A local root vulnerability in glibc

I think a lot of sudo/doas/pkexec usage could work just as well if the env wouldn't be inherited (except maybe $CWD).

please_give_me_root_capabilities_using_an_ipc(2) doesn't sound useful; to me it sounds like it would inherit all the problems of suid. AFAICT the idea behind this ipc approach would be that the process running with elevated privileges would start from a clean slate in its own environment.

There's also file capabilities, which are a sort of limited suid:

$ getcap /usr/{bin,sbin}/*
/usr/bin/mtr-packet cap_net_raw=ep
/usr/bin/ping cap_net_raw=ep

But, it does sound a bit silly if you'd need to do some IPC in order to run something like ping in a different clean context.