Finding and Replacing setuid Binaries on Linux

SUSE is working to disable setuid binaries system-wide. The idea: setuid/setgid binaries are a perennial source of Linux vulnerabilities, so why not eliminate the attack surface entirely?

They already forbid setuid in packages unless explicitly reviewed. Now Thorsten Kukuk is pushing to disable them at the kernel/distribution level via capabilities instead.

The practical part

First, audit what you have:

find / -perm -4000 -type f 2>/dev/null

You'll see things like /usr/bin/sudo, /usr/bin/passwd, /usr/bin/su, /bin/ping. Some of these have capability-based replacements now:

• ping → cap_net_raw (already done in most distros)
• su / sudo → PAM + capabilities
• passwd → PAM

What to do

1. Run the find command above
2. For each binary, check if your distro has a capability-based alternative
3. Where possible, replace the setuid binary with a capability wrapper
4. Watch your distro's efforts — SUSE, Fedora, and others are moving this direction

The goal isn't to break your system. It's to shrink the setuid attack surface one binary at a time. Start with the easy wins like ping (already capability-based on modern systems) and work from there.

If you run containers, this matters even more — fewer setuid binaries in your base image means less privilege escalation risk if something breaks out.

---

Small hardening steps compound. This is one of them.