In GNU Coreutils through 8.29 chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \-R -L\ options which allows local users to modify the ownership of arbitrary files by leveraging a race condition.