The sanlock server creates the /var/log/sanlock.log world writable allowing any one on the system to wipe the contents of the log file or to store data within the log file (bypassing any quotas applied to their account). The affected code is:
src/log.h
int setuplogging(void) { int fd, rv; snprintf(logfilepath, PATHMAX, "%s/%s", SANLKLOGDIR, SANLKLOGFILENAME); logfilefp = fopen(logfilepath, "a+");