Temporary files whose lifetime doesn't exceed that of the program that creates them, and in particular aren't supposed to survive a reboot, go into /tmp
. Or rather, the convention is to use the directory indicated by the environment variable TMPDIR
, and fall back to /tmp
if it isn't set.
You can execute files in /tmp
. While a system administrator could mount it without executable permissions, this would be a hardening configuration for a system that only runs specific applications: it is to be expected that preventing execution under /tmp
would break some applications, and it typically wouldn't improve security anyway.
Keep in mind that this directory is often shared between users, so you need to be careful when creating files there not to accidentally start using an existing file owned by another user. Use the mktemp
utility or the mkstemp
function, or better, create a private temporary directory with mktemp
or mkdtemp
and work in that directory.
/run
or /var/run
are not appropriate because you may not have the permission to create files there (in fact, you will not have the permission to create files there unless granted by the system administrator). They're for system use, not for applications.
/var/lib
seems to be one place - that's where dpkg keeps all the maintainer scripts./var/run
should be unwritable for unprivileged users (root or users running daemons); it is a major security problem if any user can write in this directory.". I would go for/tmp
or/var/tmp
according to persistence needs.