A Debian bug report [1] noted that pmake (and mk-files in Fedora) contained the files /usr/share/mk/bsd.{lib,prog}.mk that created temporary files insecurely with predictable file names in /tmp (/tmp/depend[PID]), ignoring any $TMPDIR values.

In lib.mk:

446 afterdepend: .depend 447 @(TMP=/tmp/depend$$$$; \ 448 sed -e 's/^\([^\.]\).o[ ]:/\1.o \1.po \1.so \1.ln:/' \ 449 < .depend > $$TMP; \ 450 mv $$TMP .depend) 451 .endif

The same is found in prog.mk (in Fedora's mk-files package).

The Debian bug report proposes to use mktemp here:

- @(TMP=/tmp/depend$$$$; \ + @(TMP=mktemp -t dependXXXXXXXXXX || exit $$?; \

Upstream has already corrected this by removing the offending code [2],[3].

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=626673 [2] http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.lib.mk.diff?r1=1.239&r2=1.240 [3] http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.prog.mk.diff?r1=1.192&r2=1.193