SUID Disabler and Permission Hardener

Likely, no as the package manager would give it back the setuid bit.

Create a list of all current setuid and setgid binaries before running this and then you can just give the setuid/setgid bit back to them.

A list of all setuid and setgid binaries can be gotten by running

find / -type f \( -perm -4000 -o -perm -2000 \)

Assuming you haven’t given the binary the required capabilities, it will not work. Some binaries like su will pretend to work but then always give a permission denied error.

We can create a list of common setuid and setgid binaries that are usually found on a system and remove their setuid/setgid bits individually. This way, we have a lot more control over what happens but there may be certain binaries that slip past.

Not that I know of.

The Arch Wiki has a page on this that may be useful.

https://wiki.archlinux.org/index.php/Capabilities

1 Like