Skip to content

Add troubleshooting section about tmp mounted as noexec #2505

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sbesson merged 7 commits into from
Feb 15, 2026
Merged

Add troubleshooting section about tmp mounted as noexec #2505

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
ff860a4
Add troubleshooting section about tmp mounted as noexec
sbesson Dec 2, 2025
85a4a10
Fix markup for config properties
sbesson Dec 4, 2025
7d64f7e
Reword tmp noexec issue to highlight the resolution via upgrade first
sbesson Jan 20, 2026
609722c
Merge remote-tracking branch 'origin/develop' into tmp_no_exec
sbesson Jan 20, 2026
187c16d
Use file markup for /tmp
sbesson Jan 20, 2026
cff53ef
Apply suggestions from code review
sbesson Jan 20, 2026
1affd16
Update omero/sysadmins/troubleshooting.rst
sbesson Jan 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 42 additions & 0 deletions omero/sysadmins/troubleshooting.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -456,6 +456,48 @@ To resolve this, define the :envvar:`OMERO_TMPDIR` environment variable
to point at a temporary directory located on the local file system
(e.g. :file:`/tmp/omero`).


tmp directory mounted with noexec permissions
---------------------------------------------

Security best practices like the CIS benchmarks or the NIST SP 800-53 framework recommend to
set the `noexec` mount option on the :file:`/tmp` partition. In such systems, Java Native Interface (JNI)
will be unable to make use of the default temporary directory to call native shared libraries which
is a requirement for reading some file formats like NDPI.

Under such situation, errors like the following will appear either server-side or client-side
during import::

java.lang.NoClassDefFoundError: Could not initialize class com.sun.jna.NativeLong
at com.sun.jna.ptr.NativeLongByReference.<init>(NativeLongByReference.java:19)

or::

java.lang.UnsatisfiedLinkError: 'void org.libjpegturbo.turbojpeg.TJDecompressor.init()'
at org.libjpegturbo.turbojpeg.TJDecompressor.init(Native Method)

The recommended resolution is to upgrade OMERO.server to version 5.6.17 or later and OMERO.py
to version 5.21.3 or later. Starting with these versions, the Java processes are configured to
use a temporary directory other than :file:`/tmp`.

For older versions of OMERO.server and OMERO.py, a workaround is to set the `java.io.tmpdir`
system property to point at a temporary directory with the appropriate permissions.

For OMERO.server 5.6.16 and below, this aim should be achieved using :property:`omero.jvmcfg.append`::

mkdir -p /opt/omero/OMERO.current/var/tmp
omero config set -- omero.jvmcfg.append -Djava.io.tmpdir=/opt/omero/OMERO.current/var/tmp

For imports using OMERO.py 5.21.2 and earlier, this property should be set using the
:envvar:`JAVA_OPTS` environment variable::

export JAVA_OPTS="-Djava.io.tmpdir=/opt/omero/OMERO.current/var/tmp/"
omero import ...

.. seealso::

https://github.com/ome/openmicroscopy/issues/6439

Other issues
------------

Expand Down