Setuid Replacement Moves the Privilege Decision. It Doesn’t Remove It.
A setuid replacement moves privilege decisions from a file mode bit into services and polkit policy. A function-by-function map from an openSUSE proof of concept, with the gaps left visible.
