# this is known and intentional bubblewrap: setuid-binary usr/bin/bwrap 4755 root/root