[PATCH] misc: Add mkostempat (BZ 19866)

[Mark Wielaard]

Hi Florian,

On Fri, Jun 26, 2026 at 10:00:12AM +0200, Florian Weimer wrote:
> * Florian Weimer:
> > * Paul Eggert:
> >> In the end it's simpler to have a function with a callback.
> >
> > Splitting probing and name creation has the same problem as tmpnam:
> > creation might not use O_EXCL (either explicitly or implicitly).  It
> > seems to me that a callback-based interface mostly serves to obfuscate
> > the relationship to the deprecated tmpnam function.
> >
> > We can acknowledge that deprecating tmpnam was a mistake and introduce a
> > tmpnamat function.  Not splitting probing and creation introduces a
> > proliferation of interfaces.  I think this would be cleaner than the
> > callback-based approach, and easier to consume from languages such as
> > Python.
> 
> To expand on that a little: the problem with tmpnam is not just the
> possibility of a TOCTOU race if used incorrectly.  The risk is amplified
> by the relatively short uniqueness string (six characters, so 35.7 bits
> of entropy at most) and, historically, a lack of a good entropy source.
> For tmpnamat, we can recommend a uniqueness string of at least 10
> characters (59.5 bits), which will make a TOCTOU race impractical to
> exploit.  We can document which function combinations are safe to use.

Could you expand a bit more? I am not exactly sure I understand what
you are proposing. Are you proposing we switch to a tmpname[at] style
funcion that just provides a unique name and that the user combines
this with their own creation function for whatever they want in given
directory? Would they then use this in some kind of loop till an
O_EXCL using function succeeds? Or would there be some kind of
guarantee that the result of tmpname[at] would be statistically random
enough that any toctou race would be impossible (or if it would happen
it really just counts as a failure to create any temp file)?

Thanks,

Mark