What is the "correct" or most elegant solution when /tmp is mounted with noexec?

[ee-github]

I ran into a situation where my pyinstaller-frozen app (onefile mode) no longer worked after being rebuilt on a newer version/build of RHEL where /tmp is mounted with noexec. The cause is well-described in the docs (thank you for that).

I need the app to be easily executable by any user so previously I just had the onefile executable in one of the directories in $PATH. Now, however, to get around the /tmp noexec issue, my solution is to instead put into a $PATH directory a bash script that looks something like:

#!/bin/bash

TMPDIR=/different/tmpdir /path/to/onefile/executable "$@"

And this works fine, but deploying this to a bunch of servers just got slightly more clumsy because of the need to distribute that bash script into one place and then the actual executable somewhere else.

Is there a better solution?

Should I instead set runtime-tmpdir=/different/tmpdir as a command line option at build time? Is there any downside to this? I ask because of the warnings in the help output like "rarely used" and "only if you know what you're doing". I think I know what I'm doing, but I figured it doesn't hurt to ask :).

Any feedback appreciated.

[rokm]

Should I instead set runtime-tmpdir=/different/tmpdir as a command line option at build time? Is there any downside to this?

Using runtime-tmpdir means that the path to temporary directory becomes hard-coded and impossible to change without a rebuild (and on POSIX systems, the path cannot contain environment variables). Whether you consider this a downside or an upside or are indifferent to it very much depends on your situation.

[ee-github]

Thank you. This is definitely a consideration worth keeping in mind.

[bwoodsend]

If RHEL is explicitly trying to block applications from executing temporary files then attempting to use onefile mode isn't going to work out cleanly.

[ee-github]

My understanding is that this stems from a common security recommendation to mount /tmp (and other "world writable" directories) with no exec. Not necessarily RHEL preventing execution of temporary files in a general sense. So in theory pointing pyinstaller to some other temp dir that has write and execute permissions by all relevant users should work fine. At least that's my understanding. Happy to be corrected.

The curiosity here is mainly to weight some pros/cons of the two approaches that I know of to define that alternate temp dir.

[ee-github]

Just marking this one answered. Thanks for the feedback .