/etc/sf-*.tmp files

[notramo]

dnscrypt-proxy on Linux creates random files in /etc
They all follow the /etc/sf-*.tmp pattern, with * matching 15-20 random characters.

Why are they created?
Why don't you use /tmp for temporary files? (If it needs to persist between reboots, then /var/tmp.)

[jedisct1]

There's no such thing in a standard install.

This is specific to your environment. Did you copy/paste a configuration found somewhere?

Maybe check for the sf- string in the configuration file, the context may give a clue.

All paths are configurable.

[notramo]

These are not preserved, but temporary files, so they are soon deleted after being created.
Start dnscrypt-proxy with AppArmor confinement, and you will see error message.

[notramo]

I found out by grepping the repo that this is caused by the safefile module.
https://github.com/dchest/safefile

[lifenjoiner]

As you've located it in safefile, you can read the source code and comments (safefile.go#L7-L31).

It is a safe way to overwrite an existing file. It is reasonable that the .tmp file is at the same place as the final file. Here, they are public-resolvers.md and public-resolvers.md.minisig.
Don't panic. If you prefer /var/tmp than /tmp or /etc, you can place and specify your config file there. Maybe /var/tmp is not a good idea. I'm not a Linux user. ;p

[notramo]

The problem is that allowing these globs in AppArmor profiles are ugly.
If all files were in /etc/dnscrypt-proxy/, then it would be sufficient:

owner /etc/dnscrypt-proxy rw

These files are temporary files. But what are the actual files that are written? Probably there is a better place in the system to store these files.

[jedisct1]

If these are cache files, they are written in the values defined for the cache_file property of every source in your configuration file. This is relative to the configuration file itself, so if you want everything to be in /etc/dnscrypt-proxy, you can place dnscrypt-proxy.toml in /etc/dnscrypt-proxy/.