/tmp can be hardened to noexec, /run is also sometimes noexeced. However, we don't need a varying askpass, so just do one in a libexec directory. o
Jarrod Johnson