One thing that made this take significantly longer than it might have otherwise is that we have to keep PWD "up to date" - otherwise we hit bugs in glibc's getcwd() implementation.
It still needs to be made setuid.