#215 more secure alternative to [tempfile]

[Don Porter]

The [tempfile] command creates
a new file and returns its name.

The caller is then free to
[open] that filename.

The separation of file creation
and the [open] leaves an interval
when an attacker might manipulate
that file. So care must be taken
when using this facility.

A more secure strategy is to have
one command do all parts: generate
the file name, create and open
the file, and pass back the channel
of the open file in addition to
the file name.

This is analogous to using
mkstmp() instead of tmpnam()
in a C program.

It would be good to either modify
[tempfile] to improve security, or
if compatibility is a concern, offer
an alternative command for the more
secure option.

Note there are some security issues
that cannot be addressed fully at
Tcl script level with Tcl's current
built-in commands, and will require
a C-coded solution. See TIP 210.

[Don Porter]

[file tempfile] is now part of Tcl 8.6.