|
|
Subscribe / Log in / New account

Debian's /tmpest in a teapot

By Joe Brockmeier
June 3, 2024

Debian had a major discussion about mounting /tmp as a RAM-based tmpfs in 2012 but inertia won out in the end. Debian systems have continued to store temporary files on disk by default. Until now. A mere 12 years later, the project will be switching to a RAM-based /tmp in the Debian 13 ("Trixie") release. Additionally, starting with Trixie, the default will be to periodically clean up temporary files automatically in /tmp and /var/tmp. Naturally, it involved a lengthy discussion first.

Join the party

By now, using tmpfs for the /tmp directory is a road well-traveled. Many Linux distributions have already switched to mounting /tmp as a tmpfs. Arch Linux, Fedora, openSUSE Tumbleweed, and many others have all made the switch. Red Hat Enterprise Linux (RHEL) and its clones, as well as SUSE Linux Enterprise Server (SLES) and openSUSE Leap, still default to /tmp on disk. Ubuntu, following Debian, also continues to have a disk-based /tmp rather than using tmpfs.

The knobs to control how /tmp is mounted, and the handling of temporary files, are part of systemd. (On systems where systemd is used, of course.) The upstream defaults for systemd are to mount /tmp as a tmpfs and delete files that have not been read or changed after ten days in /tmp and 30 days for those stored in /var/tmp. Debian Developer and systemd contributor Luca Boccassi recently decided it was time to revisit the topic of /tmp as a tmpfs, and start deleting temporary files in /tmp and /var/tmp.

On May 6 Boccassi resurrected a discussion from Debian's bug tracker that started in 2020 and that had trailed off in July 2022 without resolution. The bug was submitted by Eric Desrochers, who complained that Debian's systemd implementation did not clean /var/tmp by default. Michael Biebl wrote that this was a deliberate choice to match Debian's pre-systemd behavior. After a long period of inactivity, Biebl suggested in October 2021 (and again in July 2022) that Desrochers raise the topic on the Debian devel mailing list. That never happened.

In reviving the topic, Boccassi declared that it was time to bring Debian's defaults in line with upstream and other Linux distributions by making /tmp a tmpfs, and cleaning up /tmp and /var/tmp on a timer. He planned to apply those changes in the next systemd upload to Debian unstable within a week, with instructions in the NEWS file on how to override the changes for any users who wanted to keep the current behavior. That, in turn, sparked quite a discussion.

The case for and against

Biebl worried about the effect of cleaning up temporary files by default. Currently, he said, Debian only cleans /tmp on boot (which is unnecessary if /tmp is a RAM-based tmpfs) and to never clean up files in /var/tmp. Boccassi answered: "Defaults are defaults, they are trivially and fully overridable where needed if needed." Biebl replied that there is value in aligning defaults across Linux distributions, but argued that Debian has "a larger scope" than a desktop distribution like Fedora. He suggested that it was necessary to "gather feedback from all affected parties to make an informed decision". Boccassi responded that it was impossible to have defaults that would make everyone happy, and he was not looking for hypothetical arguments or philosophical discussions, he wanted facts: "what would break where, and how to fix it?"

Sam Hartman noted that ssh-agent created its socket under /tmp, but it would be better if it respected the $XDG_RUNTIME_DIR setting and created its socket under /run/user. Boccassi agreed and said that he had filed a bug for ssh-agent. Richard Lewis pointed out that tmux stores its sockets in /tmp/tmux-$UID, and deleting those files might mean users could not reattach to a tmux session that had been idle a long time. Boccassi suggested that using flock() would be the right solution to stop the deletion, and said he had filed a bug on that as well.

Lewis questioned whether files downloaded with apt source might be considered "old" when they were extracted under /tmp and immediately flagged to be deleted. Russ Allbery said that systemd-tmpfiles would respect the access timestamp (atime) and changed timestamp (ctime), not just the modified timestamp (mtime), "so I think this would only be a problem on file systems that didn't support those attributes". Allbery said he believed tmpfs supports all three.

Some users store information in /var/tmp for long-running jobs, because they want it preserved without being backed up, said Barak A. Pearlmutter. Boccassi dismissed that, saying that those users "assuming they actually exist", can customize the system defaults according to their needs.

Those users do exist, wrote Jonathan Dowland, "[I've] been one of them, I've worked with many of them, it's an incredibly common pattern in academic computing". Making a change to how these files are handled, "should be a very carefully explored decision". He also asked for arguments in favor of the change, and to hold off the change to allow the discussion to continue.

Hartman wished that it was possible to specify that directories under /var/tmp should be deleted entirely or left alone. Boccassi said that was a reasonable enhancement request, and that it had already been filed upstream for systemd.

Allbery eventually admitted surprise at the number of people who reported using /var/tmp "for things that are clearly not temporary files in the traditional UNIX sense". Periodically deleting files in /var/tmp, he said, has been common UNIX practice for at least 30 years:

Whatever we do with /var/tmp retention, I beg people to stop using /var/tmp for data you're keeping for longer than a few days and care about losing. That's not what it's for, and you *will* be bitten by this someday, somewhere, because even with existing Debian configuration many people run tmpreaper or similar programs. If you are running a long-running task that produces data that you care about, make a directory for it to use, whether in your home directory, /opt, /srv, whatever.

Hakan Bayındır said that he did not use /var/tmp, but applications that other people use do. He cited a high-end scientific application that was not under his or other users' control. Allbery argued that this was "not a good design decision" but conceded that may not be helpful if a user or admin does not have control over the application's design. However, he said, it was "playing with fire" to use /var/tmp that way "and it's going to result in someone getting their data deleted at some point, regardless of what Debian does".

Lewis said he still did not understand the rationale for the change. Was there, he asked, "perhaps something more compelling than 'other distributions and upstream already do this'?" That sounded like the original rationale, Allbery said, but he added that moving /tmp to tmpfs should make applications run faster, and reaping files under /var/tmp could help to avoid filling up a partition. Allowing the partition to fill up, he noted, could cause bounced mail, unstable services, and other problems. It may not be a problem for desktop systems, which tend to have enough disk space not to be affected, but for virtual machines that have /var/tmp contained within a small root partition, it is still a concern.

Rolling out changes

In the end, none of the arguments for maintaining Debian's status quo managed to persuade Boccassi to stay his hand. On May 28, Boccassi announced the changes that he had made and uploaded to unstable. As expected, /tmp will become a tmpfs by default, for both new and existing installations of Debian unstable. New installs will use the systemd default behavior. The openssh and tmux packages, he said, had been fixed to provide exceptions to retain their temporary files. A description has been added to the Debian installer to inform users that /tmp is a tmpfs by default, and the changes have been noted in the NEWS file. He also offered to review and merge any changes to the Debian installer that would let users customize those options during installation. Users who want /tmp to remain on disk can override the upstream default with systemctl mask tmp.mount. To stop periodic cleanups of /tmp and /var/tmp users can run touch /etc/tmpfiles.d/tmp.conf.

None of the changes, it should be noted, will affect Debian versions prior to Trixie. Users of Debian stable and oldstable will only encounter these changes on upgrade.

As noted, many distributions have already made these changes without catastrophe. Debian, and its users, should be able to adapt to the new defaults or override them if they are unsuitable for the workloads to be run. At worst, it promises to be a temporary inconvenience.



to post comments

Debian's /tmpest in a teapot

Posted Jun 3, 2024 16:31 UTC (Mon) by iustin (subscriber, #102433) [Link] (2 responses)

Finally! Now to check if the changes actually break my systems where I already switched to tmpfs…

Debian's /tmpest in a teapot

Posted Jun 3, 2024 16:38 UTC (Mon) by bluca (subscriber, #118303) [Link] (1 responses)

As long as you have done so by either adding tmp.mount in /etc or an entry in fstab, it should be a no-op

Debian's /tmpest in a teapot

Posted Jun 3, 2024 16:40 UTC (Mon) by iustin (subscriber, #102433) [Link]

I'm old school, so fstab entry. Thanks for replying!

Debian's /tmpest in a teapot

Posted Jun 3, 2024 17:25 UTC (Mon) by mb (subscriber, #50428) [Link]

I use tmpfs /tmp on Debian since it had been added to the kernel without any problems.
I don't auto-clean it, though. That is not worth the risk, IMO. tmpfs is swapped out to disk if needed.

If cleaning is enabled, it should have a size threshold to not clean files that are less than a couple of kiB in size. Removing these files doesn't really help anybody in todays world with dozens of gigabytes of memory.

Debian's /tmpest in a teapot

Posted Jun 3, 2024 17:46 UTC (Mon) by ju3Ceemi (subscriber, #102464) [Link] (38 responses)

I am surprise they did not talked about memory usage

One usage I've met many times is using /tmp to store temporary files that are too big to be kept in memory : rootfs are likely bigger than 10GB, while memory is more scarse (and while we can keep such files on disk for some time, it is expensive to use memory than way)

Nothing too difficult to handle, I think those users will be able to deal with the change accordingly

Debian's /tmpest in a teapot

Posted Jun 3, 2024 18:09 UTC (Mon) by smurf (subscriber, #17840) [Link] (33 responses)

A RAM /tmp will get swapped out when things become tight. So any memory usage of large files there is, umm, temporary.

Presumably swapping has a bit more overhead than writing directly to disk, but that should be more than offset by all the small files you no longer write to disk.

Debian's /tmpest in a teapot

Posted Jun 3, 2024 18:11 UTC (Mon) by ju3Ceemi (subscriber, #102464) [Link] (24 responses)

Yes
Is swap really a good practice in high-performance computing environment ?

Debian's /tmpest in a teapot

Posted Jun 3, 2024 18:32 UTC (Mon) by atnot (subscriber, #124910) [Link] (2 responses)

Absolutely! If you're working with a lot of data, it is almost guaranteed that at least some of it will be hotter than whatever else you have in memory. It will thus be beneficial to make the best use of the memory you have by using more of it for things like the page cache.

Debian's /tmpest in a teapot

Posted Jun 6, 2024 7:45 UTC (Thu) by taladar (subscriber, #68407) [Link] (1 responses)

Swap can be really annoying though if you have some actual process using too much RAM since everything (including the SSH login to check what is going on) will just be incredibly slow instead of the process being killed before that happens.

Debian's /tmpest in a teapot

Posted Jul 17, 2024 0:54 UTC (Wed) by immibis (guest, #105511) [Link]

You can avoid this with cgroups. Your critical stuff can go in a group with, say, 2GB max memory (or 64) while everything that you want to swap goes in a different group with 62GB max memory (if you have 64).

Debian's /tmpest in a teapot

Posted Jun 3, 2024 18:33 UTC (Mon) by Cyberax (✭ supporter ✭, #52523) [Link] (2 responses)

Surprisingly, yes. Not the old 2x RAM guideline, but some swap helps by freeing RAM.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 15:01 UTC (Tue) by gray_-_wolf (subscriber, #131074) [Link]

Agree. Even on my 128GB RAM server few tens of MB of swap are usually used.

Debian's /tmpest in a teapot

Posted Jun 5, 2024 17:32 UTC (Wed) by piexil (guest, #145099) [Link]

Zram is even better than traditional swap, and 2x ram size actually makes sense too

Debian's /tmpest in a teapot

Posted Jun 3, 2024 18:37 UTC (Mon) by Heretic_Blacksheep (guest, #169992) [Link] (1 responses)

Pretty sure the kernel has some assumptions where virtual memory layouts are concerned regardless of its size or type. x86 in general has had an assumption that disk area was available for extra RAM as needed for 30+ years regardless of its active use. Bad Things Happen when you run out of RAM. As in, unrecoverable and sometimes impossible to diagnose Things.

I can't remember if the Linux kernel will dump its core to /var/crash or if it uses the swap space area for that by default. It's been so long since I saw the kernel completely crash I've forgotten where it puts things that went Boom.

Debian's /tmpest in a teapot

Posted Jun 3, 2024 18:41 UTC (Mon) by ju3Ceemi (subscriber, #102464) [Link]

On the other hand, swap changes nothing here : you can still saturate your memory space, it will just take a bit longer, during which your system will be crippled down

Debian's /tmpest in a teapot

Posted Jun 3, 2024 18:57 UTC (Mon) by mezcalero (subscriber, #45103) [Link] (7 responses)

Yes. Swap is almost always a good idea, because it allows anonymous memory to be swapped out on memory pressure. If you have no swap you thus reduce the pool of memory that can be swapped out (i.e. only mmaped stuff such as executables, libraries and so on, as well as various kernel caches such as dentries/inodes). And a smaller pool of stuff that can be swapped out typically means that that you need to swap out more frequently, because you cannot just swap out the least used stuff. Hence by having no swap you increase memory pressure, and you become more dependent on IO and its latencies.

Hence, add swap. It makes things faster in most cases.

Debian's /tmpest in a teapot

Posted Jun 3, 2024 23:02 UTC (Mon) by josh (subscriber, #17465) [Link] (6 responses)

I've tended to avoid swap for my systems, because if something goes wild and uses too much memory, I don't want the kernel spending a literal minute trying to swap things out to make room for it before finally giving up and killing it or failing an allocation. I *do* want the kernel to be able to swap out things it isn't going to use, but I'd love to be able to say "only swap proactively, if under memory pressure just fire up the OOM-killer".

Debian's /tmpest in a teapot

Posted Jun 3, 2024 23:52 UTC (Mon) by atnot (subscriber, #124910) [Link] (2 responses)

earlyoom/(systemd-)oomd (chose your flavor, I'm sure there's more now) is exactly that. I'd been waiting for someone to bring it up but it is, in my opinion, an absolutely essential thing to have installed on any kind of modern linux desktop.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 0:02 UTC (Tue) by atnot (subscriber, #124910) [Link]

I should say, earlyoom is somewhat technically less rigorous and do be aware that anything based on the PSI metric will not work properly unless you have at least a sensible amount of swap configured. Otherwise pretty much any memory spike will cause enough pressure to trigger an oom kill. (if you're on e.g. ubuntu and have had applications randomly disappearing a lot recently, this may be why)

Debian's /tmpest in a teapot

Posted Jun 5, 2024 23:53 UTC (Wed) by ringerc (subscriber, #3071) [Link]

I've had good results with putting memory hogs like Firefox into their own cgroup, which systemd supports quite well.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 6:39 UTC (Tue) by ibukanov (subscriber, #3942) [Link] (1 responses)

On computers with modern SSD swap is fast and no longer has ill effects on longevity of SSD. With sustained read/write speed of several GB/s at worst one will see a gradual degradation of performance, not a multi-second pause.

If SSD is older, the system uses a magnetic disk or SSD is modern but has to be encrypted with software encryption like LUKS, then use compressed memory like zram. It will also provide the benefits of gradual performance degradation when the system runs out of RAM.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 17:15 UTC (Tue) by patrakov (subscriber, #97174) [Link]

Some server owners cheap out and use SATADOM drives (really, slow, as in 25 MB/s, and low-endurance flash drives with a slightly non-standard SATA interface) as OS disks. Placing swap files or partitions on them is a very bad idea.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 9:22 UTC (Tue) by farnz (subscriber, #17727) [Link]

I get that result with a combination of 1 GiB swap and systemd-oomd, on a system with 64 GiB RAM. That's just enough swap that under memory pressure, I don't immediately start swapping executable pages in preference to less-frequently used data, but not so much swap that I thrash. And this gives systemd-oomd just enough headroom to kill off the actual memory hog, rather than an unfairly maligned victim.

Debian's /tmpest in a teapot

Posted Jun 3, 2024 20:23 UTC (Mon) by NAR (subscriber, #1313) [Link] (2 responses)

I don't know about high performance computing environments, but my personal experience with swapping on desktops/laptops in the past 20 years was that as soon as Linux starts to swap due to some process (usually Chrome or the C code I'm writing) using too much memory, I might be better off reaching for the power button, because rebooting is just way faster than waiting out the system recovering from all that thrashing. I thought that the SSD drives solve this problem, but alas, no. In the 90s when the 486 machines had only a few MBs or RAM and swapping was kind of inevitable, it wasn't this bad.

Debian's /tmpest in a teapot

Posted Jun 3, 2024 20:39 UTC (Mon) by mb (subscriber, #50428) [Link] (1 responses)

Well, there are many reasons for swapping.
What you describe is extreme memory pressure because there's some runaway process or some process is completely overloading the available hardware resources.
You are right that swap hardly helps in these situations.

However, swap is also used to free (likely) completely unused pages from memory and use the free memory for something else that improves performance (e.g. disk cache).
Unused pages in RAM just reduce the amount of usable RAM.

Or it can be used to get rid of tmpfs files from RAM that are never used.

That is all happening in the background and has nothing to do with a runaway or overload scenario.

At the moment I have ~1% of my RAM freed for useful tasks due to swap. That's not much, but it's better than not having it.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 10:25 UTC (Tue) by jhe (subscriber, #164815) [Link]

I never really understood the urgency of having swap until i learned of the missing link: Executable code is mapped into memory as named pages. No memory for the page cache means your machine will saturate its disk I/O reading the code for the currently running processes.

Debian's /tmpest in a teapot

Posted Jun 3, 2024 20:41 UTC (Mon) by flussence (guest, #85566) [Link]

Swap is essential in most HPC setups; you can fit a SI unit order of magnitude more NVMe in a single system than you can for DDR, and the peak bandwidth of both is about even (Zen4 Epyc = 768GB/s DDR5 + 512GB/s×socket PCIe5), so you can swap as fast as your RAM can keep up.

Disabling the swap subsystem will not make things faster in the general case - you just lose a "L5" cache tier and the kernel has less verbs to work with for managing memory pressure. (Incidentally, the whole point of DAMON/DAMOS is to let the kernel use those verbs more effectively. It's intended for NUMA hot/cold balancing, but the distinction between that and swapping is becoming largely academic and I wouldn't be surprised to see it in use on desktop distros in a few years.)

Debian's /tmpest in a teapot

Posted Jun 4, 2024 3:14 UTC (Tue) by Paf (subscriber, #91811) [Link]

It really depends on your HPC environment. Your full up cluster "supercomputer" machines often have no node-local storage at all, so no swap. But that's a different beast - they have NO local storage at all.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 3:48 UTC (Tue) by ringerc (subscriber, #3071) [Link] (2 responses)

Yes, which is why the hostility of Kubernetes to swap drives me quite insane.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 5:42 UTC (Tue) by zdzichu (subscriber, #17118) [Link] (1 responses)

Debian's /tmpest in a teapot

Posted Jun 6, 2024 0:06 UTC (Thu) by ringerc (subscriber, #3071) [Link]

Nope - but the caveats and limitations on it are still pretty crippling.

It has also taken quite a while to make its way through to the CSP-hosted k8s stacks I'm unfortunately stuck with, and then through upgrade cycles.

Debian's /tmpest in a teapot

Posted Jun 3, 2024 18:32 UTC (Mon) by mgedmin (subscriber, #34497) [Link] (5 responses)

tmpfs mounts tend to have a size limit (which defaults to something like 50% of RAM by default, I think?).

There's a slight risk that programs who try to download large files into /tmp might end up filling it up completely and failing.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 6:04 UTC (Tue) by smurf (subscriber, #17840) [Link] (4 responses)

Better than to fill your root partition which might not be large enough either.

Large temporary stuff which you *know* is too large for RAM+swap belongs in /var/tmp IMHO.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 11:25 UTC (Tue) by Wol (subscriber, #4433) [Link] (3 responses)

> Large temporary stuff which you *know* is too large for RAM+swap belongs in /var/tmp IMHO.

That's not what /var/tmp is for ...

Just redefine /tmp as being larger. Running gentoo, I moved a lot of my compilation temporary dirs into /tmp, and seeing as I always run with masses of swap I think I had /tmp defined as maybe three or four times ram? On the basis that nearly all this stuff was pretty much WORN, and if compiling Firefox, or loffice, or gcc, etc etc pushed my machine into swapping, quelle surprise.

But as part of that, I found the definition of /tmp and /var/tmp in the FHS, and discovered that me making /var/tmp a tmpfs too was a big mistake ...

/tmp is defined as "anything that could disappear at any time", so not surviving a reboot was completely within spec.

/var/tmp on the other hand, is stuff "that isn't needed for long, but that must survive a reboot or crash". Don't remember the definition exactly, but it's clearly for recovery information, or working sets that should be deleted by the app but often aren't thanks to a crash, yadda yadda. Stuff that is likely to get orphaned and you don't want cluttering up permanent storage.

Cheers,
Wol

Debian's /tmpest in a teapot

Posted Jun 4, 2024 11:31 UTC (Tue) by adobriyan (subscriber, #30858) [Link] (1 responses)

> Running gentoo
> making /var/tmp a tmpfs too was a big mistake

For new gentooers finding this post: /var/tmp/portage is Gentoo's graveyard of failed builds.

Set up some kind of autocleaner against the directory.

Debian's /tmpest in a teapot

Posted Jun 6, 2024 7:50 UTC (Thu) by taladar (subscriber, #68407) [Link]

No, /var/tmp/portage is Gentoo's place to actually perform those builds. Even if you clean it regularly you will need at least a few dozen GB of space there.

Debian's /tmpest in a teapot

Posted Jun 5, 2024 5:03 UTC (Wed) by wtarreau (subscriber, #51152) [Link]

Same for me, having my home on NFS, I use /tmp for anything temporary (as its name implies), and I can copy there a full SD card of photos, or build an entire distro or series of cross-compilers. I do expect to have all the free space of my / available in /tmp, i.e. ~240GB from a 256GB SSD, something I'll never have in RAM.

When I want something in RAM, I'm using /dev/shm which has been available as a tmpfs everywhere for well over a decade.

While I can understand the rationale for mounting /tmp as a tmpfs, I think that some users will complain that their system is super slow, because while swap does help freeing cold pages, when a system starts to swap out due to filling a tmpfs with lots of stuff, all caches are purged first, and even task switching can be slow because previously inactive processes have been swapped out. These are the situations where you can see processes lag a lot, especially with graphical environments often composed of lots of processes.

Another annoying case is with low-memory systems. I don't know how much RAM debian wants these days, but having only a few gigs in /tmp can definitely be a limiting factor for some users.

I think another approach could be to have /tmp as disk storage and /tmp/ram be ram-based. But there's no solution that would satisfy everyone anyway, so probably that commenting/uncommenting a line in fstab remains the best option. After all, if users are no longer able to add a hash at the beginning of a line in fstab, we probably have much more serious problems to solve!

Debian's /tmpest in a teapot

Posted Jun 3, 2024 21:49 UTC (Mon) by LtWorf (subscriber, #124958) [Link] (1 responses)

Swapping, to make software running faster.

I'm sure there's a lot of situations where that backfires.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 6:08 UTC (Tue) by smurf (subscriber, #17840) [Link]

Your assumption is noted but with the exception of "there's so much memory pressure that the system is swapping like crazy" (implying that without swap the OOM killer would trigger instead; you don't want either of these situations) or possibly "/usr is on a fast SSD but your swap partition lives on rotating rust" I can't think of any.

Debian's /tmpest in a teapot

Posted Jun 3, 2024 18:33 UTC (Mon) by bluca (subscriber, #118303) [Link] (2 responses)

> I am surprise they did not talked about memory usage

That was very much intentional, because that sort of rat-holing is why this failed to happen before. For each and every anecdote about why it's not an issue, there will be an opposite example from somebody else. This is a default that can be trivially customized, and that includes both completely disabling it or setting a max filesystem limit, and a myriad of other combinations. If it works out of the box, great - if not, just customize it as needed.

Debian's /tmpest in a teapot

Posted Jun 3, 2024 19:09 UTC (Mon) by Heretic_Blacksheep (guest, #169992) [Link] (1 responses)

I agree there's likely a near infinite number of reasons why /tmp being on a RAMFS is a Bad Idea, and an equal number of reasons why it's a Good Idea (same with the anecdotes). I kinda agree with the article title that it's a tempest in a teapot. If the use case contraindicates the default, this particular configuration is trivial to change without even a reboot. If you need a whole fleet of deployments, there are tools to manage configurations before creating the deployment image.

Debian's /tmpest in a teapot

Posted Jun 3, 2024 19:20 UTC (Mon) by bluca (subscriber, #118303) [Link]

Exactly - managing fleet-wide changes to small config files in /etc/ has been a solved problem for a long time, and there are dozens of solutions readily available

Debian's /tmpest in a teapot

Posted Jun 4, 2024 10:28 UTC (Tue) by abo (subscriber, #77288) [Link]

While not explicit in the FHS (but perhaps somewhere else), it's usually better to use /var/tmp for large files. It's supposed to be preserved during reboot so it probably isn't tmpfs.

https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch05s15....

Debian's /tmpest in a teapot

Posted Jun 3, 2024 18:29 UTC (Mon) by mgedmin (subscriber, #34497) [Link] (2 responses)

In the year 2000 I was about to travel abroad for studying, and I knew that I wouldn't have Internet access in the dorms. I decided to recursively wget some webcomics like User Friendly and burn them into a CD-ROM, so I would have something to pass the time. I decided that /tmp is the perfect place for a staging area to download a bunch of files and make an ISO image for burning, and I left wget running overnight.

In the morning I discovered a collection of interesting facts: (1) wget sets the mtime according to the Last-Modified header, (2) my system had a daily cron script that deleted old files in /tmp, (3) as a result of (1) and (2) my webcomic archives only had a few of the latest files left.

A Lesson Was Learned that day. (Also, I somehow managed to re-download the files I needed and burn the CD-ROM before my flight.)

Debian's /tmpest in a teapot

Posted Jun 4, 2024 5:55 UTC (Tue) by smurf (subscriber, #17840) [Link]

(4) you should have posted a bug report, if the script had also checked ctime and atime this wouldn't have happened.

Debian's /tmpest in a teapot

Posted Jun 7, 2024 16:20 UTC (Fri) by rkraats (subscriber, #45998) [Link]

This reminds me of an issue with tmpwatch I ran into about a decade ago (on Fedora). During some experimenting, I did a bind mount of /home on /tmp/somedir, after which I gained a lot of free disk space. After reporting the issue, tmpwatch was improved to be more robust against such.. users. I wonder how systemd would behave here.

Debian's /tmpest in a teapot

Posted Jun 3, 2024 20:01 UTC (Mon) by rknight (subscriber, #26792) [Link] (7 responses)

Debian still supports some systems with very low amounts of RAM available. I have a few arm systems running Debian that only have 64MB or 128MB available. So being able to easily override this change during installation will be necessary to prevent an OOM while installing!

Debian's /tmpest in a teapot

Posted Jun 3, 2024 20:15 UTC (Mon) by bluca (subscriber, #118303) [Link] (2 responses)

Why would that be necessary? There's only a few dozens of bytes on an idle, just-installed minimal system

Debian's /tmpest in a teapot

Posted Jun 3, 2024 21:52 UTC (Mon) by python (guest, #171317) [Link] (1 responses)

A few dozen *Megabytes* is quite huge on a 64Mb system. I also deal with embedded systems but would never dream of cramming Debian onto a 64mb board.

Surely apt would just crash?

Debian's /tmpest in a teapot

Posted Jun 3, 2024 22:24 UTC (Mon) by bluca (subscriber, #118303) [Link]

Not megabytes, bytes. Why would there be dozens of MBs in /tmp/ on an empty, just-installed system? I just booted a just-installed x86_64 Trixie VM and there are 8 empty directories in /tmp/, and nothing else

Debian's /tmpest in a teapot

Posted Jun 3, 2024 21:18 UTC (Mon) by Klaasjan (subscriber, #4951) [Link] (3 responses)

I am interested. What version of Debian are you running on those arm systems? And will the trixie installer support systems with that amount of RAM?

Debian's /tmpest in a teapot

Posted Jun 4, 2024 13:41 UTC (Tue) by rknight (subscriber, #26792) [Link] (2 responses)

See https://forum.doozan.com/list.php?2 for Debian support on different Marvell SOC based devices which include many NAS servers some of which only have 64MB or 128MB of RAM.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 19:39 UTC (Tue) by Cyberax (✭ supporter ✭, #52523) [Link] (1 responses)

If they have such a small disk, you definitely should NOT use it for large temporary files, because it will wear out the flash quickly.

Debian's /tmpest in a teapot

Posted Jun 6, 2024 10:46 UTC (Thu) by aragilar (subscriber, #122569) [Link]

128MB is RAM, the rootfs (which would probably include /tmp) is usually on USB-attached storage (which would number in the 10s of GB at least).

Debian's /tmpest in a teapot

Posted Jun 3, 2024 21:44 UTC (Mon) by LtWorf (subscriber, #124958) [Link] (13 responses)

I forgot to disable this on one of my machines.

So of course I had a compilation fail because all the 7GB of space on my now very tiny /tmp got occupied by dependencies.

It seems one of these things that you have to do when you install a Debian machine. Like disable the mouse in vim.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 1:40 UTC (Tue) by mathstuf (subscriber, #69389) [Link] (12 responses)

Umm…what "compilation" requires 7GB? And thinks that `/tmp` is a good place to put it? Debian (and derivatives) are the only systems still using non-tmpfs it seems, so it smells like a Debian-specific (or at least -focused) tool? Building snaps perhaps? Or perhaps whatever other distros do to avoid the problem could be applied to Debian as well?

Debian's /tmpest in a teapot

Posted Jun 4, 2024 8:59 UTC (Tue) by dsommers (subscriber, #55274) [Link] (11 responses)

Large C++ projects can easily consume a GB or more per compilation thread. I've not dug into how much of that hits the disk without -pipe. But I have seen GCC putting some work data to /tmp

Debian's /tmpest in a teapot

Posted Jun 4, 2024 9:22 UTC (Tue) by bluca (subscriber, #118303) [Link] (10 responses)

And if someone is in the 0.x% of those cases where GBs of data are regularly written to /tmp/ without any control, they can simply configure their system accordingly. A Debian installation will not start autonomously compiling GBs of C++ intermediate data into /tmp/ by itself, if that happens it is user-driven.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 10:19 UTC (Tue) by LtWorf (subscriber, #124958) [Link] (9 responses)

> 0.x% of those cases

[Citation needed]

As I said in another comment, downloading an .iso file was enough to kill my entire session.

I don't think that "downloading a file to then dd on a USB device and never use it again" is a rare thing among linux users.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 10:28 UTC (Tue) by bluca (subscriber, #118303) [Link] (8 responses)

And that's why your home has a Downloads directory, which is used by browsers by default. It's completely absurd to demand that defaults should adapt to your specific use case of downloading ISOs to /tmp. Just configure your system according to your needs, it's not that hard.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 10:49 UTC (Tue) by LtWorf (subscriber, #124958) [Link] (7 responses)

> And that's why your home has a Downloads directory

Which is not automatically cleaned, which is why I didn't use it in that case.

> It's completely absurd to demand that defaults should adapt to your specific use case of downloading ISOs to /tmp.

It seems to me that the use case you have in mind is "do not write anything at all ever in /tmp". Do you have any source that it is the normal use case and I am indeed the only one person in the whole world that uses it?

Why not remove /tmp completely then?

Debian's /tmpest in a teapot

Posted Jun 4, 2024 10:51 UTC (Tue) by bluca (subscriber, #118303) [Link] (6 responses)

> Which is not automatically cleaned, which is why I didn't use it in that case.

You can trivially set up a tmpfiles.d in your home that cleans it, if you want that behaviour. Or you can use /var/tmp. The possibilities are endless.

> It seems to me that the use case you have in mind is "do not write anything at all ever in /tmp".

No, this is a strawman that you have just made up.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 15:34 UTC (Tue) by Wol (subscriber, #4433) [Link] (2 responses)

> You can trivially set up a tmpfiles.d in your home that cleans it, if you want that behaviour. Or you can use /var/tmp. The possibilities are endless.

And so is the (mis)information on the net.

What you're forgetting, is that a lot of people just want to USE their computers. And trying to find information about eg tmpfiles.d is just a nightmare of ill-informed blogs and crap documentation.

I know pretty much the minimum I need to do to administer my personal home server. One of the reasons it runs gentoo is it was a personal choice that means I need to know more than most. But finding the information I need is usually search terms that don't find what I'm looking for, search engines that assume they know better than I do what I'm looking for so they ignore critical terms, as I said, ill-informed blogs, answers that didn't read the question, etc etc.

Just because the possibilities are endless doesn't mean they are within reach of mere mortals - all too often they've disappeared up the wazoo of the infinite impossibility search engine ...

Cheers,
Wol

Debian's /tmpest in a teapot

Posted Jun 4, 2024 15:56 UTC (Tue) by bluca (subscriber, #118303) [Link] (1 responses)

People who just want to USE their computers won't even know /tmp/ exists, because desktop applications like browsers don't use it and it doesn't show up among the desktop icons, they use ~/Download and ~/Documents and friends. If one worries about file retention policy of /tmp, then they can find out ways to configure it. Or not, find it the hard way and learn a valuable lesson in the process. The fact that this is not an issue on other distros suggests all this hair-pulling is blown-out of proportion - as the title of the article suggests.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 17:28 UTC (Tue) by Wol (subscriber, #4433) [Link]

Unfortunately, they DO need to know about it ...

As someone else said, things like attachments in emails are generally stored in temp (be it c:\temp or \tmp or yada yada) and the grief I get with "I edited an attachment and saved it, where have my changes gone?"

Some people learn, unfortunately some people CAN'T learn. What's that saying? "Every time man invents something idiot-proof, nature invents a better idiot".

I get people are upset that Debian is being dragged kicking and screaming into the 21st century, but it doesn't mean the 21st is any better than the 20th ...

Cheers,
Wol

Debian's /tmpest in a teapot

Posted Jun 5, 2024 5:15 UTC (Wed) by wtarreau (subscriber, #51152) [Link] (2 responses)

> > It seems to me that the use case you have in mind is "do not write anything at all ever in /tmp".

> No, this is a strawman that you have just made up.

No need to be aggressive and condescending again Bluca.

I'm in the same situation with my home over NFS, I use /tmp *a lot*, for the same reasons. Where do I download LLMs ? Into /tmp. Where do I compile large stuff ? In /tmp as well, because it's fast (especially with SSDs these days). There are plenty of small use cases like this. I'm totally fine with uncommenting a line in /etc/fstab to preserve the old behavior though. But I think that during installation it would be reasonable to check the available RAM size and consider a size below which the user is asked whether they want /tmp as tmpfs or not, because running OOM on older systems that were once considered as "still good enough to run debian" will likely cast a bad image of that distro.

Debian's /tmpest in a teapot

Posted Jun 5, 2024 9:16 UTC (Wed) by bluca (subscriber, #118303) [Link] (1 responses)

> No need to be aggressive and condescending again Bluca.

There is also no need to invent arguments that nobody made, and yet here we are

> I'm in the same situation with my home over NFS, I use /tmp *a lot*, for the same reasons.

NFS is not enabled by default either, so as part of your actions to setup NFS, you can also configure your tmp according to your needs

Debian's /tmpest in a teapot

Posted Jun 5, 2024 13:37 UTC (Wed) by edgewood (subscriber, #1123) [Link]

> NFS is not enabled by default either, so as part of your actions to setup NFS, you can also configure your tmp according to your needs

Yes. But that's what he said 4 sentences after the one you quoted.

Debian's /tmpest in a teapot

Posted Jun 3, 2024 21:53 UTC (Mon) by Thalience (subscriber, #4217) [Link] (18 responses)

User: What do you mean my trash automatically emptied itself? That's where I keep my important files!

Debian's /tmpest in a teapot

Posted Jun 4, 2024 1:32 UTC (Tue) by raven667 (subscriber, #5198) [Link] (3 responses)

I've told this story before but its still funny to me, I had a user I supported, back with MS Mail (pre-Exchange), who did exactly that. They asked me to help free space on their desktop (probably at 20MB drive), so I looked around and emptied their deleted email folder, seemed sensible. They freaked out because that's where they kept their important mail, because it was just one key press to delete mail vs more keys to file in a folder. lol

Debian's /tmpest in a teapot

Posted Jun 4, 2024 2:52 UTC (Tue) by ringerc (subscriber, #3071) [Link]

I've had the same except it was a Windows box "Recycle Bin".

Their rationale? That's where they put stuff they're done with but might need later. They'd empty it at the end of the month.

Obviously absurd given the real world analogy, you say? But no. The cleaners had strict instructions not to empty this person's actual rubbish bin either. For the same reason.

The network backups excluded the "recycle bin". Items had been moved there long enough ago that they'd aged out of the backup retention window. Someone came in to stand in for them at their job and emptied it. That was fun.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 6:08 UTC (Tue) by epa (subscriber, #39769) [Link] (1 responses)

That's a kind of Hyrum's Law applied to users. No matter how strongly the label of the folder says "Deleted", the observable behaviour is that items sent there are *not* deleted, not without an explicit further step. People will rely on that.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 6:55 UTC (Tue) by magfr (subscriber, #16052) [Link]

Yes. I am suffering with outlook webmail at work and there I have a deleted folder, putting something there obviously doesn't delete anything but if I actively delete stuff from the deleted folder I then get the option to restore it for something like a month.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 7:58 UTC (Tue) by LtWorf (subscriber, #124958) [Link] (13 responses)

First time I tried a system with /tmp on tmpfs (fedora) I downloaded an .iso in /tmp. That triggered the OOM killer, which killed wayland.

My whole session got killed because I dared to use /tmp. It wasn't even full.

At this point, if we don't want to have /tmp, we could just not have a /tmp at all.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 8:43 UTC (Tue) by smurf (subscriber, #17840) [Link] (12 responses)

That's a broken combination of not enough RAM, /tmp-in-RAM, and no swap.

Long term, /tmp-on-disk won't save you here.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 9:07 UTC (Tue) by LtWorf (subscriber, #124958) [Link] (11 responses)

Not enough RAM? It was a completely normal laptop with 8 GB of RAM, not some sort of low cost embedded board.

A fresh install did that. So it was just the system defaults.

Anyway let's not forget that the advice online has been "do not create swap" for decades. So there's probably thousands of installations out there without swap (not mine) that are ready to start crashing once users start to receive this on their systems.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 9:28 UTC (Tue) by smurf (subscriber, #17840) [Link] (3 responses)

Well I have no idea who advises people not to create swap partitions … people who want to sell you a new box with more RAM?

In any case, on a laptop you also need the swap space for hibernation (suspend to disk).

Debian's /tmpest in a teapot

Posted Jun 4, 2024 10:54 UTC (Tue) by LtWorf (subscriber, #124958) [Link] (1 responses)

People on the internet. 5 seconds on google will find their usernames. If you want their real names and addresses I cannot help you.

Suspend to disk is slow, suspend to RAM is fast… Also if your swap is full of the contents of your /tmp you can't hibernate anyway.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 13:02 UTC (Tue) by smurf (subscriber, #17840) [Link]

Suspend to RAM won't help you when you need to turn the thing off due to an empty battery.

So don't fill the whole swapspace with your /tmp. It defaults to being limited to half of RAM for a reason. This is mostly orthogonal to /tmp-in-RAM, you have the same problem if (when …) your browser has a memory leak and ate your whole RAM+Swap when you want to hibernate.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 18:39 UTC (Tue) by MarcB (subscriber, #101804) [Link]

There are VM and container environments that *severely* over-commit IO. That makes a lot of sense if the workloads match this. I have seen sustainably allowed IOPS as low as 100 and even bursts only up to 500.

Heavy swapping can easily exceed those values. If the swapping happens on many VMs at once - maybe because they run the same buggy software or run into the same problematic data - the whole cluster might get into real trouble.

But in all scenarios where your storage gives sufficient guarantees, you really should use swap.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 11:27 UTC (Tue) by intelfx (subscriber, #130118) [Link] (3 responses)

> Anyway let's not forget that the advice online has been "do not create swap" for decades

That's just crappy advice.

It happens in all parts of life. Why should the world bend over to wrong things someone wrote and perpetuated on the Internet? You don't see vaccine centers shutting down because of anti-vax bullshit :-)

Debian's /tmpest in a teapot

Posted Jun 4, 2024 12:04 UTC (Tue) by malmedal (subscriber, #56172) [Link] (2 responses)

> > Anyway let's not forget that the advice online has been "do not create swap" for decades

> That's just crappy advice.

It's obsolete advice, a 7200 RPM desktop drive can do something like 72 seeks per second. I had plenty of workloads that would work fine without swap(or at least be OOM-killed), but completely hang the machine when swap was enabled.

With an SSD-drive the problem went away so it's reasonable to enable swap again.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 12:06 UTC (Tue) by intelfx (subscriber, #130118) [Link] (1 responses)

> I had plenty of workloads that would work fine without swap(or at least be OOM-killed), but completely hang the machine when swap was enabled.

I'd hazard a guess and say this just meant `vm.swappiness` had been set to a wrong value.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 15:23 UTC (Tue) by malmedal (subscriber, #56172) [Link]

I did some experiments at the time, with real and synthetic workloads, only thing that worked was reducing swap-size.

The disk at the time could read 150M/sec sequentially, but only 288K/sec with random access 4K blocks. Typical for a 7200RPM desktop-drive.

The performance cliff when swap was just a little bit too large was so tall that I just turned it off.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 11:39 UTC (Tue) by Wol (subscriber, #4433) [Link] (2 responses)

> Anyway let's not forget that the advice online has been "do not create swap" for decades. So there's probably thousands of installations out there without swap (not mine) that are ready to start crashing once users start to receive this on their systems.

Don't forget that, round about 2000, linux 2.4, don't remember the details, Linus decided to force a rewrite of the memory management / swap code. At which point, people who ran vanilla kernels and didn't read the release notes suddenly found out the HARD way that the old wives tale of "swap should be twice ram" really was true. Any system that didn't have that much swap just crashed the instant the swap code was invoked. The guidance in the notes said "no swap, or at least twice ram. NOTHING INBETWEEN".

And there were plenty of people who'd been relying on the fact that it was an old wives' tale for years even back then.

Which is why my machines always have masses of swap. May be totally unnecessary today, but nobody's ever come back to me and said "yes the rewrite really did remove that requirement" - they just assume that because everybody says "twice swap" is an old wives' tale, then it must be, despite that being proved resoundingly wrong this century-ish.

Cheers,
Wol

Debian's /tmpest in a teapot

Posted Jun 7, 2024 5:35 UTC (Fri) by porridge (subscriber, #15054) [Link] (1 responses)

This is not so easy to do on a laptop that has 32GiB of memory but just 128 or 256 GB SSD...

Suddenly you start running out of storage space for your files :-(

Debian's /tmpest in a teapot

Posted Jun 7, 2024 7:06 UTC (Fri) by Wol (subscriber, #4433) [Link]

My "big brute system" has 64GB ram and approx 20TB spinning rust across 4 drives. Every drive formatted for this system has a 256GB swap partition (I don't think they're all enabled :-) (That's 4x32GB memory slots, times 2)

Cheers,
Wol

Debian's /tmpest in a teapot

Posted Jun 4, 2024 5:43 UTC (Tue) by stop50 (subscriber, #154894) [Link]

the forgot to mention a few alternatives:
/var/lib/<something>: not cleaned up, usually no restrictions, useful for your service
/var/cache: like /tmp but for longer lived data, but you must expect them to be cleaned up.

Personally i would go for /var/lib, but you must clean it up yourself.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 6:57 UTC (Tue) by magfr (subscriber, #16052) [Link] (37 responses)

Did they fix emacs as well? Emacs used to put the socket that emacsclient connects to in /tmp

Debian's /tmpest in a teapot

Posted Jun 4, 2024 8:16 UTC (Tue) by epa (subscriber, #39769) [Link] (36 responses)

If even a tiny socket file can't reliably be stored in /tmp because it might get unpredictably deleted, then what exactly can /tmp be used for?

Debian's /tmpest in a teapot

Posted Jun 4, 2024 8:56 UTC (Tue) by bluca (subscriber, #118303) [Link] (35 responses)

Sockets should very much NOT go to /tmp. /tmp is world writable, and it needs to be used with extreme care, with randomly generated subdirs via mktemp for starters, otherwise you are left vulnerable to hijacking by unprivileged processes - but that means the path is unpredictable and thus needs a side-channel to securely communicate it to the client of the socket, which defeats the point. system services can use /run, and user processes can use XDG_RUNTIME_DIR (which is also in /run), as those have appropriate permissions.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 9:01 UTC (Tue) by epa (subscriber, #39769) [Link] (34 responses)

Yes, I'm aware of the problems with /tmp symlink attacks and other attacks. It's a minefield, as you say. So, in that case, is there *any* sensible use of /tmp? In principle no long-running task can use it because old temporary files can be deleted... but the definitions of "long-running" and "old" are hard to pin down. Reliable software can't use a mechanism which works at first but fails after a week or two.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 9:18 UTC (Tue) by smurf (subscriber, #17840) [Link] (32 responses)

Of course there are uses for /tmp. Plenty of them. My email reader stores attachments there. Your compiler writes its transient files to /tmp. So does the initramfs builder. And so on.

The correct place for transient stuff that shouldn't be cleaned (and also doesn't need to survive a reboot), these days, is /run/user/‹uid›/.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 9:30 UTC (Tue) by bluca (subscriber, #118303) [Link] (28 responses)

Yes, it's a scratch area for private data (again: to be used with mktemp and friends) that is fine to lose at any time. It's not the right place where to _share_ data.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 11:36 UTC (Tue) by epa (subscriber, #39769) [Link] (27 responses)

But what data is “fine to lose at any time”, is my question. I am having a hard time thinking of examples. Most of the time software will break if the temporary file it was using gets deleted. There are a few applications which need a pure cache, entirely able to keep working if the cache files are deleted, but most current users of /tmp are not like that.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 11:41 UTC (Tue) by bluca (subscriber, #118303) [Link] (26 responses)

If any software actually exists that expects to drop critical files in /tmp, not touch them/access them for more than a week, and barfs when it goes back and doesn't find them, then that software is simply broken. It can be fixed in a number of ways as explained at https://systemd.io/TEMPORARY_DIRECTORIES/
I'm not sure it actually exists though, it really sounds like a strawman.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 12:24 UTC (Tue) by epa (subscriber, #39769) [Link] (3 responses)

I wouldn’t be so sure. Generally “anything that can go wrong, will go wrong” and a program that wasn’t envisaged to take a week could end up doing so — after all, it will not have an explicit check of time taken. It’s possible that an attacker could note the filename used, arrange to block the target process, and let its temp file get reaped. Then create a new one with the same name.

This is speculation, of course, but a generation ago the idea of deliberate hash collisions would have been seen as a straw man, or many similar “don’t do that” or “will never happen” scenarios.

Since the reaping period is defined to be at least 10 days (and not purely site-dependent) that takes away a lot of the worry in practice.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 14:34 UTC (Tue) by bluca (subscriber, #118303) [Link] (2 responses)

If "attacker takes over filename" is part of the threat model, _DO NOT USE /tmp_ for that data - no ifs, no buts, just don't.

All these tortured strawmen are exactly what I meant when I said "I am not really looking for philosophical discussions or lists of personal preferences or hypotheticals". If the new defaults do not work for you, just do the trivial one-line configuration change. Arguing about why your preferred configuration is the one true default and everything else is wrong is a waste of time and is not going to achieve anything at all.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 14:51 UTC (Tue) by epa (subscriber, #39769) [Link] (1 responses)

Thanks, sorry I didn't realize it was you. I didn't intend to waylay your work with hypotheticals -- it looks like a good improvement and certainly the status quo ante wasn't perfect either.
If "attacker takes over filename" is part of the threat model, _DO NOT USE /tmp_ for that data
Perhaps I am not understanding, but that seems to rule out /tmp for almost anything on a multiuser system. Many programs expect to create a file in /tmp and then reference it by name later. I know that the best way is to create the file in a single atomic action and get back the file *handle*, no longer caring about the name, but there are plenty of times when you want to run an external program and pass it the name of the temp file you created. For example running an external diff command to print the differences between two strings. I think that these cases outnumber those when you're content to use an anonymous file handle.

If you're saying that is never safe, not even when done with great care and exclusive mode opening and all the rest, then our positions are not so far apart. The safe uses of /tmp are a lot fewer than is common practice.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 14:58 UTC (Tue) by bluca (subscriber, #118303) [Link]

It really depends on the threat model and countermeasures and so on. Using an O_TMP in a mktemp subdir (with enough characters in the template) is most likely ok for things that need to be safe against pre-emptive hijacking and that are not high value - caches and whatnot. But if there's anything worth stealing - just don't use tmp, there are so many safer alternatives, and are not really new either - XDG_RUNTIME_DIR has been around for at least a decade, probably more.

For sockets - just don't. It is honestly baffling that there are still programs doing that, like tmux.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 15:51 UTC (Tue) by mb (subscriber, #50428) [Link] (21 responses)

> that software is simply broken

No, it's not broken. It worked just fine until you started deleting files.

> It can be fixed in a number of ways

Yeah. But you are breaking existing userspace here.
Is there a difference, if the kernel breaks userspace or if systemd breaks userspace?

I'm really annoyed by this.
Can you please give one valid reason, why you absolutely have to delete a couple of bytes from /tmp after it was sitting there without a problem for 10 days?

If we are talking about megabytes or gigabytes. Yeah. Fine. Establish a cleanup strategy, because it actually does help.
But deleting small files and sockets? Just don't. There is no way this is going to help anybody, but plenty of room for breakage.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 16:10 UTC (Tue) by bluca (subscriber, #118303) [Link] (20 responses)

> No, it's not broken. It worked just fine until you started deleting files.

Yes, it is, and no, it didn't, as the article says at the very top this has been the norm on other distros for a decade.

> But you are breaking existing userspace here.

Nothing is broken, this is made-up nonsense. Just stop wasting time and write the one line config file to customize your machine as you want it. Complaining is not going to change anything.

> But deleting small files and sockets? Just don't. There is no way this is going to help anybody, but plenty of room for breakage.

Size limit is not the only problem, especially on a tmpfs there is also an inode limit, and saturating a tmpfs with zero size files is very much possible and DOSes other uses of /tmp. So it's just as important to remove unused small files as it is large files to ensure the shared resource remains usable.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 16:31 UTC (Tue) by mb (subscriber, #50428) [Link] (19 responses)

>especially on a tmpfs there is also an inode limit, and saturating a tmpfs with zero size files is very much possible and DOSes other uses of /tmp.

Ok. Can you give us some numbers and show how that is not "made-up nonsense" (quoting yourself), please?

How many files must be created to exhaust the available space?
Which real world application is affected?
Traditional disk based /tmp surely has the same problem, right? So there has never been a version of Linux without this "problem". But there surely have been decades of Linux that don't delete files from /tmp at random times.

>write the one line config file to customize your machine as you want it

My machine _is_ configured the way I want and you are changing it. And I didn't read a plausible explanation for why this is needed, yet.

You are changing user interfaces. You are doing the very same thing that you constantly complain about.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 16:51 UTC (Tue) by bluca (subscriber, #118303) [Link] (18 responses)

> Ok. Can you give us some numbers and show how that is not "made-up nonsense" (quoting yourself), please?

Depends on the system, just check it out - df -hi /tmp

> But there surely have been decades of Linux that don't delete files from /tmp at random times.

Sure there have - tmpfiles.d has been deleting files in /tmp, in Debian too, for the past ~15 years, and before that there were things like tmpreaper. Other OSes like Solaris also delete stuff there by default. You are pretending this is some sort of new, last minute development - it isn't, it's ancient history.

> You are changing user interfaces. You are doing the very same thing that you constantly complain about.

Nonsense. Major version of distributions change things all the time, that's why we publish this thing called "release notes" where changes are noted. If you don't want changes, stay on the same stable LTS version forever. Distributions, including Debian, never, ever said "we won't break compatibility across major version upgrades", quite the opposite, every new release changes something - that's the entire point of doing a new Debian release. The parallel you are trying to draw makes no sense, as the kernel _does_ say " we do not break compatibility". That makes all the difference, and pretending it doesn't is just silly.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 17:28 UTC (Tue) by mb (subscriber, #50428) [Link] (17 responses)

>just check it out - df -hi /tmp

Ok.

>$ df -hi /tmp
>Filesystem Inodes IUsed IFree IUse% Mounted on
>tmpfs 4.4M 37 4.4M 1% /tmp

>$ for i in $(seq 0 100000); do touch /tmp/x/$i; done

>$ df -hi /tmp
>Filesystem Inodes IUsed IFree IUse% Mounted on
>tmpfs 4.4M 98K 4.3M 3% /tmp

So it takes ~4.5 million empty files to fill up the available inode space.

It doesn't convince me that this limit can be used to argue that possibly used files must be deleted after 10 days.

Is that limit hit more frequently than applications breaking due to deleted files?

Debian's /tmpest in a teapot

Posted Jun 4, 2024 17:38 UTC (Tue) by bluca (subscriber, #118303) [Link] (16 responses)

> It doesn't convince me that this limit can be used to argue that possibly used files must be deleted after 10 days.

There must be some misunderstanding here - I am not arguing for anything, not trying to convince you of anything. I'm simply explaining how things work and why. If you don't like how they work, that's too bad - feel free to configure your machine differently as already explained, you are free to configure your laptop or your desktop or your server as you see fit, it really doesn't make any difference to me, these settings are all configurable by design

Debian's /tmpest in a teapot

Posted Jun 4, 2024 18:37 UTC (Tue) by mb (subscriber, #50428) [Link] (15 responses)

>I am not arguing for anything

Well, but you should. You are changing the Debian world here.

>feel free to configure your machine differently

Keep in mind that you are changing my machine behavior here. You change how the Debian system works and I have to revert back to the old behavior.

It's the responsibility of you as a maintainer to have actual good reasons for a change. And you should be able to explain them. Yet, I did not see more than basically that you'd like it better if the files were deleted and "somebody else does it, too".

There is a huge responsibility with being a maintainer.
If you make a change that requires millions of people to change just one configuration line to get the old behavior back, you are wasting millions of hours of work time.
There should be a *good* reason for these changes.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 18:43 UTC (Tue) by pizza (subscriber, #46) [Link] (6 responses)

> Well, but you should. You are changing the Debian world here.

No, he (nor the other systemd developers) is doing nothing of the sort. *DEBIAN* is changing its own world.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 19:28 UTC (Tue) by mb (subscriber, #50428) [Link] (5 responses)

Please grep the Debian systemd package changelogs for "bluca".

Debian's /tmpest in a teapot

Posted Jun 4, 2024 20:46 UTC (Tue) by pizza (subscriber, #46) [Link] (4 responses)

> Please grep the Debian systemd package changelogs for "bluca".

Sounds like you need to file a release blocker bug with Debian, but since this is fundamentally about overruling a Debian packager's decision, you'll probably need to escalate this to the TC or to a full project-wide vote.

Either way, you'll need a better technical argument than "I don't like it and I can't be arsed to make a one-liner configuration change"

Debian's /tmpest in a teapot

Posted Jun 4, 2024 20:50 UTC (Tue) by bluca (subscriber, #118303) [Link]

It's even sillier than that, given it's only enabled for new installs, not on upgrades: "I don't like it and I can't be arsed to make a one-liner configuration change if I ever were to reinstall from scratch"

Debian's /tmpest in a teapot

Posted Jun 4, 2024 21:25 UTC (Tue) by mb (subscriber, #50428) [Link] (2 responses)

> Either way, you'll need a better technical argument

Yes. Changes don't require technical argument. "Only one reason is needed: I have decided as such." (bluca). And the users require technical argument against it. I got it and I will respect it.

I will certainly remember that rule.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 21:57 UTC (Tue) by pizza (subscriber, #46) [Link] (1 responses)

> Changes don't require technical argument.

Except for the numerous times the technical merit of the "new" default has been explained, even in this thread. And then there's also the little detail where where the rest of the Linux world has been doing it this "new" way for about a decade. Those discussions (including technical arguments) are all part of their public record.

> "Only one reason is needed: I have decided as such."

Hate to break this to you, but the overwhelming majority of Debian packages also fall under this category - Both the packager and the upstream authors make countless such decisions every single day.

And again, if you (or whomever) doesn't like these decisions, feel free to invoke the Debian process for overruling a packager and/or upstream.

Second request

Posted Jun 4, 2024 21:59 UTC (Tue) by corbet (editor, #1) [Link]

I repeat: this has all been said, no more minds will be changed (if any ever were). I think we can stop this back-and-forth now.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 19:11 UTC (Tue) by bluca (subscriber, #118303) [Link] (7 responses)

> Keep in mind that you are changing my machine behavior here.

No. The next Debian release, due next year, will change your machine's behaviour in many ways, as it will be documented in the (lengthy) release notes. If you like it - good. If you don't - too bad, either reconfigure appropriately or stay on the current version until it goes EOL, and then start paying somebody to give you support beyond that.

> There should be a *good* reason for these changes.

Only one reason is needed: I have decided as such. Don't like it? Don't worry, you can have your money back, give me an address and I'll post you a cheque for £0.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 19:13 UTC (Tue) by bluca (subscriber, #118303) [Link]

(and to be really pedantic, as noted in the changelog, in fact the tmpfiles.d rules will not be applied to existing machines, but only to new installations)

Debian's /tmpest in a teapot

Posted Jun 4, 2024 19:26 UTC (Tue) by mb (subscriber, #50428) [Link] (1 responses)

>Only one reason is needed: I have decided as such.

Ok. That's the rule and I will also apply it to you.

A place to stop

Posted Jun 4, 2024 19:33 UTC (Tue) by corbet (editor, #1) [Link]

So ... once again we would appear to have reached a point where everybody has said their piece — several times — and any minds that might conceivably be changed will have been changed. This seems like a good place to stop this back-and-forth, please.

Debian's /tmpest in a teapot

Posted Jun 6, 2024 1:49 UTC (Thu) by jccleaver (guest, #127418) [Link] (3 responses)

>If you like it - good. If you don't - too bad,

Yep, that's bluca's and systemd's philosophy in a nutshell, right there.

Debian's /tmpest in a teapot

Posted Jun 6, 2024 9:13 UTC (Thu) by bluca (subscriber, #118303) [Link] (1 responses)

Correct - thanks for noticing! We pick sensible defaults that can be relied on, and empower you to customize them easily if and when needed.

Debian's /tmpest in a teapot

Posted Jun 6, 2024 12:16 UTC (Thu) by Wol (subscriber, #4433) [Link]

And was it *you* who decided Debian's policy to change Debian's defaults?

If it's just Debian deciding to adopt systemd's defaults, that's not down to systemd.

bluca can be a pain in the arse - can't we all - but unless he's responsible for Debian policy I fail to see how this has anything to do with him.

(Or is this the transition where now-stable is SysVInit, and next-stable is systemd, but even there I fail to see how this is down to systemd at all ...)

Cheers,
Wol

Debian's /tmpest in a teapot

Posted Jun 6, 2024 10:40 UTC (Thu) by smurf (subscriber, #17840) [Link]

@corbet asked us, multiple times, to stop the adversial and/or unproductive comments.

It's a freakin' default. You don't like it, change it. Other systems have been using the same default settings for literally decades.

If your argument boils down to "it's a change and I don't like it", well, open your window, there's way worse changes than putting /tmp into RAM looming on the horizon. Doing something about these would be a more productive use of everybody's time.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 11:34 UTC (Tue) by epa (subscriber, #39769) [Link] (2 responses)

But if the compiler writes its transient files to /tmp and they get deleted before the compiler has finished, it will break. Okay, the deletion time is typically much longer than a build runs for, but as far as I know this is not specified anywhere. Same for attachments — you could leave your desktop for a week’s holiday and expect it to be working on your return.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 11:39 UTC (Tue) by bluca (subscriber, #118303) [Link] (1 responses)

It is specified - 10 days for /tmp and 30 for /var/tmp, and that includes mtime/atime/ctime. Have you _actually_ experienced that issue, or is it pure speculation based on cursory understanding of how this works?

Debian's /tmpest in a teapot

Posted Jun 4, 2024 12:02 UTC (Tue) by epa (subscriber, #39769) [Link]

That’s great. I had thought the reaping period was probably unspecified.

While in general I dislike timing-dependent effects, such as timeouts after inactivity on a socket connection, they are a fact of life.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 9:33 UTC (Tue) by bluca (subscriber, #118303) [Link]

And also the automated file deletion can be easily and reliably stalled with a flock: https://systemd.io/TEMPORARY_DIRECTORIES/ (or a permanent opt out via tmpfiles.d 'x' directive, but that's not as good)

Debian's /tmpest in a teapot

Posted Jun 4, 2024 12:28 UTC (Tue) by smoogen (subscriber, #97) [Link] (3 responses)

I have seen various academic and research circles teach /tmp is the place to store date for 30+ years for different reasons.
1. Long ago, quotas were put on various systems home directories. What didn't have a quota was /tmp as it was considered scratch space and might even have a dedicated disk to it. Cleanup usually happened once a year or so and you might even put a larger disk on it versus other places. While home quotas and such got rarer as 'shared' computers moved more to workstations and personal laptops, the trend to put large stuff in /tmp by default in everything was going strong even in 2009 when I left that space. Most of the time I have seen someone complain about Fedora using swap /tmp it has been in academic circles where something broke at the wrong time and data was lost.
2. There are different definitions of time for research and systems administration. A system admin might think something in /tmp living longer than a day or a week needs to be moved to something more permanent. A researcher may think that the 6 months it took to gather raw data or something is temporary and might even need a year. That data may be thrown away afterwards so is 'temporary'.

Add in the fact that Debian is the NetBSD of Linux (and I mean this as a compliment). It is ported and maintained on hardware systems which have not been produced in decades, and meant to work on systems with megabytes of memory while also working on terabytes of memory. This means that general solutions which might work in 90% of a different distro cause larger complaints due to expectations that someone's SPARC10(?) or M68000 system will still install cleanly in 2024.

I would expect that in the older Debian installers this would be a question to answer.. do you want /tmp to be tmpfs, dedicated partition, or on / so that the various solutions could be implemented. I don't know if that is at all possible with the newer installers.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 18:27 UTC (Tue) by mathstuf (subscriber, #69389) [Link]

HPC systems (that I encounter) tend to have `/scratch` (or similar) partitions meant for exactly that. When filesystems get full (80%+ based on those I receive), emails go out and if things persist, things in `/scratch` are fair game for deletion. There is also dedicated space for project results that should be kept that live in project-tracked directories. This allows the operators to account storage to projects (like CPU/GPU access is accounted) properly. I'd be surprised if `/tmp` was used as such on a machine that was really simultaneously:

- unaccounted to projects
- not subject to sharing restrictions
- has an expectation to persist for long periods of time
- critical to the mission of the machine owner
- under such lax operator scrutiny that a Debian default change like this comes in silently (though given the first two points, maybe they really are just far on a scale of negligence)

Debian's /tmpest in a teapot

Posted Jun 5, 2024 5:39 UTC (Wed) by wtarreau (subscriber, #51152) [Link]

When I was a student, we had a 8MB quota in our homes, and on multiple shared machines there was 1 to 2 GB in /tmp. So with a friend we got used to creating large files there and using mtools (mdir, mcopy etc) over that file pretending to be a disk image, to store all our data. We got used to know what machine to connect to depending on the type of file we were looking for. That was totally ugly but fun :-)

Debian's /tmpest in a teapot

Posted Jun 5, 2024 7:21 UTC (Wed) by nim-nim (subscriber, #34454) [Link]

1. People definitely use /tmp and /var/tmp for big datasets (including but not limited to downloads)
2. That is not limited to academic circles
3. The main reason for this reliance is beancounter and sysadmin avoidance : /tmp and /var/tmp are sort of a gray area that allows ignoring the limits set by the people charged with provisioning storage (people that know that storage and budgets are not infinite)
4. Users are usually right in pointing they need a large scratch storage area to work
5. Beancounters and sysadmins are usually right that infinite storage does not exist in the real world, storage gets filled and BAD THINGS happen
6. A good compromise is a large scratch space where things decay before they accumulate too much (relying on humans to housekeep a scratch area is hopeless)
7. Like all real-world compromises you will find borderline cases where the default limit is set to the wrong value

Debian's /tmpest in a teapot

Posted Jun 4, 2024 16:07 UTC (Tue) by gray_-_wolf (subscriber, #131074) [Link] (8 responses)

It is bit shame that this will make the guix package unreliable out of the box. The builds do happen in /tmp, and they rarely fit into the RAM (e.g. firefox takes ~12GB, linux kernel ~18GB of disk space in /tmp), so some packages will just fail to build. I wonder how to tackle that.

Maybe the /tmp should be (by default) of reasonable size (say 50 GB) with large enough swap created by default?

Debian's /tmpest in a teapot

Posted Jun 4, 2024 16:16 UTC (Tue) by smurf (subscriber, #17840) [Link] (6 responses)

If you prefer to build firefox or the kernel with "make -j ‹nontrivial›" then you're assumed to be tech-savvy enough to adjust your tmpfs settings to make that work.

Or guix could do that for you, out of the box.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 16:27 UTC (Tue) by gray_-_wolf (subscriber, #131074) [Link] (5 responses)

I fail to see how `-j whatever' relates to usage in /tmp. Peak RAM usage I do see the connection, but not for the disk space. Without -j the disk usage will grow slower, but it will reach the same total peak number.

My point being that there are programs that legitimately use many gigabytes in /tmp, and "tmpfs with max size of 1/2 of RAM" will just not work for them. I took guix package of an example that is packaged by debian, and therefore it seems reasonable to have it work out of the box.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 16:31 UTC (Tue) by bluca (subscriber, #118303) [Link]

Such packages can simply be configured to use something else like /var/tmp, then

Debian's /tmpest in a teapot

Posted Jun 5, 2024 1:56 UTC (Wed) by nakedhitman (subscriber, #90828) [Link] (3 responses)

> I fail to see how `-j whatever' relates to usage in /tmp.

Depending on what you're compiling, each compilation thread will use up to a certain amount of temp space. That bit me a few times, but once I knew what it was, I was easily able to work around it.

> My point being that there are programs that legitimately use many gigabytes in /tmp, and "tmpfs with max size of 1/2 of RAM" will just not work for them.

tmpfs will work just fine for use cases that exceed the size of RAM. Just add swap (even better with zswap) and size accordingly. That was the solution in my case, and my system has been better for it overall. Systems really should be using swap anyway, and tmpfs should default to using a size that matches either swap or 50% RAM, whichever is greater.

build systems & /tmp

Posted Jun 5, 2024 20:20 UTC (Wed) by mbunkus (subscriber, #87248) [Link] (2 responses)

> Depending on what you're compiling, each compilation thread will use up to a certain amount of temp space. That bit me a few times, but once I knew what it was, I was easily able to work around it.

Out of curiosity: which build systems place significant amounts of data in /tmp, even temporarily? And for what? With "significant" I mean more than a handful of KB per compilation process so that the total amount can become significant enough.

build systems & /tmp

Posted Jun 6, 2024 8:17 UTC (Thu) by smurf (subscriber, #17840) [Link] (1 responses)

> which build systems place significant amounts of data in /tmp, even temporarily?

The result of preprocessing a ten-line C or C++ file can and will easily span multiple megabytes.

Same for the intermediate assembly output, esp. when you add debugging.

build systems & /tmp

Posted Jun 6, 2024 15:25 UTC (Thu) by mbunkus (subscriber, #87248) [Link]

Right… Before posting my comment I had done a quick strace with one of the clang++ calls used in project's build process and saw no write to /tmp. Re-configuring to g++ I do actually see it writing the assembly files to /tmp. It can be avoided by adding -pipe.

Debian's /tmpest in a teapot

Posted Jun 5, 2024 7:53 UTC (Wed) by intelfx (subscriber, #130118) [Link]

> It is bit shame that this will make the guix package unreliable out of the box. The builds do happen in /tmp <...>
> I wonder how to tackle that.

Maybe by making Guix NOT do that? :-)

I do not use Guix, but I do have a home-grown package builder tool with lots of bells and whistles for painless automation (because I fork or patch so many packages). One of the first things I taught this tool is a dedicated "this package is large" annotation, which I manually use to mark packages like web browsers or toolchains or Linux kernel. If this annotation is not present, the build happens in /tmp, otherwise it happens in /var/tmp.

If Guix desires maximum efficiency in building packages, surely it must not be hard to implement something like that.

Debian's /tmpest in a teapot

Posted Jun 4, 2024 19:37 UTC (Tue) by dw (subscriber, #12017) [Link] (32 responses)

Bewildered that this is even a thing. You don't write a program to use a temporary file unless it is likely necessary, i.e. unknown input set, or known input set that exceeds RAM. There's very little other reason to actually design something to use the filesystem when in-memory would suffice.

To then come along and say "surprise, we moved your filesystem back into RAM, but it's okay, because if you run out of RAM, we'll just page out half your system (including the function that draws your mouse pointer) back to disk, so now you must enable swap too" frankly just angers me.

I have no idea why anyone is still looking at this part of the stack or who is paying for that work, it's just creating dumb breakage for absolutely stupid gains. Not bothering with the list thread, but presumably these fuzzy feelings weren't backed up by any meaningful metrics?

Debian's /tmpest in a teapot

Posted Jun 5, 2024 1:58 UTC (Wed) by nakedhitman (subscriber, #90828) [Link]

> Not bothering with the list thread

Right back at ya.

Metrics missing

Posted Jun 5, 2024 8:57 UTC (Wed) by koh (subscriber, #101482) [Link] (30 responses)

I've read the entire list of comments on this article and you're right, there do not seem to be made arguments for the change based on any specific metric, which is quite annoying as it points to there being no technical reason whatsoever to change the default in Debian. Looks like it's being done because all the other kids are doing it. Criticism is being framed as "you don't like it - too bad" multiple times here and you're being told that the solution is to change the new default settings. That line of reasoning only makes sense if it's clear you're an outlier in the dataset proving that a majority of users would benefit. No such data has been put forth here.

I can add one data point here:
> $ uptime
> 10:46:36 up 35 days, 19:40, 1 user, load average: 1.01, 1.06, 0.98
> $ df -hi /tmp
> Filesystem Inodes IUsed IFree IUse% Mounted on
> none 7.4M 125 7.4M 1% /tmp

This my personal laptop used every day, also for work, without periodic /tmp cleaning. What I do is removing specific files in /tmp from programs I know at specific points in time when I know those programs aren't running and might potentially use those files. Knowledge of either cannot reliably be obtained by any automated solution.

Metrics missing

Posted Jun 5, 2024 9:24 UTC (Wed) by bluca (subscriber, #118303) [Link] (29 responses)

> No such data has been put forth here.

That's correct, and it's not going to be, as it would be completely pointless: for something like this one can produce millions of manufactured anecdotes that go one way or the other. The previous defaults also weren't established following the rigorous analysis of any large dataset, but simply through inertia. However, given you like those old defaults and they happen to fit your use case, you don't seem to have any problem with the lack of data backing them up. Funny how that works, eh?

> This my personal laptop used every day, also for work, without periodic /tmp cleaning.

That's great - then you can use one of the several available configuration options to fine-tune it to your specific needs, which is of course fully supported and well documented.

Metrics missing

Posted Jun 5, 2024 10:58 UTC (Wed) by koh (subscriber, #101482) [Link] (28 responses)

> However, given you like those old defaults and they happen to fit your use case, you don't seem to have any problem with the lack of data backing them up. Funny how that works, eh?

To be honest, I don't care either way. What I care about is changing defaults in spite of existing technical criticism. Changing defaults is a decision affecting the technical level, so this criticism should be taken seriously. In my opinion, a less condescending attitude towards it would go a long way to increase acceptance.

Just to drive this point home: my Laptop does not use Debian and has a tmpfs based /tmp and /var/tmp. The change won't affect it. But it will affect some of the servers I manage - for no specific or specified reasons. That would be my complaint. I understand that change in general is necessary, and I'm not opposed. But change for the sake of change is counter-productive. What's the reason for it to have to take place in this fashion of automated 10 days / 30 days cleanups? Is it possible to name programs cluttering those directories which need cleaning up after? Are users just too lazy and keep filling up those directories with junk? Is a time limit really the best way to decide what's junk and what isn't? Is "10 days" being determined for a constantly changing system clock (meaning: ntp)?

Metrics missing

Posted Jun 5, 2024 11:47 UTC (Wed) by bluca (subscriber, #118303) [Link] (27 responses)

> What I care about is changing defaults in spite of existing technical criticism.

There is zero "technical criticism" (left - there were some valid concerns and some bugs about a handful packages, and I've fixed them all already). There are a bunch of personal preferences and anecdotes and strongly held personal opinions, but I don't care about any of that, sorry, because for each one of those preferences and anecdotes and opinions, you can find its exact opposite too. If the new settings don't fit with your personal use cases, you are fully empowered to customize them as needed, and it's beyond trivial to do so. Complaining about how they don't work for your very special and super-duper important use case is not going to achieve anything useful.

Metrics missing

Posted Jun 5, 2024 12:04 UTC (Wed) by koh (subscriber, #101482) [Link] (22 responses)

> There is zero "technical criticism" (left - there were some valid concerns and some bugs about a handful packages, and I've fixed them all already).

I see, so all those comments about actual programs expecting /tmp not be cleaned up is no criticism about changing the defaults, got it.

> Complaining about how they don't work for your very special and super-duper important use case is not going to achieve anything useful.

a) Here is a prime example of the condescending attitude mentioned earlier.
b) I have not, which makes this a nice strawman. Keep up the good work.

Metrics missing

Posted Jun 5, 2024 12:14 UTC (Wed) by bluca (subscriber, #118303) [Link]

> I see, so all those comments about actual programs expecting /tmp not be cleaned up is no criticism about changing the defaults, got it.

Correct - they are personal anecdotes, or in a lot of cases, even just made up hypotheticals (but what about if...)

Metrics missing

Posted Jun 5, 2024 12:24 UTC (Wed) by smurf (subscriber, #17840) [Link] (5 responses)

> comments about actual programs expecting /tmp not be cleaned up is no criticism about changing the defaults,

Correct – they are not. They report a bug in $PROGRAM (and/or its packaging) which should be taken upstream and/or fixed.

/tmp is not and never was persistent. /tmp-in-RAM or not doesn't matter.

Metrics missing

Posted Jun 5, 2024 12:38 UTC (Wed) by koh (subscriber, #101482) [Link] (4 responses)

Personally, I would disagree. Usage of /tmp for temporary files is not a bug in a program per se. It very much depends on what the program is doing and should therefore (in my opinion) not be controlled by an oblivious set of rules based on no statistical or otherwise validated usage in the wild.

For instance, I work on a program that verifies semantics of other C programs. This program does use /tmp to store a bunch of C headers and other files to give the Clang frontend the illusion of working on a particular sysroot. How long the verification (and thus potential usage of those /tmp files) lasts is unclear: As we all know, in general it's not a computable problem, and even for a specific subset where it is, it might take a long time. 10 days is just arbitrary at this point. I can't change defaults on rented servers not under my control. So there's that problem with defaults. Changing them makes this problem of a technical nature. Note: I'm not claiming that my use case is "super-duper important" here. Just pointing out a technical issue that makes Debian for those servers less interesting for me.

I would argue that usage of /tmp to populate a temporary sysroot for a single verification task is well within the scope of /tmp, thus there's no bug in my program. Persistence of /tmp is not relevant for this point.

Metrics missing

Posted Jun 5, 2024 12:56 UTC (Wed) by bluca (subscriber, #118303) [Link] (3 responses)

> I can't change defaults on rented servers not under my control. So there's that problem with defaults.

Fortunately for your use case, as per documentation, your program can just take an flock on the file(s) it is using, and they will be skipped over, no need to change configuration. Also, it's not just ctime, but mtime and atime too that are taken into account for the aging algorithm, again as documented. So it doesn't matter when the file was created, if it was just accessed it will be left where it is.

Metrics missing

Posted Jun 5, 2024 13:02 UTC (Wed) by koh (subscriber, #101482) [Link] (1 responses)

Many thanks for pointing me to flock. I can probably use that Linux-specific hack. The reason I'm regarding this as a hack is that for no other OS known to me it is necessary to take measures to ensure that tmp-files created by a program stay there as long as the program is running.

Metrics missing

Posted Jun 5, 2024 13:22 UTC (Wed) by daroc (editor, #160859) [Link]

A) I'm glad you learned about flock.

B) Jon asked for a very similar thread (back and forth without anyone changing their position, covering many of the same points, including flock coming up) to stop yesterday. We're all smart people here; I am certain that we can all generalize. I don't think anything new is being said, which means we can stop here.

Metrics missing

Posted Jun 5, 2024 14:10 UTC (Wed) by smurf (subscriber, #17840) [Link]

> and atime too

Thus /tmp-on-RAM should arguably work *better* than /tmp-on-root-with-no-or-rel-atime-option, which has been the default for ages.

Metrics missing

Posted Jun 5, 2024 12:53 UTC (Wed) by pizza (subscriber, #46) [Link] (14 responses)

> I see, so all those comments about actual programs expecting /tmp not be cleaned up is no criticism about changing the defaults, got it.

See, I don't get this. Debian's default behaviour *today* is to periodically reap /tmp.

Meanwhile, my very first Linux installation (27 years ago!) came with a nightly /tmp cleaner-upper cron job. And the multi-user Solaris systems I had accounts on also (fairly aggressively) reaped /tmp.

Also, let me quote the Linux FHS, section 3.18:

"Programs must not assume that any files or directories in /tmp are preserved between invocations of the program."

And section 3.15:

"The /var/tmp directory is made available for programs that require temporary files or directories that are preserved between system reboots. Therefore, data stored in /var/tmp is more persistent than data in /tmp."

(Note that this text is from the FHS3.0 release of 2015, but the same language can be found at least as far as v2.2 from 2002)

Going back even further to the pre-FHS FSSTND v1.0 spec (from Early 1994), one will find this:

/tmp is used for temporary files, preferably on a fast device (a memory based filesystem, for instance).

The "persistence" of the data that is stored in /tmp is different from that of data which is stored in /var/tmp. /tmp may be cleaned out at boot time or at relatively frequent intervals. Therefore, data stored in /tmp should not be expected to remain for any long period.

Programs should use /tmp or /var/tmp (which was originally /usr/tmp) according to the expected requirements of the data, but should not rely on any particular persistence for any temporary storage directories.

/tmp may be on a RAM disk. /var/tmp should never be located on a RAM device.

tl;dr: Putting /tmp into a ramdisk, frequent reaping, and/or clearing it on every boot, has been part of its very definition for at least 30 years on Linux, and quite likely longer than that on "real" UNIXen.

And any programs expecting files to persistent in /tmp, much less do so forever [1], have *always been broken* according to the documented standards of the system they were intended to run on.

[1] Without out-of-band system administrator intervention.

Metrics missing

Posted Jun 5, 2024 13:38 UTC (Wed) by paulj (subscriber, #341) [Link]

/tmp was a ram based tmpfs going back to at least Solaris 2.4 or so, by my own experience. And wikip says it was by default going back to 2.1, availability of tmpfs going back to SunOS 4.

Metrics missing

Posted Jun 5, 2024 13:47 UTC (Wed) by koh (subscriber, #101482) [Link] (10 responses)

> See, I don't get this. Debian's default behaviour *today* is to periodically reap /tmp.

My Debian 10 based server doesn't seem to be doing that, without me having changed the settings. Which program/daemon is doing that?

> Also, let me quote the Linux FHS, section 3.18:
>
> "Programs must not assume that any files or directories in /tmp are preserved between invocations of the program."

OK, I'm fine with that. What happens to programs that run longer than 10 days? I've described an example in a comment above. From other comments on this article I gathered that sockets and the like for daemons should be moved to /run, so at this point the question becomes: what's the difference between a long-running process (which uses, say, 100% CPU continuously) and a long-running daemon that should put its stuff under /run?

> /tmp may be cleaned out at boot time or at relatively frequent intervals. Therefore, data stored in /tmp should not be expected to remain for any long period.

That's just an unusable rule. Basically makes /tmp worthless as there are no longer any guarantees whatsoever. Rightly so it's no longer been specified in this crude way - at least I hope. Well, up to now, I guess.

Metrics missing

Posted Jun 5, 2024 14:12 UTC (Wed) by farnz (subscriber, #17727) [Link] (9 responses)

The big use case for /tmp that's always been OK is "write out a small file that another program will immediately take in as input". If the dirent gets deleted not long after creation, that's A-OK, because the reader has already opened it and has a lock on the inode as a result (the file contents are therefore safe until the file is closed).

Basically for the case where you can't pipe output to the input of the other program, because it needs to seek or otherwise do file-like things on it, not pipe-like things.

Metrics missing

Posted Jun 5, 2024 14:48 UTC (Wed) by koh (subscriber, #101482) [Link] (8 responses)

> "write out a small file that another program will immediately take in as input" [...] lock on the inode

I suppose I should be glad that we finally have the following sequence atomic and uninterruptible:

1. spawn child process
2. wait until child is initialized and starts running
3. wait until child decides to open *the right file*

All this time I was under the impression that it's not, but now appearently we can be sure that noone presses ctrl-z or puts the computer to sleep while compiling something...

Uses for /tmp

Posted Jun 5, 2024 15:29 UTC (Wed) by farnz (subscriber, #17727) [Link] (7 responses)

We don't have that sequence; but you need some form of error handling for that case, anyway, since it's possible that you write out the file to a drive that physically fails between write and read - and there's never been a guarantee that the failure of the drive that contains /tmp will take down the system as a whole.

Uses for /tmp

Posted Jun 5, 2024 15:37 UTC (Wed) by mb (subscriber, #50428) [Link] (6 responses)

There is a huge difference between hardware failures and "cleanup" daemons deleting files.

Drive failure: The error reaction is: Throw an error and notify the user. Change the driver and the next run will succeed.

A "cleanup" daemon deleted my files: A sane error handling strategy does not exist. Next time the "cleanup" will delete my files again. The "cleanup" is the root cause of failure.

Uses for /tmp

Posted Jun 5, 2024 16:48 UTC (Wed) by farnz (subscriber, #17727) [Link] (5 responses)

In the case where the user paused your program for multiple days, then got surprised, it's "re-run without stopping at a critical moment, and the next run will succeed". The cleanup won't delete your files again unless you have that long pause, which in the case I was responding to was introduced with Ctrl-Z or system suspend.

The underlying issue is the expectation that data in a temporary location is safe for an arbitrary amount of time; I could have replaced "Ctrl-Z" and wait with "Ctrl-Z, then rm -fr /tmp/*" for the same effect. You should already be handling "the system-wide shared temporary location might get erased while in use", because there's already lots of ways in which it could get erased behind your back; making it a tmpfs, or adding a clean-up daemon, is just one more way on the existing list of ways you could lose data in /tmp.

Uses for /tmp

Posted Jun 5, 2024 21:00 UTC (Wed) by koh (subscriber, #101482) [Link] (4 responses)

Are you saying that any process relying on writing to and reading from /tmp is unreliable (as suspend/sigstop/etc. can happen to any process)? If so, what purpose does /tmp have in case I want my process to produce a reliable result? Is there any spec stating this unreliability? So far I've also not been aware of any restriction on reliability based on the time processes (or entire machines) can work or be suspended for unless their tasks involve network or other transient resources. Basically, IIUC, you're claiming that /tmp is a transient resource during process execution. Why?

The FHS-3.0 section 3.18 just says this about /tmp:
> The /tmp directory must be made available for programs that require temporary files.
> Programs must not assume that any files or directories in /tmp are preserved between invocations of the program.

There is no wording indicating that processes can't rely, during their execution, on the integrity of the files they themselves have written (modulo system bugs and hardware errors, as usual). That indeed would be contradictory to the file system's only stated purpose: storing temporary files *required* by programs.

If my understanding is correct, periodic "cleaning" reduces reliability on purpose. tmpfs is fine, though, as long as resuming a suspend-to-disk doesn't touch it.

Uses for /tmp

Posted Jun 5, 2024 21:14 UTC (Wed) by bluca (subscriber, #118303) [Link] (3 responses)

Yes, processes using /tmp to store precious, unreplaceable data are buggy, and have always been buggy, on Linux and on Unix before it. With tmpfiles.d we are actually a bit nicer, and give you a way out: take an flock, and the file will be left alone. And of course there's the usual filesystem semantics where, as long as a FD is open, the file content is still fully accessible to the owner of the FD, even if the dentry is gone.

But for precious, precious data a state directory in /var/lib needs to be used instead. Using /tmp means tacit acknowledgement that "yes this might go away at any time, and it's fine, I'll just detect it and recreate it if needed". And that's not even getting into the issue of the various filename hijacking vulneratbilities, that are non-obvious to handle if one isn't aware of them.

Uses for /tmp

Posted Jun 5, 2024 23:18 UTC (Wed) by koh (subscriber, #101482) [Link] (2 responses)

> Yes, processes using /tmp to store precious, unreplaceable data are buggy, and have always been buggy, on Linux and on Unix before it.

Citation needed.

> Using /tmp means tacit acknowledgement that "yes this might go away at any time, and it's fine, I'll just detect it and recreate it if needed".

A fractal of bad design: how can you "detect it" in particular when (rightly so) the advice has always been to use mkstemp(3) or similar?

Uses for /tmp

Posted Jun 6, 2024 0:25 UTC (Thu) by pizza (subscriber, #46) [Link] (1 responses)

>> Yes, processes using /tmp to store precious, unreplaceable data are buggy, and have always been buggy, on Linux and on Unix before it.
> Citation needed.

For Linux: Linux FHS 2.2, section 3.15 and 3.18, and before that, section 3.11 of the FSSTND, dating all the way back to Feburary 1994 [1], which was largely derived from standard Unix conventions.

Meanwhile, for Unix I can't be bothered to look it up, but every Unix system I had access to in the mid-late 90s [2] had an aggressively-reaped /tmp. Solaris and other Unix support forums show similar answers to [1].

[1] http://www.ibiblio.org/pub/Linux/docs/fsstnd/old/fsstnd-1.0/
[2] Solaris, SunOS, and HP-UX.

Uses for /tmp

Posted Jun 6, 2024 6:38 UTC (Thu) by koh (subscriber, #101482) [Link]

> For Linux: Linux FHS 2.2, section 3.15 and 3.18, and before that, section 3.11 of the FSSTND, dating all the way back to Feburary 1994 [1], which was largely derived from standard Unix conventions.

Thanks, I see.

Nitpick: Unlike [1], the FHS 2.2 and current 3.0 do no longer mention that dentrys in /tmp are unreliable by default. In fact, they state that programs may *require* temporary files stored therein. Appearently reliably only for WORN usage, since "detection" is racey with periodic cleanups.

Metrics missing

Posted Jun 6, 2024 22:40 UTC (Thu) by dskoll (subscriber, #1630) [Link] (1 responses)

See, I don't get this. Debian's default behaviour *today* is to periodically reap /tmp.

I don't believe that's the case. None of my Debian systems seem to do that. They clear /tmp on boot, but otherwise AFAIK the system doesn't do any regular cleaning of /tmp.

Metrics missing

Posted Jun 8, 2024 0:23 UTC (Sat) by pizza (subscriber, #46) [Link]

> They clear /tmp on boot, but otherwise AFAIK the system doesn't do any regular cleaning of /tmp.

You are correct -- It's been so long time since I did a new Debian installation that I forgot that tmpreaper isn't installed by default.

(But the fact that /tmp defaults to being cleaned at boot does obliterate arguments about how a ramdisk /tmp would behave any differently..)

Metrics missing

Posted Jun 5, 2024 12:19 UTC (Wed) by mb (subscriber, #50428) [Link] (3 responses)

>but I don't care about any of that

The biggest problem of all is how you communicate with people.

Metrics missing

Posted Jun 5, 2024 12:52 UTC (Wed) by bluca (subscriber, #118303) [Link] (2 responses)

Nope. Some things (many things) are well worth discussing. Some things just aren't, as it's just an endless stream of "but what about _MY_ use case" and it's literally impossible to do something that won't have any such complaints. In this case, where everything is trivially configurable and customizable, the only sensible course of action is to make a choice (and upstream is the best place to make such a choice), implement it, fix the couple of issues that crop up in-distro (already done), and document it for the rest. There is literally nothing of value to be gained from having an endless discussion about what's the best default for something that is entirely down to personal preferences - ask 10 people, you'll get 10 different answers. There is no great insight to be found, no clever solution, no lightbulb moment is just around the corner, just an endless stream of whinging. So yes, I don't care about any of that, and I am honest enough to just say it as it is, sorry (not sorry).

Metrics missing

Posted Jun 5, 2024 16:21 UTC (Wed) by rschroev (subscriber, #4164) [Link] (1 responses)

But in a case like this, there is not even a need to make a decision. I feel there's a very big difference between making a choice in a situation without history where the only consideration is the relative merits of the different choices, versus a situation where one of the choices was already chosen historically. In the latter case, the disadvantage of changing an existing situation needs to be taken into account too. If one choice is clearly better, it'll probably be worth it even it means exposing people to change.

What we have here is a case where one of alternatives has been in use for a very long time. At the same time seems that none of the alternatives is a clear winner (or at least that's the feeling I get from reading these comments). So why change? It leads to some people having to change their configuration, it leads to endless discussion, and as far as I can see has no real benefit.

From this discussion and the one about keepassxc, I get the feeling that Debian maintainers see every release as a new starting point, with not much consideration for keeping things the same between releases. What happened to "If it ain't broken, don't fix it" and the principle of least surprise?

> There is literally nothing of value to be gained from having an endless discussion about what's the best default for something that is entirely down to personal preferences - ask 10 people, you'll get 10 different answers.

So yes, choose a default, ignore the bike shedding. But once it's chosen (which in this case happened a long time ago), *stick with it* (until a clearly better alternative presents itself).

It could very well be that there actually is a good reason to change here, but honestly I haven't seen it anywhere in this whole discussion.

Metrics missing

Posted Jun 5, 2024 16:24 UTC (Wed) by bluca (subscriber, #118303) [Link]

> But once it's chosen (which in this case happened a long time ago), *stick with it*

Nothing was chosen, there was just inertia. tmpfs as a filesystem wasn't even available at the very beginning.

Time-based deletion

Posted Jun 5, 2024 12:37 UTC (Wed) by dskoll (subscriber, #1630) [Link]

I hesitantly jump in to the fray here... I am not a fan of time-based deletion. Rather than making it the default, IMO it should be off by default with a very simple way to turn it on for those who want it. Otherwise it turns /tmp into a weirdly-broken disk drive.

I've been running with a ramdisk for /tmp for years, and current stats are as follows:

$ df -h /tmp/
Filesystem      Size  Used Avail Use% Mounted on
tmpfs            32G  2.3M   32G   1% /tmp

after an uptime of about 3 days, but this is typical even after much longer uptimes.

(Yes, I have 64GB of RAM in the machine.) I've never seen /tmp even come remotely close to filling up, so time-based deletion is completely unnecessary for me.

Not a huge deal

Posted Jun 5, 2024 18:17 UTC (Wed) by wsy (subscriber, #121706) [Link]

I already keep a repo of custom config for my machines. It's just another customization to carry, not a huge deal for me.

Planned Debian regression

Posted Jun 9, 2024 22:12 UTC (Sun) by anton (subscriber, #25547) [Link]

In the bad old days systems deleted old files from /tmp, and that resulted in occasional breakage. Nothing that could not be worked around, but not a desirable state of affairs, either. Then one day I expected breakage, but it did not happen. And I was pleasantly surprised that Debian does not delete from /tmp except on rebooting; the latter is perfectly fine, because a process does not continue across reboots anyway. But it can live for longer than 10 days, and for longer than 30 days. Going back to deleting files after a while would be a regression.

And here's some data from a multi-user Debian 11 machine with 446 days of uptime:

# df -hi /tmp
Filesystem     Inodes IUsed IFree IUse% Mounted on
rpool/tmp         77M   647   77M    1% /tmp
neue-a4:/tmp# df -h /tmp
Filesystem      Size  Used Avail Use% Mounted on
rpool/tmp        39G   14M   39G   1% /tmp
# ls -ltrc|awk '{print $3}'|sort -u|wc -l
9
The last line means that there are 6 regular users with files in /tmp, as well as root and nobody, plus an empty entry from a summary line. There are files there that were created over a year ago. In this data I see no reason to delete files from /tmp between reboots.

Concerning using a RAMdisk and then using swap when memory runs out, with swap being supposedly usable again thanks to SSD speeds: Why do we want to use a RAMdisk in the first place if we have an SSDs and that is so fast? The multi-user machine shown above should do ok with /tmp on a RAMdisk (it has 128GB RAM, and 0 swap space), but OTOH the current arrangement (/tmp on ZFS) works fine.


Copyright © 2024, Eklektix, Inc.
This article may be redistributed under the terms of the Creative Commons CC BY-SA 4.0 license
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds