Create a Private Temporary File with Debian's tempfile

You will create a temporary file with mode 0600, capture the pathname safely in a shell variable, use it, and remove it when the script exits. Allow about 10 minutes to try the examples. The command is from Debianutils 5.17 on this machine, and it is deprecated: use mktemp for new scripts unless you must support an older script that already calls tempfile.

Before you start

• Run the examples as an ordinary user. Nothing here requires sudo.
• Use a writable test directory such as /tmp. Do not put private temporary data in a shared directory with a less restrictive mode.
• Have a shell that supports command substitution and trap, such as sh or bash.

1. Create the file and inspect it

Run tempfile without options. It chooses an appropriate temporary directory, creates the file exclusively, opens it for reading and writing, and prints the resulting pathname to standard output.

$ path=$(tempfile)
$ status=$?
$ printf 'status=%s path=%s\n' "$status" "$path"
status=0 path=/tmp/fileXXXXXX
$ stat -c 'mode=%a owner=%U path=%n' -- "$path"
mode=600 owner=YOUR-USER path=/tmp/fileXXXXXX

The final name contains random characters, so your output will differ. The command also writes a deprecation warning to standard error on this Debianutils version. That warning does not become part of path, because command substitution captures standard output only.

The default mode is 0600: the owner can read and write the file, while group and other users have no permissions. Check the exit status before using the variable. If creation fails, path may be empty or stale in a longer-running script.

2. Use a trap so cleanup happens on exit

A temporary file is useful only if its lifetime is clear. This small script creates one, writes a line, reads it back, and removes it when the shell exits. The -- before the pathname prevents a pathname beginning with a hyphen being parsed as an option by rm.

#!/bin/sh
path=$(tempfile) || exit 1
trap 'rm -f -- "$path"' EXIT

printf '%s\n' 'temporary data' > "$path"
cat -- "$path"

# The EXIT trap removes the file here.

Expected output is:

temporary data

Do not quote the whole command substitution, such as path="$(tempfile)", as a substitute for checking its status. Quoting is fine, but the failure check is what stops a script from operating on an empty or previous value. Also avoid putting untrusted text directly inside a trap string. For a more complex script, use a cleanup function and arrange its arguments carefully.

3. Choose the directory, prefix and suffix

Use -d when the temporary file must live in a particular writable directory. Use -p for up to five prefix letters and -s for a suffix such as .part.

$ path=$(tempfile --directory=/tmp --prefix=job --suffix=.part) || exit 1
$ printf '%s\n' "$path"
/tmp/jobXXXXXX.part
$ stat -c 'mode=%a path=%n' -- "$path"
mode=600 path=/tmp/jobXXXXXX.part

The displayed random portion is illustrative. The prefix is limited to five letters by the command's documented interface, so a longer value is not a reliable way to encode metadata. Put any meaningful identifier in your own variable or in the file contents instead.

TMPDIR is a confusing default. If it names an appropriate directory, it takes precedence over -d according to this manpage. Check it when a file appears somewhere unexpected:

$ printf 'TMPDIR=%s\n' "${TMPDIR-}"
$ path=$(tempfile --directory=/tmp)
$ printf '%s\n' "$path"
/tmp/fileXXXXXX

For a repeatable script, set TMPDIR deliberately or unset it after checking the environment. Do not trust a directory merely because it is named /tmp; verify that it is writable and has the isolation your data needs.

4. Change the mode only when you mean to

The -m option changes the mode used when the file is opened. For example, this permits the file's group and other users to read it:

$ path=$(tempfile --mode=0644) || exit 1
$ stat -c '%a %n' -- "$path"
644 /tmp/fileXXXXXX

This is a security-sensitive choice. Anyone who can read the directory entry and file can read data written there, subject to the directory permissions and the system's umask behaviour. Keep the default 0600 for credentials, tokens, private input and intermediate results. No elevated privilege is required to select a mode, and adding sudo can make ownership and cleanup less predictable.

5. Use an exact name only for a controlled compatibility case

--name=FILE bypasses generated naming. When it is supplied, -d, -p and -s are ignored. The file is still opened with exclusive creation flags, so an existing path causes an error rather than silently replacing that file.

$ path=/tmp/my-controlled-input
$ tempfile --name="$path"
WARNING: tempfile is deprecated; consider using mktemp instead.
/tmp/my-controlled-input
$ stat -c 'mode=%a path=%n' -- "$path"
mode=600 path=/tmp/my-controlled-input

Treat an exact name as a collision-prone interface. Do not derive it from untrusted input, and do not assume a successful-looking pathname means an old file was replaced. If the path already exists, choose another name or stop and investigate. This is one reason generated names are preferable.

6. Handle failures and the NFS boundary

Any non-zero exit status means the file was not created successfully. Common causes include a missing directory, a directory without write permission, an invalid mode, or a collision with --name. Capture and check the status immediately:

path=$(tempfile --directory=/path/to/your/writable-directory)
if [ "$?" -ne 0 ]; then
    printf '%s\n' 'could not create temporary file' >&2
    exit 1
fi
trap 'rm -f -- "$path"' EXIT

Replace /path/to/your/writable-directory with a real directory before running that example. If you need to diagnose a failure, run tempfile --help or tempfile --version; both exit successfully and print to standard output, although this installed version also emits the deprecation warning.

The manpage warns that exclusive creation is not guaranteed on NFS partitions. Do not use tempfile as a coordination primitive when the selected directory is on NFS. Prefer a local filesystem, or redesign the workflow so correctness does not depend on two processes never choosing the same name. tempfile creates files only; it cannot create a temporary directory.