I was pulling my hair out this morning trying to figure out why my PHP web script could see files in /var/tmp/scriptname but I couldn’t see them with ls or my text editor. I was certain I’d gotten rootkitted. Then I thought maybe it was a new chroot in the latest Apache config. It turns out it’s systemd’s unit file for Apache, which containerizes /tmp and /var/tmp for selected apps. The httpd.service unit file includes the PrivateTmp setting.

Here’s some details for anyone else confused by this:

https://access.redhat.com/blogs/766093/posts/1976243