make sure privileges cannot be restored after setuid