> Any setuid-root binary readable by the user works. Interesting detail. On Alpine, `/usr/bin/su` is not readable by any user, so the PoC doesn't work. I susp

> Any setuid-root binary readable by the user works. Interesting detail. On Alpine, `/usr/bin/su` is not readable by any user, so the PoC doesn't work. I suspect that the underlying issue can be exploited in other ways, but it makes me think that there's no reason for any suid binary to be world-readable.