diff --git a/cmd/mgmt/device/doc.go b/cmd/mgmt/device/doc.go
index 42a8873..52686b3 100644
--- a/cmd/mgmt/device/doc.go
+++ b/cmd/mgmt/device/doc.go
@@ -36,16 +36,30 @@
 The global flags are:
  -alsologtostderr=true
    log to standard error as well as files
+ -dryrun=false
+   Elides root-requiring systemcalls.
  -log_backtrace_at=:0
    when logging hits line file:N, emit a stack trace
  -log_dir=
    if non-empty, write log files to this directory
+ -logdir=
+   Path to the log directory.
  -logtostderr=false
    log to standard error instead of files
  -max_stack_buf_size=4292608
    max size in bytes of the buffer to use for logging stack traces
+ -minuid=501
+   UIDs cannot be less than this number.
+ -progname=unnamed_app
+   Visible name of the application, used in argv[0]
+ -rm=false
+   Remove the file trees given as command-line arguments.
+ -run=
+   Path to the application to exec.
  -stderrthreshold=2
    logs at or above this threshold go to stderr
+ -username=
+   The UNIX user name used for the other functions of this tool.
  -v=0
    log level for V logs
  -v23.credentials=
@@ -104,6 +118,8 @@
    Rate (from 0.0 to 1.0) to sample vtrace traces.
  -vmodule=
    comma-separated list of pattern=N settings for file-filtered logging
+ -workspace=
+   Path to the application's workspace directory.
 
 Device Install
 
diff --git a/cmd/mgmt/mgmt_v23_test.go b/cmd/mgmt/mgmt_v23_test.go
index 49bc382..3980b27 100644
--- a/cmd/mgmt/mgmt_v23_test.go
+++ b/cmd/mgmt/mgmt_v23_test.go
@@ -109,8 +109,8 @@
 		binStagingDir,
 		"v.io/x/ref/services/mgmt/device/deviced",
 		"v.io/x/ref/security/agent/agentd",
-		"v.io/x/ref/services/mgmt/suidhelper",
-		"v.io/x/ref/services/mgmt/inithelper")
+		"v.io/x/ref/services/device/suidhelper",
+		"v.io/x/ref/services/device/inithelper")
 
 	appDName := "applicationd"
 	devicedAppName := filepath.Join(appDName, "deviced", "test")
diff --git a/cmd/mgmt/suid_test.sh b/cmd/mgmt/suid_test.sh
index ea320e2..9467ae1 100755
--- a/cmd/mgmt/suid_test.sh
+++ b/cmd/mgmt/suid_test.sh
@@ -57,8 +57,8 @@
   APPLICATIOND_BIN="$(shell_test::build_go_binary 'v.io/x/ref/services/application/applicationd')"
   APPLICATION_BIN="$(shell_test::build_go_binary 'v.io/x/ref/services/application/application')"
   AGENTD_BIN="$(shell_test::build_go_binary 'v.io/x/ref/security/agent/agentd')"
-  SUIDHELPER_BIN="$(shell_test::build_go_binary 'v.io/x/ref/services/mgmt/suidhelper')"
-  INITHELPER_BIN="$(shell_test::build_go_binary 'v.io/x/ref/services/mgmt/inithelper')"
+  SUIDHELPER_BIN="$(shell_test::build_go_binary 'v.io/x/ref/services/device/suidhelper')"
+  INITHELPER_BIN="$(shell_test::build_go_binary 'v.io/x/ref/services/device/inithelper')"
   DEVICEMANAGER_BIN="$(shell_test::build_go_binary 'v.io/x/ref/services/mgmt/device/deviced')"
   DEVICE_BIN="$(shell_test::build_go_binary 'v.io/x/ref/cmd/mgmt/device')"
   NAMESPACE_BIN="$(shell_test::build_go_binary 'v.io/x/ref/cmd/namespace')"
diff --git a/services/mgmt/suidhelper/impl/args.go b/lib/suid/args.go
similarity index 80%
rename from services/mgmt/suidhelper/impl/args.go
rename to lib/suid/args.go
index 8081a26..90e9d55 100644
--- a/services/mgmt/suidhelper/impl/args.go
+++ b/lib/suid/args.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package impl
+package suid
 
 import (
 	"bytes"
@@ -14,10 +14,9 @@
 	"strings"
 
 	"v.io/v23/verror"
-	sflag "v.io/x/ref/services/mgmt/suidhelper/impl/flag"
 )
 
-const pkgPath = "v.io/x/ref/services/mgmt/suidhelper/impl"
+const pkgPath = "v.io/x/ref/lib/suid"
 
 var (
 	errUserNameMissing = verror.Register(pkgPath+".errUserNameMissing", verror.NoRetry, "{1:}{2:} --username missing{:_}")
@@ -55,21 +54,19 @@
 )
 
 func init() {
-	setupFlags(nil)
+	setupFlags(flag.CommandLine)
 }
 
 func setupFlags(fs *flag.FlagSet) {
-	if fs != nil {
-		sflag.SetupFlags(fs)
-	}
-	flagUsername = sflag.Username
-	flagWorkspace = sflag.Workspace
-	flagLogDir = sflag.LogDir
-	flagRun = sflag.Run
-	flagMinimumUid = sflag.MinimumUid
-	flagRemove = sflag.Remove
-	flagDryrun = sflag.Dryrun
-	flagProgName = sflag.ProgName
+	const uidThreshold = 501
+	flagUsername = fs.String("username", "", "The UNIX user name used for the other functions of this tool.")
+	flagWorkspace = fs.String("workspace", "", "Path to the application's workspace directory.")
+	flagLogDir = fs.String("logdir", "", "Path to the log directory.")
+	flagRun = fs.String("run", "", "Path to the application to exec.")
+	flagProgName = fs.String("progname", "unnamed_app", "Visible name of the application, used in argv[0]")
+	flagMinimumUid = fs.Int64("minuid", uidThreshold, "UIDs cannot be less than this number.")
+	flagRemove = fs.Bool("rm", false, "Remove the file trees given as command-line arguments.")
+	flagDryrun = fs.Bool("dryrun", false, "Elides root-requiring systemcalls.")
 }
 
 func cleanEnv(env []string) []string {
diff --git a/services/mgmt/suidhelper/impl/args_darwin_test.go b/lib/suid/args_darwin_test.go
similarity index 94%
rename from services/mgmt/suidhelper/impl/args_darwin_test.go
rename to lib/suid/args_darwin_test.go
index ef8ae82..f8eeacb 100644
--- a/services/mgmt/suidhelper/impl/args_darwin_test.go
+++ b/lib/suid/args_darwin_test.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package impl
+package suid
 
 const (
 	testUserName = "_uucp"
diff --git a/services/mgmt/suidhelper/impl/args_linux_test.go b/lib/suid/args_linux_test.go
similarity index 94%
rename from services/mgmt/suidhelper/impl/args_linux_test.go
rename to lib/suid/args_linux_test.go
index 15e6b01..9e66342 100644
--- a/services/mgmt/suidhelper/impl/args_linux_test.go
+++ b/lib/suid/args_linux_test.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package impl
+package suid
 
 const (
 	testUserName = "uucp"
diff --git a/services/mgmt/suidhelper/impl/args_test.go b/lib/suid/args_test.go
similarity index 99%
rename from services/mgmt/suidhelper/impl/args_test.go
rename to lib/suid/args_test.go
index d5c7233..5476a06 100644
--- a/services/mgmt/suidhelper/impl/args_test.go
+++ b/lib/suid/args_test.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package impl
+package suid
 
 import (
 	"flag"
diff --git a/services/mgmt/suidhelper/constants/constants.go b/lib/suid/constants.go
similarity index 93%
rename from services/mgmt/suidhelper/constants/constants.go
rename to lib/suid/constants.go
index 03b93af..178603e 100644
--- a/services/mgmt/suidhelper/constants/constants.go
+++ b/lib/suid/constants.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package constants
+package suid
 
 const (
 	// fd of the pipe to be used to return the pid of the forked child to the
diff --git a/services/mgmt/suidhelper/impl/run.go b/lib/suid/run.go
similarity index 96%
rename from services/mgmt/suidhelper/impl/run.go
rename to lib/suid/run.go
index 5b50974..bedc968 100644
--- a/services/mgmt/suidhelper/impl/run.go
+++ b/lib/suid/run.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package impl
+package suid
 
 import (
 	"flag"
diff --git a/services/mgmt/suidhelper/impl/system.go b/lib/suid/system.go
similarity index 93%
rename from services/mgmt/suidhelper/impl/system.go
rename to lib/suid/system.go
index 9c90e74..de37d54 100644
--- a/services/mgmt/suidhelper/impl/system.go
+++ b/lib/suid/system.go
@@ -4,7 +4,7 @@
 
 // +build linux darwin
 
-package impl
+package suid
 
 import (
 	"encoding/binary"
@@ -14,7 +14,6 @@
 	"syscall"
 
 	"v.io/v23/verror"
-	"v.io/x/ref/services/mgmt/suidhelper/constants"
 )
 
 var (
@@ -74,7 +73,7 @@
 	}
 
 	// Make sure the child won't talk on the fd we use to talk back to the parent
-	syscall.CloseOnExec(constants.PipeToParentFD)
+	syscall.CloseOnExec(PipeToParentFD)
 
 	// Start the child process
 	pid, _, err := syscall.StartProcess(hw.argv0, hw.argv, attr)
@@ -88,7 +87,7 @@
 	}
 
 	// Return the pid of the new child process
-	pipeToParent := os.NewFile(constants.PipeToParentFD, "pipe_to_parent_wr")
+	pipeToParent := os.NewFile(PipeToParentFD, "pipe_to_parent_wr")
 	if err = binary.Write(pipeToParent, binary.LittleEndian, int32(pid)); err != nil {
 		log.Printf("Problem returning pid to parent: %v", err)
 	} else {
diff --git a/services/mgmt/suidhelper/impl/system_test.go b/lib/suid/system_test.go
similarity index 98%
rename from services/mgmt/suidhelper/impl/system_test.go
rename to lib/suid/system_test.go
index 8930612..98c3091 100644
--- a/services/mgmt/suidhelper/impl/system_test.go
+++ b/lib/suid/system_test.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package impl
+package suid
 
 import (
 	"bytes"
diff --git a/services/mgmt/sysinit/init_darwin.go b/lib/sysinit/init_darwin.go
similarity index 100%
rename from services/mgmt/sysinit/init_darwin.go
rename to lib/sysinit/init_darwin.go
diff --git a/services/mgmt/sysinit/init_linux.go b/lib/sysinit/init_linux.go
similarity index 100%
rename from services/mgmt/sysinit/init_linux.go
rename to lib/sysinit/init_linux.go
diff --git a/services/mgmt/sysinit/linux_test.go b/lib/sysinit/linux_test.go
similarity index 100%
rename from services/mgmt/sysinit/linux_test.go
rename to lib/sysinit/linux_test.go
diff --git a/services/mgmt/sysinit/service_description.go b/lib/sysinit/service_description.go
similarity index 97%
rename from services/mgmt/sysinit/service_description.go
rename to lib/sysinit/service_description.go
index 62c677f..d19f072 100644
--- a/services/mgmt/sysinit/service_description.go
+++ b/lib/sysinit/service_description.go
@@ -14,7 +14,7 @@
 	"v.io/v23/verror"
 )
 
-const pkgPath = "v.io/x/ref/services/mgmt/sysinit"
+const pkgPath = "v.io/x/ref/lib/sysinit"
 
 var (
 	errMarshalFailed   = verror.Register(pkgPath+".errMarshalFailed", verror.NoRetry, "{1:}{2:} Marshal({3}) failed{:_}")
diff --git a/services/mgmt/sysinit/sysinit.go b/lib/sysinit/sysinit.go
similarity index 100%
rename from services/mgmt/sysinit/sysinit.go
rename to lib/sysinit/sysinit.go
diff --git a/services/mgmt/inithelper/main.go b/services/device/inithelper/main.go
similarity index 98%
rename from services/mgmt/inithelper/main.go
rename to services/device/inithelper/main.go
index c9bf9e5..4916c28 100644
--- a/services/mgmt/inithelper/main.go
+++ b/services/device/inithelper/main.go
@@ -18,7 +18,7 @@
 	"fmt"
 	"os"
 
-	"v.io/x/ref/services/mgmt/sysinit"
+	"v.io/x/ref/lib/sysinit"
 )
 
 func usage() {
diff --git a/services/mgmt/suidhelper/main.go b/services/device/suidhelper/main.go
similarity index 88%
rename from services/mgmt/suidhelper/main.go
rename to services/device/suidhelper/main.go
index b36e1b8..92fc1c9 100644
--- a/services/mgmt/suidhelper/main.go
+++ b/services/device/suidhelper/main.go
@@ -14,13 +14,13 @@
 	"fmt"
 	"os"
 
-	"v.io/x/ref/services/mgmt/suidhelper/impl"
+	"v.io/x/ref/lib/suid"
 )
 
 func main() {
 	flag.Parse()
 	fmt.Fprintln(os.Stderr, os.Args)
-	if err := impl.Run(os.Environ()); err != nil {
+	if err := suid.Run(os.Environ()); err != nil {
 		fmt.Fprintln(os.Stderr, "Failed with:", err)
 		// TODO(rjkroege): We should really only print the usage message
 		// if the error is related to interpreting flags.
diff --git a/services/mgmt/device/impl/app_starting_util.go b/services/mgmt/device/impl/app_starting_util.go
index a75f4e3..76d9bed 100644
--- a/services/mgmt/device/impl/app_starting_util.go
+++ b/services/mgmt/device/impl/app_starting_util.go
@@ -22,7 +22,7 @@
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
 	vexec "v.io/x/ref/lib/exec"
-	helperconsts "v.io/x/ref/services/mgmt/suidhelper/constants"
+	"v.io/x/ref/lib/suid"
 )
 
 // appWatcher watches the pid of a running app until either the pid exits or stop()
@@ -92,10 +92,10 @@
 // prepareToStart sets up the pipe used to talk to the helper. It must be called before
 // the app is started so that the app will inherit the file descriptor
 func (a *appHandshaker) prepareToStart(ctx *context.T, cmd *exec.Cmd) error {
-	if helperconsts.PipeToParentFD != (len(cmd.ExtraFiles) + vexec.FileOffset) {
+	if suid.PipeToParentFD != (len(cmd.ExtraFiles) + vexec.FileOffset) {
 		return verror.New(ErrOperationFailed, ctx,
 			fmt.Sprintf("FD expected by helper (%v) was not available (%v) (%v)",
-				helperconsts.PipeToParentFD, len(cmd.ExtraFiles), vexec.FileOffset))
+				suid.PipeToParentFD, len(cmd.ExtraFiles), vexec.FileOffset))
 	}
 	a.ctx = ctx
 
diff --git a/services/mgmt/device/impl/device_installer.go b/services/mgmt/device/impl/device_installer.go
index 233e1e5..a50daa5 100644
--- a/services/mgmt/device/impl/device_installer.go
+++ b/services/mgmt/device/impl/device_installer.go
@@ -57,8 +57,8 @@
 	"v.io/v23/services/application"
 
 	"v.io/x/ref/envvar"
+	"v.io/x/ref/lib/sysinit"
 	"v.io/x/ref/services/mgmt/device/config"
-	"v.io/x/ref/services/mgmt/sysinit"
 )
 
 // restartExitCode is the exit code that the device manager should return when it
diff --git a/services/mgmt/device/impl/impl_test.go b/services/mgmt/device/impl/impl_test.go
index 990223a..d8c4aee 100644
--- a/services/mgmt/device/impl/impl_test.go
+++ b/services/mgmt/device/impl/impl_test.go
@@ -45,13 +45,13 @@
 	"v.io/x/ref/envvar"
 	"v.io/x/ref/lib/mgmt"
 	"v.io/x/ref/lib/signals"
+	"v.io/x/ref/lib/suid"
 	"v.io/x/ref/services/binary/binarylib"
 	"v.io/x/ref/services/mgmt/device/config"
 	"v.io/x/ref/services/mgmt/device/impl"
 	"v.io/x/ref/services/mgmt/device/starter"
 	libbinary "v.io/x/ref/services/mgmt/lib/binary"
 	mgmttest "v.io/x/ref/services/mgmt/lib/testutil"
-	suidhelper "v.io/x/ref/services/mgmt/suidhelper/impl"
 	"v.io/x/ref/test"
 	"v.io/x/ref/test/expect"
 	"v.io/x/ref/test/modules"
@@ -106,7 +106,7 @@
 		return
 	}
 	vlog.VI(1).Infof("TestSuidHelper starting")
-	if err := suidhelper.Run(os.Environ()); err != nil {
+	if err := suid.Run(os.Environ()); err != nil {
 		vlog.Fatalf("Failed to Run() setuidhelper: %v", err)
 	}
 }
@@ -240,9 +240,9 @@
 }
 
 func ping(ctx *context.T) {
-	helperEnv := os.Getenv(suidhelper.SavedArgs)
+	helperEnv := os.Getenv(suid.SavedArgs)
 	d := json.NewDecoder(strings.NewReader(helperEnv))
-	var savedArgs suidhelper.ArgsSavedForTest
+	var savedArgs suid.ArgsSavedForTest
 	if err := d.Decode(&savedArgs); err != nil {
 		vlog.Fatalf("Failed to decode preserved argument %v: %v", helperEnv, err)
 	}
diff --git a/services/mgmt/suidhelper/impl/flag/flag.go b/services/mgmt/suidhelper/impl/flag/flag.go
deleted file mode 100644
index ee06320..0000000
--- a/services/mgmt/suidhelper/impl/flag/flag.go
+++ /dev/null
@@ -1,40 +0,0 @@
-// Copyright 2015 The Vanadium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package flag provides flag definitions for the suidhelper package.
-//
-// It does NOT depend on any packages outside the Go standard library.
-// This allows v.io/x/ref/lib/test to depend on this
-// package, thereby ensuring that the suidhelper flags are defined
-// before the flag.Parse call in testutil.init is made.
-//
-// This is a hack! This file should go away once testutil.init
-// is changed to not parse flags in init().
-// TODO(cnicolaou,ashankar): See above!
-package flag
-
-import "flag"
-
-var (
-	Username, Workspace, LogDir, Run, ProgName *string
-	MinimumUid                                 *int64
-	Remove, Dryrun                             *bool
-)
-
-func init() {
-	SetupFlags(flag.CommandLine)
-}
-
-func SetupFlags(fs *flag.FlagSet) {
-	Username = fs.String("username", "", "The UNIX user name used for the other functions of this tool.")
-	Workspace = fs.String("workspace", "", "Path to the application's workspace directory.")
-	LogDir = fs.String("logdir", "", "Path to the log directory.")
-	Run = fs.String("run", "", "Path to the application to exec.")
-	ProgName = fs.String("progname", "unnamed_app", "Visible name of the application, used in argv[0]")
-	MinimumUid = fs.Int64("minuid", uidThreshold, "UIDs cannot be less than this number.")
-	Remove = fs.Bool("rm", false, "Remove the file trees given as command-line arguments.")
-	Dryrun = fs.Bool("dryrun", false, "Elides root-requiring systemcalls.")
-}
-
-const uidThreshold = 501