Linux Cleanup of /tmp Directory

Here are the arguments for utility I've come up with so far:

Modern kernels fix the /lib/ld-linux.so hole, so that it won't be able to map executable pages from a noexec filesystem.

The interpreters point is certainly still a concern, though I think less of one than people might claim. The reasoning I can come up with is that there have been numerous privilege escalation vulnerabilities that relied on making particular malformed syscalls. Without an attacker providing a binary, it would be much harder to make evil syscalls. Also, script interpreters should be unprivileged (I know this has historically sometimes not been the case, such as with an suid perl), and so would need their own vulnerability to be useful in an attack. Apparently, it is possible to use Python, at least, to run some exploits.

Many 'canned' exploits may try to write and run executables in /tmp, and so noexec reduces the probability of falling to a scripted attack (say in the window between vulnerability disclosure and patch installation).

Thus, there's still a security benefit to mounting /tmp with noexec.

As described in Debian's bug tracker, setting APT::ExtractTemplates::TempDir in apt.conf to a directory that is not noexec and accessible to root would obviate the debconf concern.

I am unsure if the java applet will actually look at the environment variables before it starts, but what you can do it edit /etc/profile and add the following lines:

if [[ -O /home/$USER/tmp && -d /home/$USER/tmp ]]; then
        TMPDIR=/home/$USER/tmp
else
        # You may wish to remove this line, it is there in case
        # a user has put a file 'tmp' in there directory or a
        rm -rf /home/$USER/tmp 2> /dev/null
        mkdir -p /home/$USER/tmp
        TMPDIR=$(mktemp -d /home/$USER/tmp/XXXX)
fi

TMP=$TMPDIR
TEMP=$TMPDIR

export TMPDIR TMP TEMP

To make it a true tmp directory (as in the files go away when the session is ended, you'll want to edit the user's .bash_logout as well as the skeleton .bash_logout (/etc/skel/.bash_logout) to include the following:

if [ -O $TMPDIR && -d $TMPDIR ]; then
        rm -rf $TMPDIR/*
fi

The logout portion is dangerous is the variable doesn't get set and your logged in as root! I wouldn't add this to the root account or anyone that is a member of the wheel group! Proceed at your own caution.