Quoting first paragraph from [1]: https://bugzilla.redhat.com/showbug.cgi?id=173008

for issue description: ====================== When starting a program via "su - user -c program" the user session can escape to the parent session by using the TIOCSTI ioctl to push characters into the input buffer. This allows for example a non-root session to push "chmod 666 /etc/shadow" or similarly bad commands into the input buffer such that after the end of the session they are executed.

References: [1] https://bugzilla.redhat.com/showbug.cgi?id=173008 [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=628843