content: The whole problem is that newgrp is SUID. Running it runs as root user, but only it. The linker accepts environment variables, and one of them happens to have it print input, as it seems, to a chosen file. Due to the fact that newgrp is SUID, it has root permissions, thus you can easily do that.