ssh: allow setuid/setgid which are used when running as root