You said it yourself. LD_LIBRARY_PATH, and a myriad other knobs. Think of all the stuff you can do: mess with filehandles, signal handlers, chroot, resource li

You said it yourself. LD_LIBRARY_PATH, and a myriad other knobs. Think of all the stuff you can do: mess with filehandles, signal handlers, chroot, resource limits, seccomp, capabilities, program arguments... and more appear over time. You can't defend yourself from things that didn't exist at the time the code was written. Polkit recently got exploited this way: https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034 https://blog.qualys.com/vulnerabilities-threat-research/2022... Putting it on a socket is a good way to make sure the client has no control over the environment.