Apparently, the intended solution was "umask 0", convince the setuid program to create /etc/ld.so.preload, then overwrite that file to load shared libraries of your choosing into all programs.
Of course, I totally missed this solution, and went for the pwn instead :)