Question

Both operations create an empty file and return the filename but mkstemp leaves the file open in exclusive mode and gives you the handle. Is there a safety benefit to the C-function? Does this imply that there is a safety hole in the command-line version?

As an aside, it is interesting that there are several related functions in the C api on Linux and most of them say ‘Don’t use this function’ (or similar) in their man page.

Answer 1

As you can easily see from mktemp(1) source code, it essentially does nothing but calling mkstemp(3).

Exclusive mode in Linux means that function will fail if the file already exists, it does not guarantee locking. Other process can delete this file, create it again and fill it with data, despite the file handle being open(3) by your process.

There is no additional safety in C function compared to command line utility.