I like this option by far the best. I think that shipping setuid
binaries is a bad idea, generally speaking, and I think that not killing
the nmap process when a tab is closed is better than shipping a setuid
binary. What about some wrapper script that's not setuid, but that you
execute with AuthorizationExecuteWithPrivileges? It could exec nmap and
output the pid to stdout or something. Just a thought.