Root privilege escalation via recursive chown hard-link traversal

Privilege escalation in Gentoo uptimed before 0.4.6-r1 allows local users with access to the uptimed account to gain root privileges. The pkg_postinst ebuild phase recursively changes ownership under /var/spool/uptimed, following an attacker-created hard link to an arbitrary file. Exploitation requires control of the uptimed account and a privileged emerge operation, which transfers ownership of the linked file and enables root compromise.