If a tty port that is writeable by the user and owned by root is opened and the I PUSH ms ioctl call made followed by an lseek the effective uid of the user is changed to root.