a root-owned set-uid program allows a normal user to gain the root privilege while executing the program. what prevents the user from doing bad things using the privilege?