2

I am wondering how to best improve on mktemp for use with encrypted containers or file systems.

The issue that I am dealing with is that I would like my shell scripts to store temporary files inside the file system that contains the working directory, if possible.

The normal behaviour of mktemp seems to be to use a root path specified in an environment variables or /tmp. This will, however, routinely leak temporary data to unencrypted locations if I am working with files inside encrypted containers.

The idea is to first check the presence of a tmp directory in the mount point of the current file system and to use /tmponly as a last resort. How can I reliably (and efficiently) realize that.

Edit

A possible way to identify the mount directory of a given path is the following 

dir=`realpath [path]`; 
res=1; 
while [ $res -ne 0 ]; do 
  dir="${dir%/*}"; 
  mountpoint -q "$dir/"; 
  res=$?; 
done; 
echo "$dir";

I am not sure, however, if that is the most efficient one.

Improve this question
4
  • Why not just encrypt /tmp, or use tmpfs so it stays in ram?
    – psusi
    Jan 5, 2018 at 23:59
  • My tmp is already encrypted, but with a security policy different from the differing policies of the various containers, so it won't help. For the same reason, I would need a different tmpfs for each container.
    – highsciguy
    Jan 6, 2018 at 14:13
  • When you say "container" are you talking about LXC containers? If so, then yes, they absolutely should each have their own /tmp.
    – psusi
    Jan 6, 2018 at 17:17
  • You may think of truecrypt containers or volumes mounted somewhere in a users home directory.
    – highsciguy
    Jan 6, 2018 at 17:34

2 Answers 2

Reset to default
2

You can specify any directory to mktemp; either using the -p option or setting a different TMPDIR.

-p temp-dir, --tmpdir=temp-dir
          temp  directory  for  the  file.  This option is a member of the
          tmpdir class of options.

          If this option is not provided, mktemp will use the  environment
          variable  TMPDIR to find a suitable directory.  If these are not
          available, it will fall back to ~/tmp  or  /tmp.   A  <file-pat>
          command line argument containing a directory component will con-
          flict with this option.

For instance:

#!/bin/bash
TMPDIR=`pwd`
mktemp
Improve this answer
3
  • OK, need to try that. My man page reads a little bit differently. Will it find a tmp directory in a super directory of pwd if there is none in pwd itself?
    – highsciguy
    Jan 6, 2018 at 14:10
  • Try it and see how it behaves.
    – Rui F Ribeiro
    Jan 6, 2018 at 14:27
  • Tried it. On my system, TMPDIR=pwd; export TMPDIR; mktemp will create a temporary file in pwd. This is not the behaviour that I want, since it will create temporary files everywhere. Perhaps that is better than leaking confidential information to directories that are not encrypted. However, I would still prefer to have my temporary files in a central location for each container.
    – highsciguy
    Jan 6, 2018 at 17:57
0

If I don't misunderstand your requirement, you want mktemp /WORKING/DIR/tmp.XXXXXXXXXX or however you want the name to be like (every X is replaced by a random alphanumeric character).

Improve this answer
2
  • No. I want to use tmp dirs which are present. Creating a temporary path in the working directory entails that I mix the temporary files with persistent ones. E.g., a sync job would copy those temporary files unless I modify it. I need to ensure, however, that the temporary files are not created in a different resource.
    – highsciguy
    Apr 13, 2019 at 11:29
  • OK, I misunderstood. I don't see how to improve much on the code you supplied in the question.
    – PePa
    Apr 20, 2019 at 23:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .