Note: sent to bash, zsh and Schily Bourne shell dev mailing lists (not mksh as my email provider apparently doesn't play well with mirbsd.org's expensive greylisting, please feel free to forward there if you don't use gmail).
That's from: https://unix.stackexchange.com/questions/429285/cannot-create-temp-file-for-here-document-permission-denied $ bash -c 'umask 400; cat <<< test' bash: cannot create temp file for here-document: Permission denied $ zsh -c 'umask 400; cat <<< test' zsh:1: can't create temp file for here document: permission denied $ bosh -c 'umask 400; cat << EOF test EOF' bosh: /tmp/sh193220: cannot open $ mksh -c 'umask 400; cat <<< test' mksh: can't open temporary file /tmp/sh933f2z.tmp: Permission denied Those shells use temporary files to store the content of the here-documents as the Bourne shell initially did, and open them in read-only mode to make it cat's stdin. When umask contains the 0400 bit, the file is created without read permission to the user, hence the error upon that second open(). (note that bosh also leaves the temp file behind in that case). I can think of several ways to address it: 1- do nothing and blame the user as the user explicitly asked for files to be unreadable (but then again, it's not obvious to the user that heredocs imply a temp file) 2- do like AT&T ksh/tcsh (or yash for big heredocs that don't fit in the pipe buffer) and open the file only once for both writing the content and making it the command's stdin (with a lseek() to beginning in between). That means the fd ends up being writable though I can't see it being a huge problem. (Yash actually gives the file 000 permissions here regardless of the umask with open("/tmp/yash-ECCFE6268", O_RDWR|O_CREAT|O_EXCL, 0), but see below about =(...) emulation) 3. do like dash/yash/rc/es and use a pipe instead of a temp file. That means having to fork a process to feed the data (or like yash fall back to a temp file for big heredocs). That also means the fd is no longer seekable The change could break some scripts for bash, as on Linux (where /dev/fd/n behaves differently from other *nices), we see some doing: cmd1 /dev/fd/3 3<<< "$(cmd2)" to emulate zsh's cmd1 =(cmd2) (command substitution using a temp file). (A 0400 umask also makes a =(...) file unreadable, but definitely here it's the user's problem). 4. Reset the umask temporarily to 077 before creating the temp file (and block trapped signals until it's restored). 2 would have my preference. -- Stephane
