Index: include/stdlib.h
===================================================================
--- include/stdlib.h
+++ include/stdlib.h
@@ -297,6 +297,7 @@
 #endif
 int	 mkostemp(char *, int);
 int	 mkostemps(char *, int, int);
+int	 mkostempsat(int, char *, int, int);
 void	 qsort_r(void *, size_t, size_t, void *,
 	    int (*)(void *, const void *, const void *));
 int	 radixsort(const unsigned char **, int, const unsigned char *,
Index: lib/libc/stdio/Symbol.map
===================================================================
--- lib/libc/stdio/Symbol.map
+++ lib/libc/stdio/Symbol.map
@@ -171,6 +171,10 @@
 	gets_s;
 };
 
+FBSD_1.6 {
+	mkostempsat;
+};
+
 FBSDprivate_1.0 {
 	_flockfile;
 	_flockfile_debug_stub;
Index: lib/libc/stdio/mktemp.3
===================================================================
--- lib/libc/stdio/mktemp.3
+++ lib/libc/stdio/mktemp.3
@@ -28,7 +28,7 @@
 .\"     @(#)mktemp.3	8.1 (Berkeley) 6/4/93
 .\" $FreeBSD$
 .\"
-.Dd August 8, 2013
+.Dd July 22, 2019
 .Dt MKTEMP 3
 .Os
 .Sh NAME
@@ -46,6 +46,8 @@
 .Fn mkostemp "char *template" "int oflags"
 .Ft int
 .Fn mkostemps "char *template" "int suffixlen" "int oflags"
+.Ft int
+.Fn mkostempsat "int dfd" "char *template" "int suffixlen" "int oflags"
 .Ft char *
 .Fn mkdtemp "char *template"
 .In unistd.h
@@ -126,6 +128,19 @@
 are told the length of the suffix string.
 .Pp
 The
+.Fn mkostempsat
+function acts the same as
+.Fn mkostemps
+but takes an additional directory descriptor as a parameter.
+The temporary file is created relative to the corresponding
+directory, or to the current working directory if the special
+value
+.Dv AT_FDCWD
+is specified.
+The template must be a relative path.
+This function may be used in capability mode.
+.Pp
+The
 .Fn mkdtemp
 function makes the same replacement to the template as in
 .Fn mktemp
@@ -262,9 +277,10 @@
 .St -p1003.1-2008 .
 The
 .Fn mkostemp ,
-.Fn mkstemps
-and
+.Fn mkstemps ,
 .Fn mkostemps
+and
+.Fn mkostempsat
 functions do not conform to any standard.
 .Sh HISTORY
 A
@@ -293,6 +309,10 @@
 .Fn mkostemps
 functions appeared in
 .Fx 10.0 .
+The
+.Fn mkostempsat
+function appeared in
+.Fx 13.0 .
 .Sh BUGS
 This family of functions produces filenames which can be guessed,
 though the risk is minimized when large numbers of
@@ -308,10 +328,11 @@
 (later in the user application)
 particularly dangerous from a security perspective.
 Whenever it is possible,
-.Fn mkstemp
-or
+.Fn mkstemp ,
 .Fn mkostemp
-should be used instead, since it does not have the race condition.
+or
+.Fn mkostempsat
+should be used instead, since they do not have the race condition.
 If
 .Fn mkstemp
 cannot be used, the filename created by
Index: lib/libc/stdio/mktemp.c
===================================================================
--- lib/libc/stdio/mktemp.c
+++ lib/libc/stdio/mktemp.c
@@ -49,17 +49,25 @@
 
 char *_mktemp(char *);
 
-static int _gettemp(char *, int *, int, int, int);
+static int _gettemp(int, char *, int *, int, int, int);
 
 static const unsigned char padchar[] =
 "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 
+int
+mkostempsat(int dfd, char *path, int slen, int oflags)
+{
+	int fd;
+
+	return (_gettemp(dfd, path, &fd, 0, slen, oflags) ? fd : -1);
+}
+
 int
 mkostemps(char *path, int slen, int oflags)
 {
 	int fd;
 
-	return (_gettemp(path, &fd, 0, slen, oflags) ? fd : -1);
+	return (_gettemp(-1, path, &fd, 0, slen, oflags) ? fd : -1);
 }
 
 int
@@ -67,7 +75,7 @@
 {
 	int fd;
 
-	return (_gettemp(path, &fd, 0, slen, 0) ? fd : -1);
+	return (_gettemp(-1, path, &fd, 0, slen, 0) ? fd : -1);
 }
 
 int
@@ -75,7 +83,7 @@
 {
 	int fd;
 
-	return (_gettemp(path, &fd, 0, 0, oflags) ? fd : -1);
+	return (_gettemp(-1, path, &fd, 0, 0, oflags) ? fd : -1);
 }
 
 int
@@ -83,19 +91,19 @@
 {
 	int fd;
 
-	return (_gettemp(path, &fd, 0, 0, 0) ? fd : -1);
+	return (_gettemp(-1, path, &fd, 0, 0, 0) ? fd : -1);
 }
 
 char *
 mkdtemp(char *path)
 {
-	return (_gettemp(path, (int *)NULL, 1, 0, 0) ? path : (char *)NULL);
+	return (_gettemp(-1, path, (int *)NULL, 1, 0, 0) ? path : (char *)NULL);
 }
 
 char *
 _mktemp(char *path)
 {
-	return (_gettemp(path, (int *)NULL, 0, 0, 0) ? path : (char *)NULL);
+	return (_gettemp(-1, path, (int *)NULL, 0, 0, 0) ? path : (char *)NULL);
 }
 
 __warn_references(mktemp,
@@ -108,7 +116,7 @@
 }
 
 static int
-_gettemp(char *path, int *doopen, int domkdir, int slen, int oflags)
+_gettemp(int dfd, char *path, int *doopen, int domkdir, int slen, int oflags)
 {
 	char *start, *trv, *suffp, *carryp;
 	char *pad;
@@ -152,27 +160,40 @@
 	 * check the target directory.
 	 */
 	if (doopen != NULL || domkdir) {
-		for (; trv > path; --trv) {
-			if (*trv == '/') {
-				*trv = '\0';
-				rval = stat(path, &sbuf);
-				*trv = '/';
-				if (rval != 0)
-					return (0);
-				if (!S_ISDIR(sbuf.st_mode)) {
-					errno = ENOTDIR;
-					return (0);
+		if (dfd != -1) {
+			rval = _fstat(dfd, &sbuf);
+			if (rval != 0)
+				return (0);
+			if (!S_ISDIR(sbuf.st_mode)) {
+				errno = ENOTDIR;
+				return (0);
+			}
+		} else {
+			for (; trv > path; --trv) {
+				if (*trv == '/') {
+					*trv = '\0';
+					rval = stat(path, &sbuf);
+					*trv = '/';
+					if (rval != 0)
+						return (0);
+					if (!S_ISDIR(sbuf.st_mode)) {
+						errno = ENOTDIR;
+						return (0);
+					}
+					break;
 				}
-				break;
 			}
 		}
 	}
 
+	oflags |= O_CREAT | O_EXCL | O_RDWR;
 	for (;;) {
 		if (doopen) {
-			if ((*doopen =
-			    _open(path, O_CREAT|O_EXCL|O_RDWR|oflags, 0600)) >=
-			    0)
+			if (dfd != -1)
+				*doopen = _openat(dfd, path, oflags, 0600);
+			else
+				*doopen = _open(path, oflags, 0600);
+			if (*doopen >= 0)
 				return (1);
 			if (errno != EEXIST)
 				return (0);