Privileges are not dropped on user specified program invocation.
vulners.com/securityvulns/securityvulns:doc:6761