Portage's /var/tmp/portage tree is accessible by arbitrary users by default. Nearly all the time, the files are not writable by normal users. But sometimes, there are exceptions, which means that for certain ebuilds that create public-writable files and directories, it is possible in some instances to 'inject' things into the build process that will get installed on the system.