@pid_eins @mariusor And polkit still relies on a setuid binary (polkit-agent-helper-1). Of course, that could be fixed by replacing PAM.