I was pulling my hair out this morning trying to figure out why my PHP web
script could see files in /var/tmp/scriptname but I couldn't see them with
ls or my text editor. I was certain I'd gotten rootkitted. Then I thought
maybe it was a new chroot in the latest Apache config. It turns out it's
systemd's unit file for Apache, which containerizes /tmp and /var/tmp for
selected apps. The httpd.service unit file includes the PrivateTmp setting.
Here's some details for anyone else confused by this:
https://access.redhat.com/blogs/766093/posts/1976243
