Universal Forwarder RPM Upgrade Failure on Hardened Linux Systems with /var/tmp Mounted as noexec

A Universal Forwarder RPM installation or upgrade fails with errors similar to:

runuser: failed to execute
/var/tmp/splunk-preinstall.XXXXXX/temp_splunk-preinstall: Permission denied
failed to run splunk-preinstall as splunk
splunk-preinstall upgrade check failed

The behavior is observed on hardened Linux hosts configured with security controls that prevent execution from the /var/tmp filesystem. As a result, the pre-installation validation process is unable to complete and the upgrade is aborted before package installation proceeds.

Review of the installation logs identified that the failure occurs when the installer creates and attempts to execute a temporary script under /var/tmp.

The following commands can be used to confirm the system configuration:

mount | grep /var/tmp
mount | grep tmp
ls -ld /var/tmp
id splunk
getenforce

Systems exhibiting the issue commonly show /var/tmp mounted with the noexec option, preventing execution of the temporary splunk-preinstall script.

The issue is tracked under defect:

SPL-313320

Internal findings indicate the behavior is associated with the installer's dependency on executing a temporary script from /var/tmp during the validation phase.

Related advisory:

SVD-2026-1001