nodev,noexec,nosuid is how I've mounted /tmp (and several others) for going on two decades. I've never been a fan of installers creating a single partition by

nodev,noexec,nosuid is how I've mounted /tmp (and several others) for going on two decades. I've never been a fan of installers creating a single partition by default and I wish they didn't do it. Years ago, like you, I saw an out-of-date web app get hit by an exploit but was "saved" because of some of those mount options. I'm a big fan of SELinux on public-facing servers too (especially web servers, for the same reason), but that's an argument for another day.