Temp File Race Conditions

### The shape of the bug `tempfile.mktemp` returns a *name*: it composes the temp directory with a random component, confirms nothing is at that path right now, and gives you the string. `tempfile.mkstemp` returns a *file*: an integer file descriptor for a file it has already created, plus the absolute path it created it at. That difference is the whole security story, and it has a standard name — TOCTOU, time-of-check to time-of-use. `mktemp` checks at time T. You open at time T+d. The operating system is free to run any other process in between, and on a loaded machine d can be milliseconds or seconds. An attacker who can write to the temp directory only has to win that gap once, and they can retry as often as they like because your job runs on a schedule. The exploit is not subtle: ```python # UNSAFE - do not ship this import tempfile path = tempfile.mktemp(suffix=".csv") # a name, nothing exists yet # ... attacker creates a symlink at `path` here ... with open(path, "w") as f: # follows the symlink, truncates the target f.write("id,amount\n") ``` If the attacker points `path` at a file your process is permitted to write — a config file, a cron fragment, a state file another service trusts — your process destroys and rewrites it on their behalf. Privilege escalation through a temp file is a borrowed-privilege attack: they never needed access, they needed *you* to have it. A gentler but still real variant needs no attacker at all. Consider an export job whose workers each stage a warehouse extract under a name derived from the wall clock. Clock skew between workers means two hosts can produce the same second, both call `mktemp`, both see the path free, and both open it — one truncating the other's half-written extract, so the file that lands in the warehouse is a clean-looking blend of two runs. That is the same race with a scheduler rather than an adversary driving it. ### Why O_EXCL is a different kind of promise `tempfile.mkstemp` builds a name the same way, but then calls roughly: ```python fd = os.open(path, os.O_CREAT | os.O_EXCL | os.O_RDWR, 0o600) ``` `O_CREAT` says create it if absent. `O_EXCL` says fail if it is present. Together they are a single system call, and the kernel performs the test and the creation without any other process being able to interleave. There is no interval between check and use, because there is no separate check. Three consequences follow. The call fails with `FileExistsError` if anything is already there — and critically, `O_EXCL` treats an existing *symlink* as existing, even a dangling one, so the classic attack turns into an error instead of a hijack. The module catches that error and retries with a fresh name, up to a bounded number of attempts. And the mode `0o600` is requested at creation, so the file is never briefly world-readable. `mkstemp` returns `(fd, path)` — an integer descriptor, not a file object — precisely because the descriptor is the guarantee. Wrap it with `os.fdopen(fd, "w")` to get buffered writes without ever going back through the path. ### What does *not* fix it - **A longer random suffix.** Unpredictability makes the attacker guess; it does not remove the window. Against an attacker who can watch the directory — with an inotify-style watch, or just a tight polling loop — the name is known the instant it appears. - **Checking first.** `if not os.path.exists(path): open(path, "w")` is the race written out longhand. - **The sticky bit.** It stops other users deleting your files; it does not stop them creating names. - **Deleting afterwards.** Cleanup is hygiene, not a control. ### The remaining caveats worth knowing `O_EXCL` is a kernel guarantee about a local filesystem. On old NFS versions it was documented as unreliable, which is one more reason not to place security-sensitive staging files on a shared network mount. And the guarantee covers *creation only*: once you close the descriptor and go back to the path, you are back in the shared namespace. If you need many temp files, `tempfile.mkdtemp` gives you a directory with mode `0o700`, and inside a directory nobody else may enter, plain names are safe again. `tempfile.mktemp` still exists in Python 3.14 and still works, which is why it still shows up in code review. Treat every appearance as a finding.