--- configure.in
+++ configure.in
@@ -1399,7 +1399,7 @@ AC_PROG_GCC_TRADITIONAL
 AC_FUNC_SETPGRP
 AC_TYPE_SIGNAL
 AC_FUNC_VPRINTF
-AC_CHECK_FUNCS(bcopy crypt fdatasync fgetgrent fgetpwent fgetspent flock fpathconf freeaddrinfo futimes getpgid getpgrp nl_langinfo)
+AC_CHECK_FUNCS(bcopy crypt fdatasync fgetgrent fgetpwent fgetspent flock fpathconf freeaddrinfo futimes getpgid getpgrp mkdtemp nl_langinfo)
 AC_CHECK_FUNC(gai_strerror,
   AC_DEFINE(HAVE_GAI_STRERROR, 1,
     [Define if you have the gai_strerror() function]),
--- configure
+++ configure
@@ -26526,7 +26526,8 @@ done
 
 
 
-for ac_func in bcopy crypt fdatasync fgetgrent fgetpwent fgetspent flock fpathconf freeaddrinfo futimes getpgid getpgrp nl_langinfo
+
+for ac_func in bcopy crypt fdatasync fgetgrent fgetpwent fgetspent flock fpathconf freeaddrinfo futimes getpgid getpgrp mkdtemp nl_langinfo
 do
 as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
 { echo "$as_me:$LINENO: checking for $ac_func" >&5
--- config.h.in
+++ config.h.in
@@ -357,6 +357,9 @@
 /* Define if you have the mkdir function.  */
 #undef HAVE_MKDIR
 
+/* Define if you have the mkdtemp function.  */
+#undef HAVE_MKDTEMP
+
 /* Define if you have the mkstemp function.  */
 #undef HAVE_MKSTEMP
 
--- contrib/mod_sftp/fxp.c
+++ contrib/mod_sftp/fxp.c
@@ -5498,7 +5498,7 @@ static int fxp_handle_mkdir(struct fxp_p
   (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
     "creating directory '%s' with mode 0%o", path, (unsigned int) dir_mode);
 
-  res = pr_fsio_mkdir(path, dir_mode);
+  res = pr_fsio_smkdir(fxp->pool, path, dir_mode, (uid_t) -1, (gid_t) -1);
   if (res < 0) {
     const char *reason;
     int xerrno = errno;
--- contrib/mod_sftp/scp.c
+++ contrib/mod_sftp/scp.c
@@ -711,7 +711,7 @@ static int recv_finfo(pool *p, uint32_t
       if (xerrno == ENOENT) {
         pr_trace_msg(trace_channel, 5, "creating directory '%s'", sp->filename);
 
-        if (pr_fsio_mkdir(sp->filename, 0777) < 0) {
+        if (pr_fsio_smkdir(p, sp->filename, 0777, (uid_t) -1, (gid_t) -1) < 0) {
           xerrno = errno;
 
           (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
--- include/fsio.h
+++ include/fsio.h
@@ -129,6 +129,7 @@ struct fs_rec {
   int (*fchmod)(pr_fh_t *, int, mode_t);
   int (*chown)(pr_fs_t *, const char *, uid_t, gid_t);
   int (*fchown)(pr_fh_t *, int, uid_t, gid_t);
+  int (*lchown)(pr_fs_t *, const char *, uid_t, gid_t);
   int (*access)(pr_fs_t *, const char *, int, uid_t, gid_t, array_header *);
   int (*faccess)(pr_fh_t *, int, uid_t, gid_t, array_header *);
   int (*utimes)(pr_fs_t *, const char *, struct timeval *);
@@ -249,6 +250,7 @@ int pr_fsio_mkdir(const char *, mode_t);
 int pr_fsio_rmdir(const char *);
 int pr_fsio_rename(const char *, const char *);
 int pr_fsio_rename_canon(const char *, const char *);
+int pr_fsio_smkdir(pool *, const char *, mode_t, uid_t, gid_t);
 int pr_fsio_unlink(const char *);
 int pr_fsio_unlink_canon(const char *);
 pr_fh_t *pr_fsio_open(const char *, int);
@@ -270,6 +272,7 @@ int pr_fsio_fchmod(pr_fh_t *, mode_t);
 int pr_fsio_chmod_canon(const char *, mode_t);
 int pr_fsio_chown(const char *, uid_t, gid_t);
 int pr_fsio_fchown(pr_fh_t *, uid_t, gid_t);
+int pr_fsio_lchown(const char *, uid_t, gid_t);
 int pr_fsio_chown_canon(const char *, uid_t, gid_t);
 int pr_fsio_chroot(const char *);
 int pr_fsio_access(const char *, int, uid_t, gid_t, array_header *);
@@ -278,6 +281,11 @@ int pr_fsio_utimes(const char *, struct
 int pr_fsio_futimes(pr_fh_t *, struct timeval *);
 off_t pr_fsio_lseek(pr_fh_t *, off_t, int);
 
+/* Set a flag determining whether to use mkdtemp(3) (if available) or not.
+ * Returns the previously-set value.
+ */
+int pr_fsio_set_use_mkdtemp(int);
+
 /* FS-related functions */
 
 char *pr_fsio_getline(char *, int, pr_fh_t *, unsigned int *);
--- modules/mod_core.c
+++ modules/mod_core.c
@@ -3744,7 +3744,7 @@ int core_chgrp(cmd_rec *cmd, char *dir,
   }
   cmd->argv[0] = cmd_name;
 
-  return pr_fsio_chown(dir, uid, gid);
+  return pr_fsio_lchown(dir, uid, gid);
 }
 
 int core_chmod(cmd_rec *cmd, char *dir, mode_t mode) {
@@ -4002,7 +4002,6 @@ MODRET core_rmd(cmd_rec *cmd) {
 MODRET core_mkd(cmd_rec *cmd) {
   int res;
   char *dir;
-  struct stat st;
 
   CHECK_CMD_MIN_ARGS(cmd, 2);
 
@@ -4043,7 +4042,8 @@ MODRET core_mkd(cmd_rec *cmd) {
     return PR_ERROR(cmd);
   }
 
-  if (pr_fsio_mkdir(dir, 0777) < 0) {
+  if (pr_fsio_smkdir(cmd->tmp_pool, dir, 0777, session.fsuid,
+      session.fsgid) < 0) {
     int xerrno = errno;
 
     (void) pr_trace_msg("fileperms", 1, "%s, user '%s' (UID %lu, GID %lu): "
@@ -4055,71 +4055,6 @@ MODRET core_mkd(cmd_rec *cmd) {
     return PR_ERROR(cmd);
   }
 
-  /* Check to see if we need to change the ownership (user and/or group) of
-   * the newly created directory.
-   */
-  if (session.fsuid != (uid_t) -1) {
-    int err = 0, iserr = 0;
-
-    pr_fsio_stat(dir, &st);
-
-    PRIVS_ROOT
-    if (pr_fsio_chown(dir, session.fsuid, session.fsgid) == -1) {
-      iserr++;
-      err = errno;
-    }
-    PRIVS_RELINQUISH
-
-    if (iserr) {
-      pr_log_pri(PR_LOG_WARNING, "chown() as root failed: %s", strerror(err));
-
-    } else {
-      if (session.fsgid != (gid_t) -1) {
-        pr_log_debug(DEBUG2, "root chown(%s) to uid %lu, gid %lu successful",
-          dir, (unsigned long) session.fsuid, (unsigned long) session.fsgid);
-
-      } else {
-        pr_log_debug(DEBUG2, "root chown(%s) to uid %lu successful", dir,
-          (unsigned long) session.fsuid);
-      }
-    }
-
-  } else if (session.fsgid != (gid_t) -1) {
-    register unsigned int i;
-    int use_root_privs = TRUE;
-
-    pr_fsio_stat(dir, &st);
-
-    /* Check if session.fsgid is in session.gids.  If not, use root privs.  */
-    for (i = 0; i < session.gids->nelts; i++) {
-      gid_t *group_ids = session.gids->elts;
-
-      if (group_ids[i] == session.fsgid) {
-        use_root_privs = FALSE;
-        break;
-      }
-    }
-
-    if (use_root_privs) {
-      PRIVS_ROOT
-    }
-
-    res = pr_fsio_chown(dir, (uid_t) -1, session.fsgid);
-
-    if (use_root_privs) {
-      PRIVS_RELINQUISH
-    }
-
-    if (res == -1) {
-      pr_log_pri(PR_LOG_WARNING, "%schown() failed: %s",
-        use_root_privs ? "root " : "", strerror(errno));
-
-    } else { 
-      pr_log_debug(DEBUG2, "%schown(%s) to gid %lu successful",
-        use_root_privs ? "root " : "", dir, (unsigned long) session.fsgid);
-    }
-  }
-
   pr_response_add(R_257, _("\"%s\" - Directory successfully created"),
     quote_dir(cmd, dir));
 
--- src/fsio.c
+++ src/fsio.c
@@ -29,6 +29,7 @@
  */
 
 #include "conf.h"
+#include "privs.h"
 
 #ifdef HAVE_REGEX_H
 # include <regex.h>
@@ -84,6 +85,13 @@ static unsigned char chk_fs_map = FALSE;
 static char vwd[PR_TUNABLE_PATH_MAX + 1] = "/";
 static char cwd[PR_TUNABLE_PATH_MAX + 1] = "/";
 
+/* Runtime enabling/disabling of mkdtemp(3) use. */
+#ifdef HAVE_MKDTEMP
+static int use_mkdtemp = TRUE;
+#else
+static int use_mkdtemp = FALSE;
+#endif /* HAVE_MKDTEMP */
+
 /* Runtime enabling/disabling of encoding of paths. */
 static int use_encoding = TRUE;
 
@@ -179,6 +187,10 @@ static int sys_fchown(pr_fh_t *fh, int f
   return fchown(fd, uid, gid);
 }
 
+static int sys_lchown(pr_fs_t *fs, const char *path, uid_t uid, gid_t gid) {
+  return lchown(path, uid, gid);
+}
+
 /* We provide our own equivalent of access(2) here, rather than using
  * access(2) directly, because access(2) uses the real IDs, rather than
  * the effective IDs, of the process.
@@ -2477,6 +2489,213 @@ int pr_fsio_mkdir(const char *path, mode
   return res;
 }
 
+int pr_fsio_set_use_mkdtemp(int value) {
+  int prev_value;
+
+  prev_value = use_mkdtemp;
+
+#ifdef HAVE_MKDTEMP
+  use_mkdtemp = value;
+#endif /* HAVE_MKDTEMP */
+
+  return prev_value;
+}
+
+/* "safe mkdir" variant of mkdir(2), uses mkdtemp(3), lchown(2), and
+ * rename(2) to create a directory which cannot be hijacked by a symlink
+ * race (hopefully) before the UserOwner/GroupOwner ownership changes are
+ * applied.
+ */
+int pr_fsio_smkdir(pool *p, const char *path, mode_t mode, uid_t uid,
+    gid_t gid) {
+  int res, use_root_privs = TRUE, xerrno = 0;
+  char *tmpl_path;
+  char *dst_dir, *tmpl;
+  size_t dst_dirlen, tmpl_len;
+
+  if (path == NULL) {
+    errno = EINVAL;
+    return -1;
+  }
+
+#ifdef HAVE_MKDTEMP
+  if (use_mkdtemp == TRUE) {
+    char *ptr;
+    struct stat st;
+
+    ptr = strrchr(path, '/');
+    if (ptr == NULL) {
+      errno = EINVAL;
+      return -1;
+    }
+
+    if (ptr != path) {
+      dst_dirlen = (ptr - path);
+      dst_dir = pstrndup(p, path, dst_dirlen);
+
+    } else {
+      dst_dirlen = 1;
+      dst_dir = "/";
+    }
+
+    res = lstat(dst_dir, &st);
+    if (res < 0) {
+      return -1;
+    }
+
+    if (!S_ISDIR(st.st_mode) &&
+        !S_ISLNK(st.st_mode)) {
+      errno = EPERM;
+      return -1;
+    }
+
+    /* Allocate enough space for the temporary name: the length of the
+     * destination directory, a slash, 9 X's, 3 for the prefix, and 1 for the
+     * trailing NUL.
+     */
+    tmpl_len = strlen(dst_dir) + 14;
+    tmpl = pcalloc(p, tmpl_len);
+    snprintf(tmpl, tmpl_len-1, "%s/dstXXXXXXXXX",
+      dst_dirlen > 1 ? dst_dir : "");
+
+    /* Use mkdtemp(3) to create the temporary directory (in the same destination
+     * directory as the target path).
+     */
+    tmpl_path = mkdtemp(tmpl);
+    if (tmpl_path == NULL) {
+      return -1;
+    }
+
+  } else {
+    res = pr_fsio_mkdir(path, mode);
+    if (res < 0) {
+      return -1;
+    }
+
+    tmpl_path = pstrdup(p, path);
+  }
+#else
+
+  res = pr_fsio_mkdir(path, mode);
+  if (res < 0) {
+    return -1;
+  }
+
+  tmpl_path = pstrdup(p, path);
+#endif /* HAVE_MKDTEMP */
+
+  if (uid != (uid_t) -1) {
+    PRIVS_ROOT
+    res = pr_fsio_lchown(tmpl_path, uid, gid);
+    xerrno = errno;
+    PRIVS_RELINQUISH
+
+    if (res < 0) {
+      pr_log_pri(PR_LOG_WARNING, "lchown(%s) as root failed: %s", tmpl_path,
+        strerror(xerrno));
+
+    } else {
+      if (gid != (gid_t) -1) {
+        pr_log_debug(DEBUG2, "root lchown(%s) to UID %lu, GID %lu successful",
+          tmpl_path, (unsigned long) uid, (unsigned long) gid);
+
+      } else {
+        pr_log_debug(DEBUG2, "root lchown(%s) to UID %lu successful",
+          tmpl_path, (unsigned long) uid);
+      }
+    }
+
+  } else if (gid != (gid_t) -1) {
+    register unsigned int i;
+
+    /* Check if session.fsgid is in session.gids.  If not, use root privs.  */
+    for (i = 0; i < session.gids->nelts; i++) {
+      gid_t *group_ids = session.gids->elts;
+
+      if (group_ids[i] == gid) {
+        use_root_privs = FALSE;
+        break;
+      }
+    }
+
+    if (use_root_privs) {
+      PRIVS_ROOT
+    }
+
+    res = pr_fsio_lchown(tmpl_path, (uid_t) -1, gid);
+    xerrno = errno;
+
+    if (use_root_privs) {
+      PRIVS_RELINQUISH
+    }
+
+    if (res < 0) {
+      pr_log_pri(PR_LOG_WARNING, "%slchown(%s) failed: %s",
+        use_root_privs ? "root " : "", tmpl_path, strerror(xerrno));
+
+    } else {
+      pr_log_debug(DEBUG2, "%slchown(%s) to GID %lu successful",
+        use_root_privs ? "root " : "", tmpl_path, (unsigned long) gid);
+    }
+  }
+
+  if (use_mkdtemp == TRUE) {
+    mode_t mask, *dir_umask;
+
+    /* Use chmod(2) to set the permission that we want.
+     *
+     * mkdtemp(3) creates a directory with 0700 perms; we are given the
+     * target mode (modulo the configured Umask).
+     */
+    dir_umask = get_param_ptr(CURRENT_CONF, "DirUmask", FALSE);
+    if (dir_umask) {
+      mask = *dir_umask;
+
+    } else {
+      mask = (mode_t) 0022;
+    }
+
+    if (use_root_privs) {
+      PRIVS_ROOT
+    }
+
+    res = chmod(tmpl_path, mode & ~mask);
+    xerrno = errno;
+
+    if (use_root_privs) {
+      PRIVS_RELINQUISH
+    }
+
+    if (res < 0) {
+      pr_log_pri(PR_LOG_WARNING, "%schmod(%s) failed: %s",
+        use_root_privs ? "root " : "", tmpl_path, strerror(xerrno));
+
+      (void) rmdir(tmpl_path);
+
+      errno = xerrno;
+      return -1;
+    }
+
+    /* Use rename(2) to move the temporary directory into place at the
+     * target path.
+     */
+    res = rename(tmpl_path, path);
+    if (res < 0) {
+      xerrno = errno;
+
+      pr_log_pri(PR_LOG_WARNING, "renaming '%s' to '%s' failed: %s", tmpl_path,
+        path, strerror(xerrno));
+
+      (void) rmdir(tmpl_path);
+    
+      errno = xerrno;
+      return -1;
+    }
+  }
+
+  return 0;
+}
+
 int pr_fsio_rmdir(const char *path) {
   int res;
   pr_fs_t *fs;
@@ -3336,6 +3555,33 @@ int pr_fsio_fchown(pr_fh_t *fh, uid_t ui
   return res;
 }
 
+int pr_fsio_lchown(const char *name, uid_t uid, gid_t gid) {
+  int res;
+  pr_fs_t *fs;
+
+  fs = lookup_file_fs(name, NULL, FSIO_FILE_CHOWN);
+  if (fs == NULL) {
+    return -1;
+  }
+
+  /* Find the first non-NULL custom lchown handler.  If there are none,
+   * use the system chown.
+   */
+  while (fs && fs->fs_next && !fs->lchown) {
+    fs = fs->fs_next;
+  }
+
+  pr_trace_msg(trace_channel, 8, "using %s lchown() for path '%s'",
+    fs->fs_name, name);
+  res = (fs->lchown)(fs, name, uid, gid);
+
+  if (res == 0) {
+    pr_fs_clear_cache();
+  }
+
+  return res;
+}
+
 int pr_fsio_access(const char *path, int mode, uid_t uid, gid_t gid,
     array_header *suppl_gids) {
   pr_fs_t *fs;
@@ -3955,6 +4201,7 @@ int init_fs(void) {
   root_fs->fchmod = sys_fchmod;
   root_fs->chown = sys_chown;
   root_fs->fchown = sys_fchown;
+  root_fs->lchown = sys_lchown;
   root_fs->access = sys_access;
   root_fs->faccess = sys_faccess;
   root_fs->utimes = sys_utimes;
@@ -4036,6 +4283,12 @@ static const char *get_fs_hooks_str(pool
   if (fs->chown)
     hooks = pstrcat(p, hooks, *hooks ? ", " : "", "chown(2)", NULL);
 
+  if (fs->fchown)
+    hooks = pstrcat(p, hooks, *hooks ? ", " : "", "fchown(2)", NULL);
+
+  if (fs->lchown)
+    hooks = pstrcat(p, hooks, *hooks ? ", " : "", "lchown(2)", NULL);
+
   if (fs->access)
     hooks = pstrcat(p, hooks, *hooks ? ", " : "", "access(2)", NULL);
 
--- src/Makefile.in
+++ src/Makefile.in
@@ -294,7 +294,7 @@ filter.o: ../include/event.h ../include/
 filter.o: ../include/trace.h ../include/encode.h ../include/compat.h
 filter.o: ../include/proctitle.h ../include/pidfile.h ../include/env.h
 filter.o: ../include/pr-syslog.h
-fsio.o: ../include/conf.h ../include/version.h ../config.h
+fsio.o: ../include/conf.h ../include/privs.h ../include/version.h ../config.h
 fsio.o: ../include/default_paths.h ../include/options.h ../include/pool.h
 fsio.o: ../include/str.h ../include/regexp.h ../include/table.h
 fsio.o: ../include/proftpd.h ../include/class.h ../include/netacl.h