CVE-2017-18018: TOCTOU race condition in coreutils chown -R -L (restricted_chown bypass)

CVE-2017-18018 is a TOCTOU (Time-of-Check-Time-of-Use) race condition in GNU coreutils chown/chgrp commands. When using 'chown -R -L' (recursive + follow all symlinks to directories), an attacker who controls files in the traversed directory can replace a regular file with a symlink to an arbitrary privileged file during the window between FTS stat and the actual chownat() syscall. This allows changing ownership of any file on the system.

Root cause: In restricted_chown() in src/chown-core.c (lines 222-223), when neither --from=OWNER (required_uid) nor --from=:GROUP (required_gid) is specified (both == -1), the function immediately returns RC_do_ordinary_chown, bypassing the entire safe path (open file → fstat → verify inode matches → fchown with file descriptor). This causes the caller change_file_owner() to use chownat() (line 438), a path-based syscall that follows symlinks, instead of the inode-safe fchown approach.