NAME
mktemp, mkstemp,
mkstemps, mkdtemp —
make temporary file name
(unique)
SYNOPSIS
#include
<stdlib.h>
char *
mktemp(char
*template);
int
mkstemp(char
*template);
int
mkstemps(char
*template, int
suffixlen);
char *
mkdtemp(char
*template);
DESCRIPTION
The
mktemp()
family of functions take the given file name template and overwrite a
portion of it to create a new file name. This file name is unique and
suitable for use by the application. The template may be any file name with
at least six trailing Xs, for example
/tmp/temp.XXXXXXXX. The trailing Xs are replaced
with a unique digit and letter combination. The number of unique file names
that can be returned depends on the number of Xs provided;
mktemp() will try at least 2 ** 31 combinations
before giving up. At least six Xs must be used, though 10 is much
better.
The
mktemp()
function generates a temporary file name based on a template as described
above. Because mktemp() does not actually create the
temporary file there is a window of opportunity during which another process
can open the file instead. Because of this race condition,
mktemp() should not be used where
mkstemp() can be used instead.
mktemp() was marked as a legacy interface in
IEEE Std 1003.1-2001 (“POSIX.1”).
The
mkstemp()
function makes the same replacement to the template and creates the template
file, mode 0600, returning a file descriptor opened for reading and writing.
This avoids the race between testing for a file's existence and opening it
for use.
The
mkstemps()
function acts the same as mkstemp(), except it
permits a suffix to exist in the template. The template should be of the
form /tmp/tmpXXXXXXXXXXsuffix.
mkstemps() is told the length of the suffix string,
i.e., strlen("suffix").
The
mkdtemp()
function makes the same replacement to the template as in
mktemp() and creates the template directory, mode
0700.
RETURN VALUES
The mktemp() and
mkdtemp() functions return a pointer to the template
on success and NULL on failure. The
mkstemp() and mkstemps()
functions return -1 if no suitable file could be created. If any call fails,
an error code is placed in the global variable
errno.
EXAMPLES
Quite often a programmer will want to replace a use of
mktemp() with mkstemp(),
usually to avoid the problems described above. Doing this correctly requires
a good understanding of the code in question.
For instance, code of this form:
char sfn[19];
FILE *sfp;
strlcpy(sfn, "/tmp/ed.XXXXXXXXXX", sizeof(sfn));
if (mktemp(sfn) == NULL || (sfp = fopen(sfn, "w+")) == NULL) {
warn("%s", sfn);
return (NULL);
}
return (sfp);
should be rewritten like this:
char sfn[19];
FILE *sfp;
int fd;
strlcpy(sfn, "/tmp/ed.XXXXXXXXXX", sizeof(sfn));
if ((fd = mkstemp(sfn)) == -1 ||
(sfp = fdopen(fd, "w+")) == NULL) {
if (fd != -1) {
unlink(sfn);
close(fd);
}
warn("%s", sfn);
return (NULL);
}
return (sfp);
Often one will find code which uses
mktemp() very early on, perhaps to globally
initialize the template nicely, but the code which calls
open(2) or
fopen(3) on that file name will occur much later. (In almost all
cases, the use of
fopen(3) will mean that the flags O_CREAT |
O_EXCL are not given to
open(2), and thus a symbolic link race becomes possible, hence making
necessary the use of
fdopen(3) as seen above.) Furthermore, one must be careful about code
which opens, closes, and then re-opens the file in question. Finally, one
must ensure that upon error the temporary file is removed correctly.
There are also cases where modifying the code to use
mktemp(), in concert with
open(2) using the flags O_CREAT |
O_EXCL, is better, as long as the code retries a new
template if open(2) fails with an errno of
EEXIST.
ERRORS
The mktemp(),
mkstemp(), and mkdtemp()
functions may set errno to one of the following
values:
- [
EINVAL] - The template argument has fewer than six trailing Xs.
- [
EEXIST] - All file names tried are already in use. Consider appending more Xs to the template.
The mktemp() function may also set
errno to any value specified by the
lstat(2) function.
The mkstemp() function may also set
errno to any value specified by the
open(2) function.
The mkstemps() function may also set
errno to any value specified by the
open(2) function or,
- [
EINVAL] - The template argument length is less than suffixlen or it has fewer than six Xs before the suffix.
The mkdtemp() function may also set
errno to any value specified by the
mkdir(2) function.
SEE ALSO
chmod(2), lstat(2), mkdir(2), open(2), tempnam(3), tmpfile(3), tmpnam(3)
STANDARDS
The mkdtemp() and
mkstemp() functions conform to the
IEEE Std 1003.1-2008 (“POSIX.1”)
specification. The ability to specify more than six Xs is an extension to
that standard.
The mktemp() function conforms to
IEEE Std 1003.1-2001 (“POSIX.1”); as
of IEEE Std 1003.1-2008 (“POSIX.1”) it
is no longer a part of the standard.
The mkstemps() function is non-standard
and should not be used if portability is required.
HISTORY
A mktemp() function appeared in
Version 7 AT&T UNIX. The
mkdtemp() function appeared in
OpenBSD 2.2. The mkstemp()
function appeared in 4.4BSD. The
mkstemps() function appeared in
OpenBSD 2.3.
BUGS
For mktemp() there is an obvious race
between file name selection and file creation and deletion: the program is
typically written to call
tmpnam(3),
tempnam(3), or mktemp(). Subsequently, the
program calls open(2) or
fopen(3) and erroneously opens a file (or symbolic link, FIFO or
other device) that the attacker has created in the expected file location.
Hence mkstemp() is recommended, since it atomically
creates the file. An attacker can guess the file names produced by
mktemp(). Whenever it is possible,
mkstemp() or mkdtemp()
should be used instead.
For this reason,
ld(1)
will output a warning message whenever it links code that uses
mktemp().