@lcamtuflcamtuf This code has a lot of problems. Like the race vuln in /bin/mkdir.

In pdp-11 Unix, mkdir was a suid-root program that did a mknod to create the directory, and then a chown to change its ownership to other-than-root. But something else could rename the directory after the mknod, and replace it with a link to, e.g., /etc/passwd, which would then get chowned.

On later versions with ^Z job control, a ^Z on mkdir had good odds of catching it between the two syscalls; no code required.