Building GMT: " mktemp' is dangerous"?

Q&A
1

I build GMT (sudo cmake --build . --target install on Ubuntu 20.04) and I see this message.

Should I worry? Should we make something?

 ....    
[  2%] Linking C shared library libgmt.so
/usr/bin/ld: CMakeFiles/gmtlib.dir/gmt_support.c.o: en la función `gmt_get_tempname':
gmt_support.c:(.text+0xc8f9): aviso: the use of `mktemp' is dangerous, better use `mkstemp' or `mkdtemp'
[ 51%] Built target gmtlib
2

I know about it. I will see if I can switch this section to use mkstemps.

3

Why is the use of mktemp dangerous?

4

It’s for some(?) security reasons. Apparently they can be guessed and an attacker could get in the middle during code execution. For a long time that the Coverity reports pointed the finger to those temporary files creating method.

5

Also mostly for race-condition reasons: Between the time the temp name is created and you create that file, another user could have created the same filename…

6

Thanks.