Add noexec /tmp detection — fall back to /usr/local/src for staging

Scripts auto-detect noexec /tmp by attempting to execute a test script.
If /tmp is noexec, staging directory falls back to /usr/local/src.
Supports mixed fleets with both noexec and standard /tmp mounts.

Updated: deploy-exporter (1.1), install-node-exporter (1.2),
install-prometheus-stack (3.2), update-prometheus-stack (1.02),
install-snort (1.02), install-ntfy-server (1.1), install-bot-monitor (1.2)

install-snort.sh

@@ -8,7 +8,7 @@
 # Contact: contact@mylinux.work
 # Website: https://mylinux.work
 # License: MIT
-# Version: 1.01
+# Version: 1.02
 #
 # Usage:
 #   sudo ./install-snort.sh
@@ -39,6 +39,18 @@ DRY_RUN=false
 UNINSTALL=false
 SKIP_BUILD=false
 
+# Detect noexec /tmp — fall back to /usr/local/src
+STAGE_DIR="/tmp"
+_exec_test=$(mktemp /tmp/.exec_test.XXXXXX 2>/dev/null)
+if [[ -n "$_exec_test" ]]; then
+    printf '#!/bin/sh\nexit 0\n' > "$_exec_test"
+    chmod +x "$_exec_test"
+    "$_exec_test" 2>/dev/null || STAGE_DIR="/usr/local/src"
+    rm -f "$_exec_test"
+else
+    STAGE_DIR="/usr/local/src"
+fi
+
 # Colors
 RED='\033[0;31m'
 GREEN='\033[0;32m'
@@ -201,7 +213,7 @@ install_dependencies() {
 build_libdaq() {
     log_step "Building libdaq $DAQ_VERSION..."
 
-    local build_dir="/tmp/snort-build"
+    local build_dir="${STAGE_DIR}/snort-build"
     mkdir -p "$build_dir"
     cd "$build_dir"
 
@@ -224,7 +236,7 @@ build_libdaq() {
 build_snort() {
     log_step "Building Snort $SNORT_VERSION..."
 
-    local build_dir="/tmp/snort-build"
+    local build_dir="${STAGE_DIR}/snort-build"
     mkdir -p "$build_dir"
     cd "$build_dir"
 
@@ -336,16 +348,16 @@ download_rules() {
     if [[ "$COMMUNITY_RULES" == true ]]; then
         log_info "Downloading community rules..."
         local community_url="https://www.snort.org/downloads/community/snort3-community-rules.tar.gz"
-        wget -q "$community_url" -O /tmp/snort3-community-rules.tar.gz || {
+        wget -q "$community_url" -O ${STAGE_DIR}/snort3-community-rules.tar.gz || {
             log_warn "Failed to download community rules — trying alternative URL"
             wget -q "https://www.snort.org/downloads/community/community-rules.tar.gz" \
-                -O /tmp/snort3-community-rules.tar.gz || {
+                -O ${STAGE_DIR}/snort3-community-rules.tar.gz || {
                 log_error "Cannot download community rules"
                 return 1
             }
         }
-        tar xzf /tmp/snort3-community-rules.tar.gz -C /tmp/
-        find /tmp/ -name '*.rules' -path '*community*' -exec cp {} "$RULE_DIR/" \;
+        tar xzf ${STAGE_DIR}/snort3-community-rules.tar.gz -C ${STAGE_DIR}/
+        find ${STAGE_DIR}/ -name '*.rules' -path '*community*' -exec cp {} "$RULE_DIR/" \;
         log_info "Community rules installed to $RULE_DIR/"
     fi
 
@@ -355,11 +367,11 @@ download_rules() {
         else
             log_info "Downloading registered rules with Oinkcode..."
             local reg_url="https://www.snort.org/reg-rules/snortrules-snapshot-31840.tar.gz/$OINKCODE"
-            wget -q "$reg_url" -O /tmp/snort-registered-rules.tar.gz || {
+            wget -q "$reg_url" -O ${STAGE_DIR}/snort-registered-rules.tar.gz || {
                 log_error "Failed to download registered rules (check Oinkcode)"
                 return 1
             }
-            tar xzf /tmp/snort-registered-rules.tar.gz -C "$RULE_DIR/"
+            tar xzf ${STAGE_DIR}/snort-registered-rules.tar.gz -C "$RULE_DIR/"
             log_info "Registered rules installed to $RULE_DIR/"
         fi
     fi