[PATCH] misc: Add mkostempat (BZ 19866)

[Florian Weimer]

* Florian Weimer:

> * Paul Eggert:
>
>> On 2026-06-25 14:59, Mark Wielaard wrote:
>>> If not, can we have a simple mkstempat one that just adds the dirfd
>>> argument, but doesn't try to fix any other issue?
>>
>> We could, but there is always one more feature that people want. For
>> example, if/when Linux adds O_CREAT|O_DIRECTORY support to openat2, or
>> a mkdirat2 API (or whatever), we'll need yet another function to make
>> this new kernel facility available in the mkdtemp family.
>>
>> In the end it's simpler to have a function with a callback.
>
> Splitting probing and name creation has the same problem as tmpnam:
> creation might not use O_EXCL (either explicitly or implicitly).  It
> seems to me that a callback-based interface mostly serves to obfuscate
> the relationship to the deprecated tmpnam function.
>
> We can acknowledge that deprecating tmpnam was a mistake and introduce a
> tmpnamat function.  Not splitting probing and creation introduces a
> proliferation of interfaces.  I think this would be cleaner than the
> callback-based approach, and easier to consume from languages such as
> Python.

To expand on that a little: the problem with tmpnam is not just the
possibility of a TOCTOU race if used incorrectly.  The risk is amplified
by the relatively short uniqueness string (six characters, so 35.7 bits
of entropy at most) and, historically, a lack of a good entropy source.
For tmpnamat, we can recommend a uniqueness string of at least 10
characters (59.5 bits), which will make a TOCTOU race impractical to
exploit.  We can document which function combinations are safe to use.

Thanks,
Florian