Do not run programs from /tmp

High risk Not ticked by default Catalog reviewed: 2026-11-05

Malware and exploits often drop a program into /tmp and run it. This stops anything from running there.

Why it matters

After breaking in, malware and exploit scripts often download a program into /tmp, because anyone can write there, and then run it. Mounting /tmp so that nothing in it can be executed breaks that step and forces the attacker to find another place.

How it works

Sets the noexec mount option on /tmp, so the kernel refuses to execute programs stored there and refuses to map files from it as executable code. It does not stop an interpreter from reading a script, so bash /tmp/script.sh can still run.

Who should use it

Suits servers and tidy desktops where software is installed from the package manager. Developers and anyone who builds software or runs installers should think twice, as a lot of tooling expects to run things from /tmp.

What you may notice

Programs fail with Permission denied or failed to map segment from shared object. Installers, build tools, package scripts and some Java or Python modules that unpack code into /tmp are the usual victims.

Check it on your computer

See the options of the mount:

findmnt -no OPTIONS /tmp

Apply it by hand

Add the option to the mount in /etc/fstab, or in a systemd mount unit, then remount:

# /etc/fstab, add "noexec" to the options of /tmp, for example:
tmpfs  /tmp  tmpfs  defaults,noexec  0 0
sudo mount -o remount /tmp

Undo it

Take the option out again and remount.

Related settings

Protect shared folders from link and file tricks

Sources

Linux Hardening Guide (madaidans): 17