SUSE moves to disable setuid binaries across the whole Linux system
The SUSE security team is working to disable setuid system-wide, a measure that still faces obstacles, according to the LWN article on Thorsten Kukuk's talk at All Systems Go! 2026.
Source: Os esforços da SUSE para desativar setuid em todo o sistema (lwn.net). Text prepared with AI from this source.
What happened and what to do
According to the LWN article, the SUSE security team is working to disable setuid binaries across the whole Linux system. SUSE already forbids including setuid or setgid binaries in packages unless they have been reviewed and explicitly authorized. Thorsten Kukuk wants to go further and prohibit them entirely, and spoke about this work and some remaining obstacles at All Systems Go! 2026.
In practice, a company running Linux distributions can start with a continuous inventory of every binary carrying setuid and setgid bits across images, containers and servers, compared against an approved exception list. A build pipeline can block new packages with those bits that lack review, and a production monitor can alert on any file that gains the bit after deployment. Each exception can then be handled case by case, replacing the privilege with capabilities, separately privileged services or mediation through systemd and polkit, as appropriate.
How the consultancy can help
Diagnosis of the setuid and setgid binary exposure in the client's images, packages and servers, with exceptions prioritized. Then we implement build gates, continuous monitoring and a migration plan to remove unnecessary privileges, operated on the client's infrastructure.
Next step
If your organization maintains Linux images, packages or servers and wants to reduce the risk from privileged binaries, send a short description of your environment and what is already controlled today. We will reply with a scoped proposal for diagnosis and implementation.
Let's assess your project
I reply with scope and a proposal.