2fe8fb192f
There is important information about booting non-ack images in docs/UPDATING. ack/aout-format images can't be built any more, and booting clang/ELF-format ones is a little different. Updating to the new boot monitor is recommended. Changes in this commit: . drop boot monitor -> allowing dropping ack support . facility to copy ELF boot files to /boot so that old boot monitor can still boot fairly easily, see UPDATING . no more ack-format libraries -> single-case libraries . some cleanup of OBJECT_FMT, COMPILER_TYPE, etc cases . drop several ack toolchain commands, but not all support commands (e.g. aal is gone but acksize is not yet). . a few libc files moved to netbsd libc dir . new /bin/date as minix date used code in libc/ . test compile fix . harmonize includes . /usr/lib is no longer special: without ack, /usr/lib plays no kind of special bootstrapping role any more and bootstrapping is done exclusively through packages, so releases depend even less on the state of the machine making them now. . rename nbsd_lib* to lib* . reduce mtree
261 lines
6.4 KiB
Groff
261 lines
6.4 KiB
Groff
.\" $NetBSD: tmpnam.3,v 1.17 2010/04/30 04:55:10 jruoho Exp $
|
|
.\"
|
|
.\" Copyright (c) 1988, 1991, 1993
|
|
.\" The Regents of the University of California. All rights reserved.
|
|
.\"
|
|
.\" This code is derived from software contributed to Berkeley by
|
|
.\" the American National Standards Committee X3, on Information
|
|
.\" Processing Systems.
|
|
.\"
|
|
.\" Redistribution and use in source and binary forms, with or without
|
|
.\" modification, are permitted provided that the following conditions
|
|
.\" are met:
|
|
.\" 1. Redistributions of source code must retain the above copyright
|
|
.\" notice, this list of conditions and the following disclaimer.
|
|
.\" 2. Redistributions in binary form must reproduce the above copyright
|
|
.\" notice, this list of conditions and the following disclaimer in the
|
|
.\" documentation and/or other materials provided with the distribution.
|
|
.\" 3. Neither the name of the University nor the names of its contributors
|
|
.\" may be used to endorse or promote products derived from this software
|
|
.\" without specific prior written permission.
|
|
.\"
|
|
.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
|
|
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
|
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
.\" SUCH DAMAGE.
|
|
.\"
|
|
.\" @(#)tmpnam.3 8.2 (Berkeley) 11/17/93
|
|
.\"
|
|
.Dd April 30, 2010
|
|
.Dt TMPFILE 3
|
|
.Os
|
|
.Sh NAME
|
|
.Nm tempnam ,
|
|
.Nm tmpfile ,
|
|
.Nm tmpnam
|
|
.Nd temporary file routines
|
|
.Sh LIBRARY
|
|
.Lb libc
|
|
.Sh SYNOPSIS
|
|
.In stdio.h
|
|
.Ft FILE *
|
|
.Fn tmpfile void
|
|
.Ft char *
|
|
.Fn tmpnam "char *str"
|
|
.Ft char *
|
|
.Fn tempnam "const char *tmpdir" "const char *prefix"
|
|
.Sh DESCRIPTION
|
|
The
|
|
.Fn tmpfile
|
|
function
|
|
returns a pointer to a stream associated with a file descriptor returned
|
|
by the routine
|
|
.Xr mkstemp 3 .
|
|
The created file is unlinked before
|
|
.Fn tmpfile
|
|
returns, causing the file to be automatically deleted when the last
|
|
reference to it is closed.
|
|
The file is opened with the access value
|
|
.Ql w+ .
|
|
.Pp
|
|
The
|
|
.Fn tmpnam
|
|
function
|
|
returns a pointer to a file name, in the
|
|
.Dv P_tmpdir
|
|
directory, which
|
|
did not reference an existing file at some indeterminate point in the
|
|
past.
|
|
.Dv P_tmpdir
|
|
is defined in the include file
|
|
.In stdio.h .
|
|
If the argument
|
|
.Fa s
|
|
is
|
|
.Pf non- Dv NULL ,
|
|
the file name is copied to the buffer it references.
|
|
Otherwise, the file name is copied to a static buffer.
|
|
In either case,
|
|
.Fn tmpnam
|
|
returns a pointer to the file name.
|
|
.Pp
|
|
The buffer referenced by
|
|
.Fa s
|
|
is expected to be at least
|
|
.Dv L_tmpnam
|
|
bytes in length.
|
|
.Dv L_tmpnam
|
|
is defined in the include file
|
|
.In stdio.h .
|
|
.Pp
|
|
The
|
|
.Fn tempnam
|
|
function
|
|
is similar to
|
|
.Fn tmpnam ,
|
|
but provides the ability to specify the directory which will
|
|
contain the temporary file and the file name prefix.
|
|
.Pp
|
|
The environment variable
|
|
.Ev TMPDIR
|
|
(if set), the argument
|
|
.Fa tmpdir
|
|
(if
|
|
.Pf non- Dv NULL ) ,
|
|
the directory
|
|
.Dv P_tmpdir ,
|
|
and the directory
|
|
.Pa /tmp
|
|
are tried, in the listed order, as directories in which to store the
|
|
temporary file.
|
|
.Pp
|
|
The argument
|
|
.Fa prefix ,
|
|
if
|
|
.Pf non- Dv NULL ,
|
|
is used to specify a file name prefix, which will be the
|
|
first part of the created file name.
|
|
.Fn tempnam
|
|
allocates memory in which to store the file name; the returned pointer
|
|
may be used as a subsequent argument to
|
|
.Xr free 3 .
|
|
.Sh RETURN VALUES
|
|
The
|
|
.Fn tmpfile
|
|
function
|
|
returns a pointer to an open file stream on success, and a
|
|
.Dv NULL
|
|
pointer
|
|
on error.
|
|
.Pp
|
|
The
|
|
.Fn tmpnam
|
|
and
|
|
.Fn tempnam
|
|
functions
|
|
return a pointer to a file name on success, and a
|
|
.Dv NULL
|
|
pointer
|
|
on error.
|
|
.Sh ERRORS
|
|
The
|
|
.Fn tmpfile
|
|
function
|
|
may fail and set the global variable
|
|
.Va errno
|
|
for any of the errors specified for the library functions
|
|
.Xr fdopen 3
|
|
or
|
|
.Xr mkstemp 3 .
|
|
.Pp
|
|
The
|
|
.Fn tmpnam
|
|
function
|
|
may fail and set
|
|
.Va errno
|
|
for any of the errors specified for the library function
|
|
.Xr mktemp 3 .
|
|
.Pp
|
|
The
|
|
.Fn tempnam
|
|
function
|
|
may fail and set
|
|
.Va errno
|
|
for any of the errors specified for the library functions
|
|
.Xr malloc 3
|
|
or
|
|
.Xr mktemp 3 .
|
|
.Sh SEE ALSO
|
|
.Xr mkstemp 3 ,
|
|
.Xr mktemp 3
|
|
.Sh STANDARDS
|
|
The
|
|
.Fn tmpfile
|
|
and
|
|
.Fn tmpnam
|
|
functions
|
|
conform to
|
|
.St -ansiC .
|
|
All described functions also conform to
|
|
.St -p1003.1-2001 ,
|
|
albeit the
|
|
.Fn tempnam
|
|
and
|
|
.Fn tmpnam
|
|
functions have been marked as obsolete in the
|
|
.St -p1003.1-2008
|
|
revision.
|
|
.Sh BUGS
|
|
These interfaces are provided for
|
|
.At V
|
|
and
|
|
.Tn ANSI
|
|
compatibility only.
|
|
The
|
|
.Xr mkstemp 3
|
|
interface is strongly preferred.
|
|
.Sh SECURITY CONSIDERATIONS
|
|
There are four important problems with these interfaces (as well as
|
|
with the historic
|
|
.Xr mktemp 3
|
|
interface).
|
|
First, there is an obvious race between file name selection and file
|
|
creation and deletion: the program is typically written to call
|
|
.Fn tmpnam ,
|
|
.Fn tempnam ,
|
|
or
|
|
.Xr mktemp 3 .
|
|
Subsequently, the program calls
|
|
.Xr open 2
|
|
or
|
|
.Xr fopen 3
|
|
and erroneously opens a file (or symbolic link, or fifo or other
|
|
device) that the attacker has placed in the expected file location.
|
|
Hence
|
|
.Xr mkstemp 3
|
|
is recommended, since it atomically creates the file.
|
|
.Pp
|
|
Second, most historic implementations provide only a limited number
|
|
of possible temporary file names (usually 26) before file names will
|
|
start being recycled.
|
|
Third, the
|
|
.At V
|
|
implementations of these functions (and of
|
|
.Xr mktemp 3 )
|
|
use the
|
|
.Xr access 2
|
|
system call to determine whether or not the temporary file may be created.
|
|
This has obvious ramifications for setuid or setgid programs, complicating
|
|
the portable use of these interfaces in such programs.
|
|
Finally, there is no specification of the permissions with which the
|
|
temporary files are created.
|
|
.Pp
|
|
This implementation of
|
|
.Fn tmpfile
|
|
does not have these flaws,
|
|
and that of
|
|
.Fn tmpnam
|
|
and
|
|
.Fn tempnam
|
|
only have the first limitation, but portable software
|
|
cannot depend on that.
|
|
In particular, the
|
|
.Fn tmpfile
|
|
interface should not be used in software expected to be used on other systems
|
|
if there is any possibility that the user does not wish the temporary file to
|
|
be publicly readable and writable.
|
|
.Pp
|
|
A link-time warning will be issued if
|
|
.Fn tmpnam
|
|
or
|
|
.Fn tempnam
|
|
is used, and advises the use of
|
|
.Fn mkstemp
|
|
instead.
|