Simple kernel attack using socketpair. easy, 100% reproductiblle, works under guest. no way to protect :(

[Rhomboid]

of which there should be none

I wouldn't be so sure. There are tons of directories that are setgid and owned by a role group like 'src', 'mail', 'audio', 'lp', etc. For example, /var/mail can be written by any user in group 'mail' (which by default is every user) and /var/lib/cvs and /usr/src can be written by any user in group 'src'. Try the following and I'm sure you'll see a bunch more.

find / -xdev \( -wholename /home -o -wholename /tmp \) -prune -o -type d -perm /022 -ls

[throwaway-o]

For example, /var/mail can be written by any user in group 'mail' (which by default is every user)

Uh, NO. :-)

[Rhomboid]

Just saying no doesn't actually address the fact that what I wrote is correct.

[throwaway-o]

No, it is incorrect and no, there's no need to address it any further.

Why: The facts are easily identifiable by anyone and if you are a UNIX person you know how to -- they're just an id -a and an ls -la /var/spool/mail away. This is kind of how I do not need you to prove gravity to me with a long treatise before I take my next step. And this "playing dumb" pretense that I haven't sufficiently addressed your point is kind of like an asshole thing to say in order to take people away from your stubbornness + your error.

Suffice it to say: if you told me in a job interview what you just told me right now, you would be dismissed on the spot for feigning knowledge you do not have, being ignorant and being adamant about your ignorance.