# Restrict shared memory
tmpfs  /dev/shm  tmpfs  defaults,nodev,nosuid,noexec 0 0

# Restrict /tmp (keep noexec off to allow dev strict directly run out of /tmp)
tmpfs  /tmp  tmpfs  defaults,nodev,nosuid  0 0