Currently pam_mktemp.so is loaded after pam_env.so (in /etc/pam.d/system-auth, /etc/pam.d/system-services), so the ${TMP} variable is not available for pam_env.so. It appears to me that pam_mktemp.so does not depend on pam_env.so to be loaded first, so swapping it would probably do no harm. This is not a problem with login sessions, but if one wants to define ${TMP} in /etc/security/pam_env.conf for use in fcron. This is related to https://bugs.gentoo.org/show_bug.cgi?id=504492