[$] SUSE's efforts to disable setuid system-wide (lwn.net)
<p>Setuid (and setgid) binaries have long been a source of headaches, and security
vulnerabilities, on Linux systems. They are largely seen as something to be
avoided; SUSE's security team, for example, <a
href="https://en.opensuse.org/openSUSE:Package_security_guidelines#Setuid_Binaries">forbids
the inclusion of setuid or setgid binaries in packages</a> unless they have been
reviewed and explicitly allowed. Thorsten Kukuk wants to go a step further and
disallow them entirely. At the <a
href="https://all-systems-go.io/">2026 All Systems Go!</a> conference, he spoke
about his work to disable setuid system-wide, as well as some of the hurdles
that remain.</p>
vulnerabilities, on Linux systems. They are largely seen as something to be
avoided; SUSE's security team, for example, <a
href="https://en.opensuse.org/openSUSE:Package_security_guidelines#Setuid_Binaries">forbids
the inclusion of setuid or setgid binaries in packages</a> unless they have been
reviewed and explicitly allowed. Thorsten Kukuk wants to go a step further and
disallow them entirely. At the <a
href="https://all-systems-go.io/">2026 All Systems Go!</a> conference, he spoke
about his work to disable setuid system-wide, as well as some of the hurdles
that remain.</p>
Comments