Create secure FCGI socket file name

Cargo.toml

@@ -39,6 +39,7 @@ rust-embed = { version = "6.8.1", features = ["compression"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0.57"
 sqlx = { version = "0.7.0", default-features = false, features = [ "runtime-tokio-rustls", "sqlite", "postgres" ] }
+tempfile = "3.8.1"
 thiserror = "1.0.31"
 tokio = { version = "1.19.2" }
 

bbox-asset-server/Cargo.toml

@@ -19,7 +19,7 @@ minijinja = { workspace = true }
 once_cell = { workspace = true }
 rust-embed = { workspace = true }
 serde = { workspace = true }
-tempfile = "3.2.0"
+tempfile = { workspace = true }
 zip = { version = "0.5.13", default-features = false, features = ["deflate"] }
 
 [[bin]]

bbox-map-server/Cargo.toml

@@ -29,6 +29,7 @@ rand = "0.7.3"
 serde = { workspace = true }
 serde-xml-rs = "0.4.0"
 serde_json = { workspace = true }
+tempfile = { workspace = true }
 thiserror = { workspace = true }
 tokio = { version = "1", features = ["time"] }
 

bbox-map-server/src/fcgi_process.rs

@@ -147,9 +147,15 @@ impl FcgiProcessPool {
         }
     }
     /// Constant socket path over application lifetime
-    fn socket_path(name: &str, process_no: usize) -> String {
-        // TODO: Use tempfile::tempdir
-        format!("/tmp/fcgi_{}_{}", name, process_no)
+    fn socket_path(name: &str, _process_no: usize) -> String {
+        // We use the system temp path, but according to FHS /run would be correct
+        let file = tempfile::Builder::new()
+            .prefix(&format!("fcgi_{name}_"))
+            .rand_bytes(8)
+            .suffix(".sock")
+            .tempfile()
+            .expect("Socket file creation");
+        file.into_temp_path().to_string_lossy().to_string()
     }
     pub async fn spawn_processes(&mut self) -> std::io::Result<()> {
         let envs: Vec<_> = self

bbox-tile-server/Cargo.toml

@@ -42,7 +42,7 @@ rusoto_s3 = { version = "0.48.0", default-features = false, features = ["rustls"
 serde = { workspace = true }
 serde_json = { workspace = true }
 sqlx = { workspace = true }
-tempfile = "3.3.0"
+tempfile = { workspace = true }
 thiserror = { workspace = true }
 #tile-grid = "0.5.2"
 tile-grid = { git = "https://github.com/pka/tile-grid" }