/tmp should be mounted as a separate filesystem with the noexec,nosuid options set