hazards of linking directories

[jbn]

     This is a strong argument against running utilities such as the
line printer spooler as ``setuid to root''.  Such programs should
open the file of interest while running as the requestor and then
exec a second program which is set-uid to a service user id which owns
the spooling directory, after which a copy can be performed.  This
is a little more complex but much safer.