/tmp

temporary files

/tmp is shared scratch space. Programs put files here that they need for a moment — a download half-finished, an archive being unpacked. Every user can write to it, and the system is free to empty it.

Use it freely. Do not expect to find it again.

Holds

Temporary files

From any user or program

On disk

Depends

In memory on some distributions

Who writes

Everyone

Mode 1777, with the sticky bit

Cleared

Automatically

At boot, or after some days

Why it exists

Every directory at the top of the tree is there for a reason. This is the problem /tmp solves.

A place anyone may write

A program should not need special rights just to save a working file. /tmp is the one directory on the system open to every user for that.

The sticky bit keeps it safe to share

Although everyone can write here, the sticky bit means a file can be deleted only by its owner or root. One user cannot remove another’s files.

What you find inside

Not everything, but the entries worth recognising. Each is marked as a directory, a file, a link or a device.

/tmp

systemd-private-…directoryA private temporary directory that systemd gives to one service.
.X11-unixdirectorySockets used by the graphical display.
tmp.Xa4kQ9fileA file created by mktemp, with a random name.
ssh-XXXXXXdirectoryAn SSH agent’s socket, for the length of a session.

At the terminal

Four commands that show what this directory is doing on a real machine.

ls -ld /tmp

Show the permissions: drwxrwxrwt. The final t is the sticky bit.

mktemp

Create a temporary file with a name nobody can guess, and print the name.

mktemp -d

The same, for a temporary directory.

df -h /tmp

See whether /tmp is on a disk or held in memory.

Handle with care

What goes wrong here, and what someone securing or attacking the machine looks at.

Never use a predictable name

A script that writes to /tmp/output can be tricked by another user who creates that name first, as a link to a file they want overwritten. Use mktemp.

It is where intruders unpack

Because anyone can write here, tools dropped by an attacker often land in /tmp or /dev/shm. Unexpected executables in either deserve a look.

For files that must last, use /var/tmp

/var/tmp is kept across reboots and cleaned less often. /tmp may be emptied without warning.

Read alongside

/varData that changes as the system runs: logs, caches, queues and databases./runState since the last boot: process ids, sockets and lock files./homeOne directory per user, for their own files and personal settings.