diff --git a/base/file.cpp b/base/file.cpp
index e4407d0..d5bb7fe 100644
--- a/base/file.cpp
+++ b/base/file.cpp
@@ -18,6 +18,7 @@
 
 #include <errno.h>
 #include <fcntl.h>
+#include <ftw.h>
 #include <libgen.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -30,11 +31,6 @@
 #include <string>
 #include <vector>
 
-#include "android-base/logging.h"
-#include "android-base/macros.h"  // For TEMP_FAILURE_RETRY on Darwin.
-#include "android-base/unique_fd.h"
-#include "android-base/utf8.h"
-
 #if defined(__APPLE__)
 #include <mach-o/dyld.h>
 #endif
@@ -47,6 +43,11 @@
 #define OS_PATH_SEPARATOR '/'
 #endif
 
+#include "android-base/logging.h"  // and must be after windows.h for ERROR
+#include "android-base/macros.h"   // For TEMP_FAILURE_RETRY on Darwin.
+#include "android-base/unique_fd.h"
+#include "android-base/utf8.h"
+
 #ifdef _WIN32
 int mkstemp(char* template_name) {
   if (_mktemp(template_name) == nullptr) {
@@ -72,7 +73,8 @@
 
 std::string GetSystemTempDir() {
 #if defined(__ANDROID__)
-  const char* tmpdir = "/data/local/tmp";
+  const auto* tmpdir = getenv("TMPDIR");
+  if (tmpdir == nullptr) tmpdir = "/data/local/tmp";
   if (access(tmpdir, R_OK | W_OK | X_OK) == 0) {
     return tmpdir;
   }
@@ -81,7 +83,7 @@
   return ".";
 #elif defined(_WIN32)
   char tmp_dir[MAX_PATH];
-  DWORD result = GetTempPathA(sizeof(tmp_dir), tmp_dir);
+  DWORD result = GetTempPathA(sizeof(tmp_dir), tmp_dir);  // checks TMP env
   CHECK_NE(result, 0ul) << "GetTempPathA failed, error: " << GetLastError();
   CHECK_LT(result, sizeof(tmp_dir)) << "path truncated to: " << result;
 
@@ -91,7 +93,9 @@
   tmp_dir[result - 1] = '\0';
   return tmp_dir;
 #else
-  return "/tmp";
+  const auto* tmpdir = getenv("TMPDIR");
+  if (tmpdir == nullptr) tmpdir = "/tmp";
+  return tmpdir;
 #endif
 }
 
@@ -130,7 +134,34 @@
 }
 
 TemporaryDir::~TemporaryDir() {
-  rmdir(path);
+  if (!remove_dir_and_contents_) return;
+
+  auto callback = [](const char* child, const struct stat*, int file_type, struct FTW*) -> int {
+    switch (file_type) {
+      case FTW_D:
+      case FTW_DP:
+      case FTW_DNR:
+        if (rmdir(child) == -1) {
+          PLOG(ERROR) << "rmdir " << child;
+        }
+        break;
+      case FTW_NS:
+      default:
+        if (rmdir(child) != -1) break;
+        // FALLTHRU (for gcc, lint, pcc, etc; and following for clang)
+        FALLTHROUGH_INTENDED;
+      case FTW_F:
+      case FTW_SL:
+      case FTW_SLN:
+        if (unlink(child) == -1) {
+          PLOG(ERROR) << "unlink " << child;
+        }
+        break;
+    }
+    return 0;
+  };
+
+  nftw(path, callback, 128, FTW_DEPTH | FTW_MOUNT | FTW_PHYS);
 }
 
 bool TemporaryDir::init(const std::string& tmp_dir) {
diff --git a/base/include/android-base/file.h b/base/include/android-base/file.h
index 80d7134..f8748b5 100644
--- a/base/include/android-base/file.h
+++ b/base/include/android-base/file.h
@@ -61,12 +61,16 @@
  public:
   TemporaryDir();
   ~TemporaryDir();
+  // Don't remove the temporary dir in the destructor.
+  void DoNotRemove() { remove_dir_and_contents_ = false; }
 
   char path[1024];
 
  private:
   bool init(const std::string& tmp_dir);
 
+  bool remove_dir_and_contents_ = true;
+
   DISALLOW_COPY_AND_ASSIGN(TemporaryDir);
 };
 
diff --git a/fs_mgr/liblp/images.cpp b/fs_mgr/liblp/images.cpp
index a46836e..9e64de1 100644
--- a/fs_mgr/liblp/images.cpp
+++ b/fs_mgr/liblp/images.cpp
@@ -299,7 +299,7 @@
     uint64_t partition_size = ComputePartitionSize(partition);
     if (file_length > partition_size) {
         LERROR << "Image for partition '" << GetPartitionName(partition)
-               << "' is greater than its size (" << file_length << ", excepted " << partition_size
+               << "' is greater than its size (" << file_length << ", expected " << partition_size
                << ")";
         return false;
     }
@@ -419,25 +419,19 @@
         return fd;
     }
 
-    char temp_file[PATH_MAX];
-    snprintf(temp_file, sizeof(temp_file), "%s/imageXXXXXX", P_tmpdir);
-    android::base::unique_fd temp_fd(mkstemp(temp_file));
-    if (temp_fd < 0) {
-        PERROR << "mkstemp failed";
-        return -1;
-    }
-    if (unlink(temp_file) < 0) {
-        PERROR << "unlink failed";
+    TemporaryFile tf;
+    if (tf.fd < 0) {
+        PERROR << "make temporary file failed";
         return -1;
     }
 
     // We temporarily unsparse the file, rather than try to merge its chunks.
-    int rv = sparse_file_write(source.get(), temp_fd, false, false, false);
+    int rv = sparse_file_write(source.get(), tf.fd, false, false, false);
     if (rv) {
         LERROR << "sparse_file_write failed with code: " << rv;
         return -1;
     }
-    temp_fds_.push_back(std::move(temp_fd));
+    temp_fds_.push_back(android::base::unique_fd(tf.release()));
     return temp_fds_.back().get();
 }
 
diff --git a/gatekeeperd/gatekeeperd.cpp b/gatekeeperd/gatekeeperd.cpp
index f2818f3..446b66e 100644
--- a/gatekeeperd/gatekeeperd.cpp
+++ b/gatekeeperd/gatekeeperd.cpp
@@ -25,7 +25,7 @@
 #include <unistd.h>
 #include <memory>
 
-#include <android/security/IKeystoreService.h>
+#include <android/security/keystore/IKeystoreService.h>
 #include <binder/IPCThreadState.h>
 #include <binder/IServiceManager.h>
 #include <binder/PermissionCache.h>
@@ -318,8 +318,8 @@
             // TODO: cache service?
             sp<IServiceManager> sm = defaultServiceManager();
             sp<IBinder> binder = sm->getService(String16("android.security.keystore"));
-            sp<security::IKeystoreService> service =
-                interface_cast<security::IKeystoreService>(binder);
+            sp<security::keystore::IKeystoreService> service =
+                    interface_cast<security::keystore::IKeystoreService>(binder);
             if (service != NULL) {
                 std::vector<uint8_t> auth_token_vector(*auth_token,
                                                        (*auth_token) + *auth_token_length);