Isolate Session Files with pam_namespace Safely

A shared /tmp or a shared home directory across a multi-user box is exactly the kind of thing pam_namespace exists to stop. It gives selected directories a separate per-user or per-context instance at session start. This guide configures that PAM session module and verifies it without guessing what the mount namespace is doing. The examples target the installed Linux-PAM package libpam-modules 1.5.3-5ubuntu5.7.

Allow about thirty minutes, plus a maintenance window if you are changing a real login service. You need root access, a test account, a PAM service that opens sessions, and a recovery route such as an existing root shell.

1. Understand the two files involved

• It is a session module, not a command. pam_namespace reads /etc/security/namespace.conf and files in /etc/security/namespace.d when a session opens.
• It must be added per service. The module has to be placed in the session group for each PAM service that needs the isolation.

Check the installed module and configuration paths before editing anything:

$ dpkg-query -W -f='${Package} ${Version}\n' libpam-modules:amd64
libpam-modules 1.5.3-5ubuntu5.7
$ ls -l /usr/lib/x86_64-linux-gnu/security/pam_namespace.so /etc/security/namespace.conf
$ ls -ld /etc/security/namespace.d

2. Choose one narrow directory rule

Each non-comment line in namespace.conf has four fields:

polydir instance_prefix method list_of_users

• polydir is the directory seen by the session.
• instance_prefix is where the backing instance is created.
• method selects the differentiation method.
• list_of_users is blank for everyone, or prefixed with ~ to limit the rule to those listed users instead.

For a first test, isolate a disposable directory for one named account. Run the following as root, after creating the instance parent with the required restrictive mode:

# install -d -o root -g root -m 000 /srv/pam-namespace/instances
# cp --preserve=mode,ownership /etc/security/namespace.conf /etc/security/namespace.conf.bak
# printf '%s\n' '/srv/pam-test /srv/pam-namespace/instances/ user ~pamtest' >> /etc/security/namespace.conf

The user method differentiates instances by user name, so the example gives pamtest its own instance without touching other users. The instance parent must exist and, by default, have mode 0000. Do not use ignore_instance_parent_mode to make a convenient but unsafe directory work.

# tail -n 1 /etc/security/namespace.conf
/srv/pam-test /srv/pam-namespace/instances/ user ~pamtest

3. Add the module to one test service

Choose a PAM service you can test without risking your only administrative access. Add the module as the last line in that service's session group:

session required pam_namespace.so

Make a backup before editing the service file, then add the line to /etc/pam.d/LOGIN_SERVICE, replacing the placeholder with the real service name:

# cp --preserve=mode,ownership /etc/pam.d/LOGIN_SERVICE /etc/pam.d/LOGIN_SERVICE.bak
# editor /etc/pam.d/LOGIN_SERVICE

4. Open a fresh session and verify the instance

The namespace is set up when the PAM session opens. Existing shells do not acquire it just because the files changed. Log in as pamtest through the service you edited, then compare the directory view with an unisolated session:

$ touch /srv/pam-test/created-by-pamtest
$ ls -ld /srv/pam-test
$ findmnt -T /srv/pam-test
$ printf 'session status: %s\n' "$?"
session status: 0

The exact findmnt output depends on the host. What matters is that the path is mounted or otherwise presented through the instance for pamtest, and that a second user's session does not see the same contents. Test the second account with a harmless listing before placing real data in the directory.

5. Use the other methods deliberately

• tmpfs. Mounts a tmpfs instance and accepts mount options through mntopts=, for example tmpfs:create=0700,owner,group:mntopts=size=64M,nosuid,nodev,noexec. Check the exact field parsing on your target before deploying this form; noexec, nodev and nosuid change what the instance can do.
• tmpdir. Creates a temporary instance that is removed when the session closes. Both this and tmpfs are service-impacting if applications expect shared files.
• level and context. Depend on SELinux. The caller or pam_selinux.so must establish the relevant execution context, otherwise the module falls back to user-based differentiation. The optional shared flag can make context and level instances shared between users, which weakens the separation and should have a specific justification.

/srv/pam-cache /srv/pam-namespace/cache/ tmpfs:create=0700,owner,group:mntopts=size=64M,nosuid,nodev,noexec ~pamtest

If you use an instance initialisation script, the installed documentation describes /etc/security/namespace.init and an iscript= override relative to /etc/security/namespace.d. Make such a script root-owned, non-writable by ordinary users, and test its arguments with a disposable directory. An init script runs as part of session setup, so a failure there can become a login failure.

6. Recover from a bad test

Before removing anything, close the test session and make sure no process still uses its private namespace. Then restore the PAM file and remove only the rule you added:

# cp --preserve=mode,ownership /etc/pam.d/LOGIN_SERVICE.bak /etc/pam.d/LOGIN_SERVICE
# editor /etc/security/namespace.conf
# findmnt -T /srv/pam-test
# ls -la /srv/pam-namespace/instances