in 2.6.x and 2.4.x kernels, if a core file owned by a non root user exists and root runs a process that drops core in the same location, the original core file owned by the non root user is replaced with root's core dump, except the original owner maintains ownership of the core. http://bugzilla.kernel.org/show_bug.cgi?id=3043