> which means that it's tricky for such a program to be able to safely use system() without allowing for a security hole of using the privileged program to run

> which means that it's tricky for such a program to be able to safely use system() without allowing for a security hole of using the privileged program to run another arbitrary program as root. Not entirely and this is what the post mentions. That compromise of the program calling systemd("sudo <...>") does not necessarily lead to full blown privilege escalation, because the sudoers file can be crafted into letting sudo run pre-specied privileged programs including pre-specified arguments. Also the compromised system caller will not be able to use poisoned environmental variables to influence the privileged program ran by sudo because sudo wipes the environmental variables by default, before running the privileged program.