A Debian bug report [1] noted that gdomap daemon used by GNUstep chroots itself to /tmp for "another level of paranoia", however it is chrooting to a directory that is writable and readable by every other user on the system.  It should be chrooting to an empty directory (like /var/empty) where nothing can influence the environment or be overritten by the daemon itself.

In Tools/gdomap.c:

4974 #if     !defined(__svr4__)
4975   /*
4976    * As another level of paranoia - restrict this process to /tmp
4977    */
4978 #ifndef __MINGW__
4979   if (chdir("/tmp") < 0)
4980     {
4981       snprintf(ebuf, sizeof(ebuf), "Unable to change directory to /tmp");
4982       gdomap_log(LOG_CRIT);
4983       exit(EXIT_FAILURE);
4984     }
4985
4986   if (geteuid() == 0)
4987     {
4988       if (chroot("/tmp") < 0)
4989         {
4990           snprintf(ebuf, sizeof(ebuf), "Unable to change root to /tmp");
4991           gdomap_log(LOG_CRIT);
4992           exit(EXIT_FAILURE);
4993         }
4994       chdir("/");
4995     }
4996 #endif /* __MINGW__ */
4997 #endif /* __svr4__ */

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=741441