I am wondering how to best improve on mktemp for use with encrypted containers or file systems.

The issue that I am dealing with is that I would like my shell scripts to store temporary files inside the file system that contains the working directory, if possible.

The normal behaviour of mktemp seems to be to use a root path specified in an environment variables or /tmp. This will, however, routinely leak temporary data to unencrypted locations if I am working with files inside encrypted containers.

The idea is to first check the presence of a tmp directory in the mount point of the current file system and to use /tmponly as a last resort. How can I reliably (and efficiently) realize that.


A possible way to identify the mount directory of a given path is the following

dir=`realpath [path]`; 
while [ $res -ne 0 ]; do 
  mountpoint -q "$dir/"; 
echo "$dir";

I am not sure, however, if that is the most efficient one.

  • Why not just encrypt /tmp, or use tmpfs so it stays in ram? – psusi Jan 5 '18 at 23:59
  • My tmp is already encrypted, but with a security policy different from the differing policies of the various containers, so it won't help. For the same reason, I would need a different tmpfs for each container. – highsciguy Jan 6 '18 at 14:13
  • When you say "container" are you talking about LXC containers? If so, then yes, they absolutely should each have their own /tmp. – psusi Jan 6 '18 at 17:17
  • You may think of truecrypt containers or volumes mounted somewhere in a users home directory. – highsciguy Jan 6 '18 at 17:34

You can specify any directory to mktemp; either using the -p option or setting a different TMPDIR.

-p temp-dir, --tmpdir=temp-dir
          temp  directory  for  the  file.  This option is a member of the
          tmpdir class of options.

          If this option is not provided, mktemp will use the  environment
          variable  TMPDIR to find a suitable directory.  If these are not
          available, it will fall back to ~/tmp  or  /tmp.   A  <file-pat>
          command line argument containing a directory component will con-
          flict with this option.

For instance:

| improve this answer | |
  • OK, need to try that. My man page reads a little bit differently. Will it find a tmp directory in a super directory of pwd if there is none in pwd itself? – highsciguy Jan 6 '18 at 14:10
  • Try it and see how it behaves. – Rui F Ribeiro Jan 6 '18 at 14:27
  • Tried it. On my system, TMPDIR=pwd; export TMPDIR; mktemp will create a temporary file in pwd. This is not the behaviour that I want, since it will create temporary files everywhere. Perhaps that is better than leaking confidential information to directories that are not encrypted. However, I would still prefer to have my temporary files in a central location for each container. – highsciguy Jan 6 '18 at 17:57

If I don't misunderstand your requirement, you want mktemp /WORKING/DIR/tmp.XXXXXXXXXX or however you want the name to be like (every X is replaced by a random alphanumeric character).

| improve this answer | |
  • No. I want to use tmp dirs which are present. Creating a temporary path in the working directory entails that I mix the temporary files with persistent ones. E.g., a sync job would copy those temporary files unless I modify it. I need to ensure, however, that the temporary files are not created in a different resource. – highsciguy Apr 13 '19 at 11:29
  • OK, I misunderstood. I don't see how to improve much on the code you supplied in the question. – PePa Apr 20 '19 at 23:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.