From 91c51689c928725e5e2dd3391711a2a6b27dc8fc Mon Sep 17 00:00:00 2001
From: rcourtman <courtmanr@gmail.com>
Date: Fri, 21 Nov 2025 23:00:47 +0000
Subject: [PATCH] Guard host-agent installs on noexec filesystems (Related to
 #718)

---
 frontend-modern/public/install-host-agent.sh | 33 ++++++++++++++++++++
 scripts/install-host-agent.sh                | 33 ++++++++++++++++++++
 2 files changed, 66 insertions(+)

diff --git a/frontend-modern/public/install-host-agent.sh b/frontend-modern/public/install-host-agent.sh
index 75cfbbb..05212d3 100755
--- a/frontend-modern/public/install-host-agent.sh
+++ b/frontend-modern/public/install-host-agent.sh
@@ -453,6 +453,7 @@ if command -v selinuxenabled &> /dev/null && selinuxenabled 2>/dev/null; then
 fi
 
 log_success "Agent binary installed to $AGENT_PATH"
+validate_agent_binary_executable "$AGENT_PATH"
 
 # Build reusable agent command strings
 AGENT_CMD="$AGENT_PATH --url $PULSE_URL"
@@ -466,6 +467,38 @@ fi
 MANUAL_START_CMD="$AGENT_CMD"
 MANUAL_START_WRAPPED="nohup $MANUAL_START_CMD >$LINUX_LOG_FILE 2>&1 &"
 
+validate_agent_binary_executable() {
+    local path="$1"
+    local mount_opts=""
+
+    if command -v findmnt >/dev/null 2>&1; then
+        mount_opts=$(findmnt -no OPTIONS --target "$path" 2>/dev/null || true)
+        if echo "$mount_opts" | grep -Eq '(^|,)noexec(,|$)'; then
+            log_error "Install target $path is on a filesystem mounted noexec (options: $mount_opts)"
+            echo ""
+            log_info "Enable exec on that dataset or choose an exec-capable path, then rerun the installer."
+            exit 1
+        fi
+    fi
+
+    if command -v file >/dev/null 2>&1; then
+        local file_type=""
+        file_type=$(file -b "$path" 2>/dev/null || true)
+        if [[ -n "$file_type" ]] && ! echo "$file_type" | grep -qiE 'ELF|Mach-O|PE32'; then
+            log_error "Downloaded file at $path is not a recognizable executable (detected: $file_type)"
+            exit 1
+        fi
+    fi
+
+    if ! "$path" --version >/dev/null 2>&1; then
+        log_error "Installed agent at $path failed to execute; check for noexec mounts or download issues."
+        if [[ -n "$mount_opts" ]]; then
+            log_info "Filesystem options: $mount_opts"
+        fi
+        exit 1
+    fi
+}
+
 write_truenas_env_file() {
     sudo install -d -m 0700 "$TRUENAS_STATE_DIR" "$TRUENAS_LOG_DIR"
     local tmp_env
diff --git a/scripts/install-host-agent.sh b/scripts/install-host-agent.sh
index 75cfbbb..05212d3 100755
--- a/scripts/install-host-agent.sh
+++ b/scripts/install-host-agent.sh
@@ -453,6 +453,7 @@ if command -v selinuxenabled &> /dev/null && selinuxenabled 2>/dev/null; then
 fi
 
 log_success "Agent binary installed to $AGENT_PATH"
+validate_agent_binary_executable "$AGENT_PATH"
 
 # Build reusable agent command strings
 AGENT_CMD="$AGENT_PATH --url $PULSE_URL"
@@ -466,6 +467,38 @@ fi
 MANUAL_START_CMD="$AGENT_CMD"
 MANUAL_START_WRAPPED="nohup $MANUAL_START_CMD >$LINUX_LOG_FILE 2>&1 &"
 
+validate_agent_binary_executable() {
+    local path="$1"
+    local mount_opts=""
+
+    if command -v findmnt >/dev/null 2>&1; then
+        mount_opts=$(findmnt -no OPTIONS --target "$path" 2>/dev/null || true)
+        if echo "$mount_opts" | grep -Eq '(^|,)noexec(,|$)'; then
+            log_error "Install target $path is on a filesystem mounted noexec (options: $mount_opts)"
+            echo ""
+            log_info "Enable exec on that dataset or choose an exec-capable path, then rerun the installer."
+            exit 1
+        fi
+    fi
+
+    if command -v file >/dev/null 2>&1; then
+        local file_type=""
+        file_type=$(file -b "$path" 2>/dev/null || true)
+        if [[ -n "$file_type" ]] && ! echo "$file_type" | grep -qiE 'ELF|Mach-O|PE32'; then
+            log_error "Downloaded file at $path is not a recognizable executable (detected: $file_type)"
+            exit 1
+        fi
+    fi
+
+    if ! "$path" --version >/dev/null 2>&1; then
+        log_error "Installed agent at $path failed to execute; check for noexec mounts or download issues."
+        if [[ -n "$mount_opts" ]]; then
+            log_info "Filesystem options: $mount_opts"
+        fi
+        exit 1
+    fi
+}
+
 write_truenas_env_file() {
     sudo install -d -m 0700 "$TRUENAS_STATE_DIR" "$TRUENAS_LOG_DIR"
     local tmp_env