Hi,
there is a patchset that adds sss_unique_file with an optional
destructor:
https://patchwork.acksyn.org/patch/11351/
Attached are patches that use the function instead of mkstemp(). As you
can see in the patches, we already fix some bugs this way, especially
removing the tmpfiles left behind on error. In some cases, I also added
closing the fd on error.