HP-UX setprivgrp()

I just ran into this while doing routine security checks on HP-UX B.10.01
from man 2 chown on hp-ux 10.01:

"...Only processes with an effective user ID equal to the file owner or a
user having appropriate privileges can change the ownership of a file.
If privilege groups are supported, the owner of a file can change the
ownership only as a member of a privilege group allowing CHOWN, as set
up by the setprivgrp command (see setprivgrp(1M)). All users get the
CHOWN privilege by default..."

$ date
Thu Nov 7 11:17:24 PST 1996
$ getprivgrp
global privileges: CHOWN
$ pwd
/home/esilva
$ id
uid=112(esilva) gid=999(tmp)
$ mkdir tmp
$ chown esilva tmp
$ chmod 6777 tmp
$ ls -ldi tmp
 45696 drwsrwsrwx 2 esilva tmp 24 Nov 7 11:12 tmp
$ chown root tmp
$ ls -ldi tmp
 45696 drwsrwsrwx 2 root tmp 24 Nov 7 11:12 tmp
$ cd tmp
$ touch hello
$ ls -ldi hello
 45697 -rw-rw-rw- 1 esilva tmp 0 Nov 7 11:12 hello
$ chmod 6777 hello
$ chown root hello
$ ls -ldi hello
 45697 -rwxrwxrwx 1 root tmp 0 Nov 7 11:12 hello

Maybe a race condition can be won between the times the setuid bits
are changed by chown().

-Ed

--
                                                                      _
                                                                    /\o/\
Thanks!                                                            / <_> \
                                                                  /^^/ \^^\
-Ed                                                                 /___\