Suggestion: Google Security Engineering Notes

[jrandrusk]

/tmp is mounted with exec permissions by default, but should be setup with noexec, nodev, and nosuid so as to prevent malware from being able to execute as this is the first spot they attempt to drop and execute the payload.