Great. perl is just doing what it ought to do :-) You are not running -T, but there's a discrepancy between UID and EUID.

The assignment is the other way round. Set the real UID to the effective UID:

$UID = $EUID;
# or
$< = $>;
[download]

Apart from that, you are perhaps missing some caveats from perlvar (emphasis added):

$REAL_USER_ID
$UID
$<

The real uid of this process. (Mnemonic: it's the uid you came from, if you're running setuid.) You can change both the real uid and the effective uid at the same time by using POSIX::setuid(). Since changes to $< require a system call, check $! after a change attempt to detect any possible errors.

$EFFECTIVE_USER_ID
$EUID
$>

The effective uid of this process. Example:

    $< = $>;            # set real to effective uid
    ($<,$>) = ($>,$<);  # swap real and effective uid
[download]

You can change both the effective uid and the real uid at the same time by using POSIX::setuid(). Changes to $> require a check to $! to detect any possible errors after an attempted change.

(Mnemonic: it's the uid you went to, if you're running setuid.) $< and $> can be swapped only on machines supporting setreuid().

but why not just untaint and make your open call safe?

--shmem

_($_=" "x(1<<5)."?\n".q·/)Oo.  G°\        /
                              /\_¯/(q    /
----------------------------  \__(m.====·.(_("always off the crowd"))."·
");sub _{s./.($e="'Itrs `mnsgdq Gdbj O`qkdq")=~y/"-y/#-z/;$e.e && print}