> Once you pick a user to start the authentication flow, it forks off a special helper that's marked setuid root so it can interact with PAM (unfortunately, arb

> Once you pick a user to start the authentication flow, it forks off a special helper that's marked setuid root so it can interact with PAM (unfortunately, arbitrary PAM modules can assume things about root credentials). Does this mean we could remove the helper's setuid mark if we know the PAM modules we need don't assume things about root credentials? Would we even need the helper then?