I have configured my first publicly accessible nginx server. I have configured it to use a /tmp/nginx folder to store temp files. This includes the body of http requests, proxy files etc. The /tmp folder is on external partition with nosuid, noexec and nodev privileges. Is this configuration potentially dangerous?
The greatest concern is that an attacker can use a temporary directory to store executable code, which is a useful foothold when exploiting your system. Almost always the /tmp has very open privileges, such that any process can write to them (chmod 777). As an example, I took advantage of this property of /tmp when bypassing AppArmor to obtain remote codex execution in PHP-Nuke using a Local File Include vulnerability chained with a MySQL's into outfile. File uploads are also commonly stored in /tmp which in PHP can also turn a LFI vulnerability in to remote code execution.
Regardless of platform there are two permission strategies you must adopt. The rational is that an attacker is going to use your application against you and there for is limited by what the application can do.
It may have security implications if other users on the box have access to the box's tmp folder.
If others have access they may read the tmp folder, extract a session id then hijack it.
The tmp folder should be limited to only the webserver.