Very nice, thank you. I will look into this. This may be my break into PAM that I've ignored thus far.

I'm wondering if there's programs that will break with such a change. One example would be if multiple users in a group need access to the same file under /tmp.

pam_namespace normally isolates /tmp by user or SELinux context, so your example might require a couple tweaks. I haven't tried any of these but I'm thinking any of:

1) You could modify the namespace init script used by pam_namespace to also mount a shared directory under each user's /tmp, and do this only for the users who need it.

2) Rely on a different shared directory for the users who need it.

3) Configure namespace.conf to isolate by SELinux context and put each user who needs a shared /tmp into the same SELinux role.

What occurs to me now is that with a proper SELinux configuration you do not even need per-user /tmp, you can use the old /tmp for all. It is still motivating to look into PAM, but perhaps also motivating to learn more about SELinux that I've also put off.