Casper.Dik at Sun.COM writes: > Unfortunately the use of TMPDIR is inherited across "su" and > then, when users assume roles, TMPDIR no longer works.
That point would seem to be a show-stopper to me. Having an RBAC role fail to work because $TMPDIR is now set (when it wasn't before) and owned by the original user would be an incompatible change and clearly a Bad Thing. I've been staying out of this particular issue until now, as I could see both sides of it. But it looks now like the weight of evidence is against the proposal: not just RBAC damage, but also unnecessary *extra* clutter in /tmp (due to the one-per-user directories, even if no temp files are used), but also the fact that admins can already set this up if they want, that the target of "easy to use" (the isolated, one-user system) won't benefit at all, and that it seems to fix a non-existent problem (who cares what's in /tmp anyway?) all argue against doing this. As it's no longer "obvious" and thus not appropriate for a fast-track, if that's not removed from the proposal, I'll derail for a full review and a written opinion. -- James Carlson, Solaris Networking <james.d.carlson at sun.com> Sun Microsystems / 1 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677
