tools: pmount and safe TMPDIR

modules/tool.nix

@@ -46,6 +46,28 @@ in
     pkgs.psmisc # killall, pstree
   ];
 
+  security.wrappers = {
+    pmount = {
+      setuid = true;
+      owner = "root";
+      group = "root";
+      source = "${pkgs.pmount}/bin/pmount";
+    };
+    pumount = {
+      setuid = true;
+      owner = "root";
+      group = "root";
+      source = "${pkgs.pmount}/bin/pumount";
+    };
+  };
+
+  environment.interactiveShellInit = ''
+    # Use XDG_RUNTIME_DIR for temporary files if available
+    if [ -d "$XDG_RUNTIME_DIR" ]; then
+      export TMPDIR="$XDG_RUNTIME_DIR"
+    fi
+  '';
+
   environment.shellAliases =
     let
       take = pkgs.writers.writeDash "take" ''