docs: discourage `/tmp/lima` on shared hosts (and deprecate it?)

[AkihiroSuda]

Using /tmp/lima is discouraged on shared hosts, as another user on the host can peek/poke the directory.

Maybe we should deprecate and remove it in v2.0 ?
A user can still enable the directory by specifying --mount /tmp/lima:w.

[jandubois]

Using /tmp/lima is discouraged on shared hosts, as another user on the host can peek/poke the directory.

Only users with the same GID can poke because we create the directory with 750 permissions. Maybe we should create non-existing directories with 700 instead?

Since /tmp normally has the sticky bit set, only the owner or root can change the permission flags, even if the user otherwise has write access to the directory itself.

[jandubois]

SSH agent forwarding puts the agent socket in a directory on /tmp, relying on file mode protection bits being sticky. If it is good enough for that use case, then it should be good enough for /tmp/lima.

[AkihiroSuda]

Maybe we should create non-existing directories with 700 instead?

Yes, but TOCTOU still has to be cared carefully

BTW, in the current design multiple users cannot run Lima simultaneously by default, so it should be renamed to /tmp/lima-{{.Username}}?

[jandubois]

BTW, in the current design multiple users cannot run Lima simultaneously by default, so it should be renamed to /tmp/lima-{{.Username}}?

We currently use {{.GlobalTempDir}} in our default mounts:

mounts:
- location: "{{.GlobalTempDir}}/lima"
  mountPoint: /tmp/lima
  writable: true

We talked about using {{.TempDir}} whenever we are willing to make an incompatible change (Lima 2.0 release). It will use the value of $TMPDIR instead, so should be a private directory.

We could add additional code that checks if the return value is still /tmp, and if it is, we check if /run/user/$UID exists, and use that if it does.

It would only affect Linux, as macOS always has $TMPDIR pointing to a private temp directory.

Not sure I like it though, a bit too much magic, but what do you think?

[jandubois]

Maybe we should create non-existing directories with 700 instead?

It looks like this is currently not very consistent. We seem to create directories for forwarded sockets with 750 permissions. Mount locations are created with 755 when using reverse-sshfs and 750 when using virtiofs.

I would suggest to change all of them to 700. This only applies to directories created by Lima. If they already exist, then their existing permissions should not be changed.

[afbjorklund]

This was one of the reasons for making /tmp/lima into a variable:

• Add abstraction for the default /tmp/lima directory ? #2339

The other reason was that Fedora puts /tmp in RAM so the space is limited...

If you are doing something like building images, might want to use /var/tmp