not setuid or run by malicious user - no -T necessary