Maybe redshift is setuid or it gets blocked by apparmor or selinux? You can check audit.log for the latter.