User "foo" can use the SWAPEXT ioctl to swap a write-only file owned by 
user "bar" into a file owned by "foo" and subsequently reading it. It 
does so by checking that the file descriptors passed to the ioctl are 
also opened for reading.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=605158
http://archives.free.net.ph/message/20100616.130710.301704aa.en.html
http://archives.free.net.ph/message/20100616.135735.40f53a32.en.html

Thanks, Eugene