Search notes:

/var/tmp/.oracle/

/var/tmp/.oracle is a directory that belong to root, but is world read/writeable:

$ stat -c '%A %U %G' /var/tmp/.oracle
drwxrwxrwt root root

This directory is created by $ORACLE_HOME/network/install/sqlnet/setowner.sh.