^^^ Above, hopefully, means

Trigger event if both process (aka child_process), corresponding parent existed within unprivileged location

. The reason I'm asking, because some legit Linux processes actually use /tmp as a location for various operations, like update-notifier, timeshift, fluentd, etc