How Linux Manages Temporary Files in /tmp

The /tmp directory in the Linux operating system serves as a shared workspace for applications and users to store temporary data needed during active sessions. This article examines the mechanics behind how Linux manages /tmp, including whether it resides in system memory or physical storage, the role of specialized permissions like the sticky bit, and how background services such as systemd automatically clean and prune old files.

Storage Location: RAM vs. Disk

In modern Linux distributions, the /tmp directory is frequently mounted as a tmpfs filesystem. A tmpfs mount resides directly in volatile memory (RAM) and system swap space rather than on a persistent physical drive. This design significantly improves input/output performance for temporary read-and-write operations. Consequently, because volatile memory loses power during a system shutdown, all data stored in a tmpfs-backed /tmp is wiped instantly upon reboot.

On distributions or custom configurations where /tmp is not configured as tmpfs, it exists as a standard directory on the root partition or a dedicated physical disk partition (such as ext4 or XFS). In these environments, files physically remain on the disk across reboots unless an explicit cleanup policy removes them during the boot sequence.

Automated Cleanup with systemd-tmpfiles

For long-running servers that rarely reboot, Linux relies on automated system daemons to prevent /tmp from consuming all available storage. Most contemporary distributions use systemd-tmpfiles to manage this lifecycle.

The management process relies on two key components:

• Configuration Files: Rules defining how /tmp is handled are stored in /usr/lib/tmpfiles.d/tmp.conf and /etc/tmpfiles.d/. By default, files inside /tmp are configured to be deleted if they have not been accessed, modified, or changed for a specific duration—typically 10 days.
• Timers: A system service named systemd-tmpfiles-clean.timer triggers systemd-tmpfiles-clean.service periodically (often once every 24 hours). This job scans /tmp, checks file timestamps (atime, mtime, and ctime), and unlinks files that exceed the defined age threshold.

Older Linux distributions or minimal distributions without systemd typically achieve similar automated pruning through daily cron jobs using utilities such as tmpwatch or tmpreaper.

Security and Permissions: The Sticky Bit

Because /tmp must be accessible to every service and user on a system, it has universal read, write, and execute permissions. Standard Linux permissions would ordinarily allow any user with write access to delete or overwrite another user's files. Linux mitigates this security vulnerability using a special permission called the "sticky bit."

The /tmp directory is assigned octal permissions of 1777 (drwxrwxrwt). The trailing t indicates the sticky bit is active. Under this rule, while any user can create new files inside /tmp, only the root user or the actual owner of a specific file has permission to rename, edit, or delete that file.

Difference Between /tmp and /var/tmp

Linux maintains a strict separation between /tmp and /var/tmp in accordance with the Filesystem Hierarchy Standard (FHS):

• /tmp: Intended for short-lived, transient files that can be deleted at any time without compromising application integrity, especially across reboots.
• /var/tmp: Intended for temporary files that require persistence across system restarts. Unlike /tmp, /var/tmp is rarely mounted as tmpfs and typically retains its contents for a much longer period (often a 30-day cleanup cycle via systemd).