use mktemp, and keep existing permissions set by user after update