@phnt

> At least here you can't break it by changing $PATH I think.

Well, they pass argv through, but it's not really the thing (although they are passing argv through), it's that suid is *always* a suspicious thing, and also there are not many (any?) reasons to do it like this.