Dear Maintainer,

we use the Linux fanotify interface in a virus scanner to detect
viruses as soon as the files are written. Yesterday we noticed that a
machine that has been upgraded to Debian stretch no longer detects
viruses that have been uploaded with a PHP script served by Apache.

The issue is easily reproducable by installing the package fnotifystat
and using that to monitor for filesystem events caused by Apache, for
example:

# fnotifystat -v | grep apache

Then request some document served by Apache, or just trigger a reload:

# systemctl reload apache2

fnotifystat won't print any filesystem events caused by Apache, the only
thing you'll see are a few events from apachectl that is used by systemd
to reload Apache.

The reason for this is apparently the namespace isolation done by
systemd that is triggered by the following setting:

host ~ # grep PrivateTmp /lib/systemd/system/apache2.service
PrivateTmp=true

If I comment the PrivateTmp line out and then restart Apache:

# systemctl daemon-reload; systemctl restart apache2

then fnotifystat will be able to see events caused by Apache, either
from requesting a document, or from reloading it. This issue has been
documented on some websites already, but I haven't found any bugreports
for it yet:

https://community.sophos.com/kb/en-us/122625
https://lkml.org/lkml/2015/10/29/268
https://community.f-secure.com/t5/Business/Linux-Security-11-00-unable-to/ta-p/77793

It is easily worked around by disabling PrivateTmp on all services that
may be used to upload files, but I do believe that it should be properly
fixed in the kernel. fanotify seems to be the intended interface for
virus scanners, and therefore it shouldn't be accidentally circumvented
by namespace isolation.