Making /tmp non-executable

Increase security by mounting /tmp as non-executable.

Many high security environments require that the /tmp directory be mounted with the noexec flag set to prevent executables from executing from /tmp. However, when /tmp is non-executable, the Cassandra database fails to starts because JNA cannot start when it does not have a file system location to keep temporary files.

If the /tmp directory is not available, the Cassandra system.log might have an error. To view the error:
tail -3 /var/log/cassandra/system.log
The error is similar to:
ERROR main 2015-12-18 09:57:00,879 - JNA failing to initialize properly. Use -Dcassandra.boot_without_jna=true to bootstrap even so.
INFO Thread-2 2015-12-18 09:57:00,880 - DSE shutting down...
INFO Thread-2 2015-12-18 09:57:00,881 - All plugins are stopped.


To make /tmp non-executable and provide access:

  1. Verify that DataStax Enterprise is running:
    service dse status
    dse is running
  2. Verify how the /tmp directory is mounted.
    mount | grep /tmp
    tmpfs on /tmp type tmpfs (rw,nosuid,nodev,relatime,size=3668992k)
  3. Stop DataStax Enterprise.
    service dse stop
  4. Verify that DatatStax Enterprise is not running.
    service dse status
    dse is not running
  5. Remount /tmp as non-executable.
    mount -o remount,noexec /tmp
  6. Verify that the /tmp directory is mounted as non-executable.
    mount | grep /tmp
    tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noexec,relatime,size=3668992k)
  7. In the file, add this line for the /tmp directory that you have access to:
    JVM_OPTS="$JVM_OPTS -Djna.tmpdir=/tmp/directory/you/have/exec/access/to
  8. Restart DataStax Enterprise.