whack-run is a separate C binary for this very reason:

https://github.com/mwilliamson/whack-run

Whack itself is run with normal privileges.