How complex is whack-run? A setuid binary should be sure to minimize its attack surface. It's just a quick look but when I see your shit-ton of .py files and then you say there is setuid involved it does not fill me with lots of confidence.