If you need a temporary file in your script to store data for the script's run, it can be tempting to assume a fixed path for the file in /tmp:
# Store the current date for later
# Requires GNU/BSD `date` with non-POSIX %s format
date +%s > /tmp/myscript-timestamp
/tmp exists on virtually all Unix systems, which makes it a popular choice. However, this approach has some risks:
- There may be a safer or more suitable location for temporary files specified by the system, or preferred by the user, such as /var/tmp. The /tmp directory might be very strictly locked down in some environments, especially PCI-DSS-compliant systems.
- If the temporary filename name is not unique, and more than one instance of the script runs at once, the behavior can be unpredictable and hard to debug.
- Because /tmp is world-writable, if an attacker can write to and predict...
