[GH-ISSUE #1017] Allow custom tmp path for Linux agent #2567

New issue

Closed

opened 2026-03-14 04:37:31 +03:00 by kerem · 3 comments

kerem commented

2026-03-14 04:37:31 +03:00

Owner

Originally created by @georgebarnick on GitHub (Mar 22, 2022).
Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/1017

This may be an edge case but in situations where /tmp/ has locked down permissions or special handling on the system, Tactical RMM has trouble installing and executing scripts.

I've been able to verify this in one particular case, which is on CentOS 7 servers running a clean install of cPanel/WHM. From my understanding, cPanel locks the /tmp/ filesystem down using a script they call securetmp. Beyond that I haven't looked very much into this case and not entirely sure on to what extent it's locked down, but from what I can tell, execution is prevented entirely in that filesystem, even as root.

What I was able to confirm however is that during the install using the Linux installation script, it can't execute ./meshagent inside of its tmp directory it downloads to. Moving ./meshagent somewhere else (such as /home/) works and installs fine however. Once the agent is installed, if you try to execute a script, it gets Permission Denied inside of /tmp/trmmXXXXXXXXXX/. Example below:

Script Output
Last Run: Mar-22-2022 - 15:50
Run Time: 0.0005 seconds
Return Code: -1

Standard Error

fork/exec /tmp/trmm2651145699: permission denied

Since this may be an edge case and could vary depending on what types of Linux installs might handle /tmp/ differently, I was thinking it could be a good feature request to specify a custom temporary file path for Tactical RMM to use during the install process, rather than it being forced to use /tmp/.

Originally created by @georgebarnick on GitHub (Mar 22, 2022). Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/1017 This may be an edge case but in situations where /tmp/ has locked down permissions or special handling on the system, Tactical RMM has trouble installing and executing scripts. I've been able to verify this in one particular case, which is on CentOS 7 servers running a clean install of cPanel/WHM. From my understanding, cPanel locks the /tmp/ filesystem down using a script they call [securetmp](https://docs.cpanel.net/whm/scripts/the-securetmp-script/). Beyond that I haven't looked very much into this case and not entirely sure on to what extent it's locked down, but from what I can tell, execution is prevented entirely in that filesystem, even as root. What I was able to confirm however is that during the install using the Linux installation script, it can't execute ./meshagent inside of its tmp directory it downloads to. Moving ./meshagent somewhere else (such as /home/) works and installs fine however. Once the agent is installed, if you try to execute a script, it gets Permission Denied inside of /tmp/trmmXXXXXXXXXX/. Example below: ``` Script Output Last Run: Mar-22-2022 - 15:50 Run Time: 0.0005 seconds Return Code: -1 Standard Error fork/exec /tmp/trmm2651145699: permission denied ``` Since this may be an edge case and could vary depending on what types of Linux installs might handle /tmp/ differently, I was thinking it could be a good feature request to specify a custom temporary file path for Tactical RMM to use during the install process, rather than it being forced to use /tmp/.

kerem closed this issue

2026-03-14 04:37:36 +03:00

kerem commented

2026-03-14 04:37:42 +03:00

Author

Owner

@bbrendon commented on GitHub (Mar 22, 2022):

From a cpanel machine I have access to, I think this might be what the issue is. noexec.

/dev/mapper/centos-tmp on /tmp type ext4 (rw,nosuid,noexec,relatime,seclabel,data=ordered)

It might be possible to remove noexec, install, then re-add it. I'm not sure what the best practice is here.

@bbrendon commented on GitHub (Mar 22, 2022): From a cpanel machine I have access to, I think this might be what the issue is. `noexec`. ``` /dev/mapper/centos-tmp on /tmp type ext4 (rw,nosuid,noexec,relatime,seclabel,data=ordered) ``` It might be possible to remove noexec, install, then re-add it. I'm not sure what the best practice is here.

kerem commented

2026-03-14 04:37:47 +03:00

Author

Owner

@wh1te909 commented on GitHub (Mar 24, 2022):

I've pushed a fix to fallback to the current directory if creating it in the tmp dir fails

@wh1te909 commented on GitHub (Mar 24, 2022): I've pushed a fix to fallback to the current directory if creating it in the tmp dir fails

kerem commented

2026-03-14 04:37:52 +03:00

Author

Owner

@wh1te909 commented on GitHub (Mar 25, 2022):

fixed in release 0.12.1 please check release notes. you'll need to manually update the agent if already installed since /tmp was used for agent update as well

@wh1te909 commented on GitHub (Mar 25, 2022): fixed in release 0.12.1 please check release notes. you'll need to manually update the agent if already installed since /tmp was used for agent update as well