Local privilege escalation via hardlink ownership change

Local privilege escalation in GNU Guix guix-daemon allows local users to gain write access to root-owned files through a failed build. In a multi-user setup, an unprivileged user makes a build directory world-writable, adds a hardlink to a root-owned file, and triggers build failure with --keep-failed so the daemon recursively transfers ownership of the linked inode. The attack requires local low-privileged access, a locally running privileged daemon, and control of a failing build; exploitation permits modification of files such as /etc/shadow.