Use _mktemp internally
these are inherently unsafe interfaces. Do not allow TMPDIR to override path for setuid/setgid programs.