In other words, given the mechanism we have now in the various BSDs,
   EVERY SETUID PROGRAM SHOULD BEGIN WITH:
   
   	seteuid(getuid());



i completely agree with this.  i'd just like to note that it doesn't stop
buffer overflow attacks as the "shell code" can just call setuid(0) before
it calls exec....