Skip to content

Add troubleshooting section about tmp mounted as noexec #2505

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sbesson wants to merge 2 commits into
base: develop
Choose a base branch
from
Open

Add troubleshooting section about tmp mounted as noexec #2505

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ff860a4
Add troubleshooting section about tmp mounted as noexec
sbesson Dec 2, 2025
85a4a10
Fix markup for config properties
sbesson Dec 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 40 additions & 0 deletions omero/sysadmins/troubleshooting.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -456,6 +456,46 @@ To resolve this, define the :envvar:`OMERO_TMPDIR` environment variable
to point at a temporary directory located on the local file system
(e.g. :file:`/tmp/omero`).


tmp directory mounted with noexec permissions
---------------------------------------------

Under some conditions, the OMERO.server or the data import can fail with exceptions like::

java.lang.NoClassDefFoundError: Could not initialize class com.sun.jna.NativeLong
at com.sun.jna.ptr.NativeLongByReference.<init>(NativeLongByReference.java:19)

or::

java.lang.UnsatisfiedLinkError: 'void org.libjpegturbo.turbojpeg.TJDecompressor.init()'
at org.libjpegturbo.turbojpeg.TJDecompressor.init(Native Method)

These errors can be caused by the `/tmp` partition might be mounted with noexec permissions.
This configuration follows security best practices from the CIS benchmarks or the NIST SP 800-53
framework and prevents Java from using native shared libraries by default, which is requirement
for the reading of some file formats.

For older versions of OMERO.server and OMERO.py, the workaround is to set the `java.io.tmpdir`
system property to point at a temporary directory with the appropriate permissions.

For OMERO.server 5.6.16 and below, this property should be achieved using :property:`omero.jvmcfg.append`::

mkdir -p /opt/omero/OMERO.current/var/tmp
omero config set -- omero.jvmcfg.append -Djava.io.tmpdir=/opt/omero/OMERO.current/var/tmp

For imports using OMERO.py 5.21.2 and earlier, this property should be set using the
:envvar:`JAVA_OPTS` environment variable::

export JAVA_OPTS="-Djava.io.tmpdir=/opt/omero/OMERO.current/var/tmp/"
omero import ...

Starting with OMERO.server 5.6.17 and OMERO.py 5.21.3, the application should internally use
a local temporary directory other than `/tmp` and these workarounds can be removed be unnecessay.

.. seealso::

https://github.com/ome/openmicroscopy/issues/6439

Other issues
------------

Expand Down