So you just need a static setuid binary and it will all be fine. Too bad su isn't static, despite my best efforts on behalf of my own su. So I'll just shut up.