MKTEMP(3) OpenBSD Programmer's Manual MKTEMP(3)NAME
mktemp, mkstemp, mkstemps, mkdtemp - make temporary file name (unique)
SYNOPSIS
#include <stdlib.h>
char *
mktemp(char *template);
int
mkstemp(char *template);
int
mkstemps(char *template, int suffixlen);
char *
mkdtemp(char *template);
DESCRIPTION
The mktemp() family of functions take the given file name template and
overwrite a portion of it to create a new file name. This file name is
unique and suitable for use by the application. The template may be any
file name with some number of Xs appended to it, for example
/tmp/temp.XXXXXX. The trailing Xs are replaced with a unique digit and
letter combination. The number of unique file names that can be returned
depends on the number of Xs provided; six Xs will result in mktemp()
testing roughly 62 ** 6 combinations. At least 6 Xs should be used,
though 10 is much better. Some non-BSD implementations return an error
if fewer than 6 Xs are used.
The mktemp() function generates a temporary file name based on a template
as described above. Because mktemp() does not actually create the
temporary file there is a window of opportunity during which another
process can open the file instead. Because of this race condition,
mktemp() should not be used where mkstemp() can be used instead.
mktemp() was marked as a legacy interface in IEEE Std 1003.1-2001
(``POSIX'').
The mkstemp() function makes the same replacement to the template and
creates the template file, mode 0600, returning a file descriptor opened
for reading and writing. This avoids the race between testing for a
file's existence and opening it for use.
The mkstemps() function acts the same as mkstemp(), except it permits a
suffix to exist in the template. The template should be of the form
/tmp/tmpXXXXXXXXXXsuffix. mkstemps() is told the length of the suffix
string, i.e., strlen("suffix").
The mkdtemp() function makes the same replacement to the template as in
mktemp() and creates the template directory, mode 0700.
RETURN VALUES
The mktemp() and mkdtemp() functions return a pointer to the template on
success and NULL on failure. The mkstemp() and mkstemps() functions
return -1 if no suitable file could be created. If any call fails, an
error code is placed in the global variable errno.
EXAMPLES
Quite often a programmer will want to replace a use of mktemp() with
mkstemp(), usually to avoid the problems described above. Doing this
correctly requires a good understanding of the code in question.
For instance, code of this form:
char sfn[19];
FILE *sfp;
strlcpy(sfn, "/tmp/ed.XXXXXXXXXX", sizeof(sfn));
if (mktemp(sfn) == NULL || (sfp = fopen(sfn, "w+")) == NULL) {
warn("%s", sfn);
return (NULL);
}
return (sfp);
should be rewritten like this:
char sfn[19];
FILE *sfp;
int fd;
strlcpy(sfn, "/tmp/ed.XXXXXXXXXX", sizeof(sfn));
if ((fd = mkstemp(sfn)) == -1 ||
(sfp = fdopen(fd, "w+")) == NULL) {
if (fd != -1) {
unlink(sfn);
close(fd);
}
warn("%s", sfn);
return (NULL);
}
return (sfp);
Often one will find code which uses mktemp() very early on, perhaps to
globally initialize the template nicely, but the code which calls open(2)
or fopen(3) on that file name will occur much later. (In almost all
cases, the use of fopen(3) will mean that the flags O_CREAT | O_EXCL are
not given to open(2), and thus a symbolic link race becomes possible,
hence making necessary the use of fdopen(3) as seen above.) Furthermore,
one must be careful about code which opens, closes, and then re-opens the
file in question. Finally, one must ensure that upon error the temporary
file is removed correctly.
There are also cases where modifying the code to use mktemp(), in concert
with open(2) using the flags O_CREAT | O_EXCL, is better, as long as the
code retries a new template if open(2) fails with an errno of EEXIST.
ERRORS
These functions may set errno to one of the following values:
[EINVAL] The template argument is an empty string.
[EEXIST] All file names tried are already in use. Consider
appending more Xs to the template.
The mktemp() function may also set errno to any value specified by the
lstat(2) function.
The mkstemp() function may also set errno to any value specified by the
open(2) function.
The mkstemps() function may also set errno to any value specified by the
open(2) function or,
[EINVAL] The suffix length is longer than the template length.
The mkdtemp() function may also set errno to any value specified by the
mkdir(2) function.
SEE ALSOchmod(2), lstat(2), mkdir(2), open(2), tempnam(3), tmpfile(3), tmpnam(3)STANDARDS
The mkdtemp() and mkstemp() functions conform to the IEEE Std 1003.1-2008
(``POSIX'') specification. The ability to specify more than six Xs and
setting errno(2) in case of errors are extensions to that standard.
The mkstemps() function is non-standard and should not be used if
portability is required.
HISTORY
A mktemp() function appeared in Version 7 AT&T UNIX. The mkdtemp()
function appeared in OpenBSD 2.2. The mkstemp() function appeared in
4.4BSD. The mkstemps() function appeared in OpenBSD 2.3.
BUGS
For mktemp() there is an obvious race between file name selection and
file creation and deletion: the program is typically written to call
tmpnam(3), tempnam(3), or mktemp(). Subsequently, the program calls
open(2) or fopen(3) and erroneously opens a file (or symbolic link, FIFO
or other device) that the attacker has created in the expected file
location. Hence mkstemp() is recommended, since it atomically creates
the file. An attacker can guess the file names produced by mktemp().
Whenever it is possible, mkstemp() or mkdtemp() should be used instead.
For this reason, ld(1) will output a warning message whenever it links
code that uses mktemp().
OpenBSD 4.9 January 10, 2011 OpenBSD 4.9