`setuid` and `setgid` global options should be overridable, and should probably not default to root.