secure mktemp

packages/cro.nix

@@ -4,7 +4,7 @@ chromium.override {
     "--disable-sync"
     "--no-default-browser-check"
     "--no-first-run"
-    "--user-data-dir=$(${coreutils}/bin/mktemp -d)"
+    "--user-data-dir=$(${coreutils}/bin/mktemp -p $XDG_RUNTIME_DIR -d chromium-XXXXXX)"
     "--incognito"
   ];
 }

packages/fzfmenu.nix

@@ -12,8 +12,8 @@ writers.writeBashBin "fzfmenu" ''
 
   PATH=$PATH:${lib.makeBinPath [st fzf dash]}
 
-  input=$(mktemp -u --suffix .fzfmenu.input)
-  output=$(mktemp -u --suffix .fzfmenu.output)
+  input=$(mktemp -p "$XDG_RUNTIME_DIR" -u --suffix .fzfmenu.input)
+  output=$(mktemp -p "$XDG_RUNTIME_DIR" -u --suffix .fzfmenu.output)
   mkfifo "$input"
   mkfifo "$output"
   chmod 600 "$input" "$output"

packages/qrpaste.nix

@@ -6,7 +6,7 @@
   nsxiv,
 }:
 writers.writeDashBin "qrpaste" ''
-  file="$(${mktemp}/bin/mktemp --tmpdir)"
+  file="$(${mktemp}/bin/mktemp -p "$XDG_RUNTIME_DIR" qrpaste-XXXXXX.png)"
   trap clean EXIT
   clean() {
     rm "$file"