /usr/share/doc/pam-*/txts/README.pam_namespace for more information.

[2] Fix | Delete

#

[3] Fix | Delete

# Uncommenting the following three lines will polyinstantiate

[4] Fix | Delete

# /tmp, /var/tmp and user's home directories. /tmp and /var/tmp will

[5] Fix | Delete

# be polyinstantiated based on the MLS level part of the security context as well as user

[6] Fix | Delete

# name, Polyinstantion will not be performed for user root and adm for directories

[7] Fix | Delete

# /tmp and /var/tmp, whereas home directories will be polyinstantiated for all users.

[8] Fix | Delete

# The user name and context is appended to the instance prefix.

[9] Fix | Delete

#

[10] Fix | Delete

# Note that instance directories do not have to reside inside the

[11] Fix | Delete

# polyinstantiated directory. In the examples below, instances of /tmp

[12] Fix | Delete

# will be created in /tmp-inst directory, where as instances of /var/tmp

[13] Fix | Delete

# and users home directories will reside within the directories that

[14] Fix | Delete

# are being polyinstantiated.

[15] Fix | Delete

#

[16] Fix | Delete

# Instance parent directories must exist for the polyinstantiation

[17] Fix | Delete

# mechanism to work. By default, they should be created with the mode

[18] Fix | Delete

# of 000. pam_namespace module will enforce this mode unless it

[19] Fix | Delete

# is explicitly called with an argument to ignore the mode of the

[20] Fix | Delete

# instance parent. System administrators should use this argument with

[21] Fix | Delete

# caution, as it will reduce security and isolation achieved by

[22] Fix | Delete

# polyinstantiation.

[23] Fix | Delete

#

[24] Fix | Delete

#/tmp /tmp-inst/ level root,adm

[25] Fix | Delete

#/var/tmp /var/tmp/tmp-inst/ level root,adm

[26] Fix | Delete

#$HOME $HOME/$USER.inst/ level

[27] Fix | Delete

[28] Fix | Delete