chown security problem

[Kirill Korotaev]

Hello all,

I recently found that chown tries to keep SUID bit the same as it was 
for previous user. I think it is totally wrong and unsecure!

It leads to hard-exploitable race when user triggers SUID bit on its 
file and superuser changes owner to itself.

make under user:
$ touch aaa
$ chmod 755 aaa
$ ls -l aaa
-rwxr-xr-x    1 user    user            0 Фев 16 14:00 aaa
$ chmod 04755 aaa

make under root:
# strace chown root:root aaa
[...]
lstat64("aaa", {st_mode=S_IFREG|S_ISUID|0755, st_size=0, ...}) = 0
chown32("aaa", 0, 0)                    = 0
chmod("aaa", 0104755)                   = 0   <<<<<<< OOOOOPPPPSSSSSS
exit_group(0)                           = ?
# ls -l aaa
-rwsr-xr-x    1 root     root            0 Фев 16 14:01 aaa

Kirill