Remount /tmp with exec permission

Some software installations and compilation tasks require execute permission on /tmp. On hardened cPanel servers, /tmp is mounted with noexec by default as a security measure. Here is how to temporarily remount it with exec permission and re-secure it afterward.

01. Check Current Mount Options

mount | grep /tmp

Look for noexec in the output. If present, /tmp does not allow script execution:

/dev/sda1 on /tmp type ext4 (rw,nosuid,noexec,nodev)

02. Remount with exec

mount -o remount,exec /tmp

Verify the change:

mount | grep /tmp
# Should now show: (rw,nosuid,nodev) without noexec

03. Remount with noexec (Re-secure)

After your installation or compilation is complete, immediately re-secure /tmp:

mount -o remount,noexec /tmp

Verify:

mount | grep /tmp
# Should show: (rw,nosuid,noexec,nodev)

04. Why /tmp Is noexec by Default

/tmp is world-writable (anyone can write files to it). On a web server, this means:

• A compromised PHP script can upload a malicious binary to /tmp
• Without noexec, the attacker can then execute that binary
• With noexec, the binary is written but cannot be executed - the attack is stopped

This is a standard hardening practice recommended by CIS benchmarks and cPanel's security advisor.

05. Alternatives to Remounting

If you need exec on /tmp frequently for cPanel updates or EasyApache builds, consider these alternatives:

• Use a different temp directory - set TMPDIR=/root/tmp before running the installer. Many build tools respect this environment variable
• cPanel's built-in handling - recent cPanel versions automatically handle noexec /tmp during updates by using /usr/local/cpanel/tmp/ instead
• Script the process - wrap your task in a script that remounts, runs the task, and remounts back:

  mount -o remount,exec /tmp
  # run your task here
  mount -o remount,noexec /tmp

Quick Recap

1. Check: mount | grep /tmp
2. Enable exec: mount -o remount,exec /tmp
3. Do your work (install, compile, etc.)
4. Re-secure: mount -o remount,noexec /tmp
5. Verify: mount | grep /tmp shows noexec

32,941 users found this article useful · Last updated March 2026 · Browse all Server Maintenance articles