Would it make perfect sense to set a default perm on /tmp with ACL's so as any new files/folders created have 700 or 600 permissions ?? Why would any other user besides the one creating the temp files/folders need to access any other files ?

Makes sense to me but thought I'd ask before I implement it in case I am missing anything that will break something.

What do you mean by default perms? Do you mean default perms for the directory itself - 755? Wouldnt that effectively mean that only root or the owner of /tmp could write into /tmp? I'm not sure you would want that.

The way it usually is is that /tmp is set to 1777 which means everyone can do whatever they want with their files. The 1 in 1777 would stand for the sticky bit and this would mean that I can whop Dave's files from /tmp even if I could write into /tmp.

Using ACL's is fine but then unless you have a specific user/group who are the only ones supposed to access these files it's a bit of overkill, specially for something supposed to be world writeable like /tmp. Unless you want to restrict people from using /tmp all together.

Cheers
Arvind

No I mean using ACL default settings on tmp so that any file or folder created by "adam" would be 700 and owner by "adam" and any file or folder created by www-data would be 700 and owner by www-data.

Maybe I am not making sense here, was just thinking out loud how users can read and write others users temp files and how that may be a security risk.

What you're asking for is easily acheived using umask. Incase you're not sure about its usage I'd suggest you read the umask man page over here.

http://www.nada.kth.se/cgi-bin/man?p...s=1&ss=&M=&f=y

Cheers
Arvind

i'm curious if this would work too... i mean, it does sound like it makes sense... but, considering how i've never seen a distro do this, i am compelled to think that something would indeed break...

well, by default other users can read, but they can't write - unless there's something terribly wrong with your umask...

If your umask is set properly and the permissions on your files are OK I really dont think what you want to do would even be necessary. It would be a bit of overkill according to me.

Cheers
Arvind