1 files changed, 11 insertions, 0 deletions

diff --git a/etc/disable-exec.inc b/etc/disable-exec.inc
new file mode 100644
index 000000000..c535af7d4
--- /dev/null
+++ b/etc/disable-exec.inc
@@ -0,0 +1,11 @@
+# This file is overwritten during software install.
+# Persistent customizations should go in a .local file.
+include disable-exec.local
+
+noexec ${HOME}
+noexec ${RUNUSER}
+noexec /dev/shm
+noexec /tmp
+# /var/tmp is noexec by default
+# just in case there is a keep-var-tmp option:
+noexec /var/tmp