# SUSE engineer pushes to disable setuid binaries system-wide on Linux

> **Key takeaway:** SUSE's Thorsten Kukuk is working to eliminate setuid and setgid binaries entirely from Linux systems, building on SUSE's existing policy of requiring explicit security review for such binaries.

**Published:** 2026-10-20T18:36:10+00:00 
**Source:** Linux Weekly News (LWN.net) 
**Category:** kernel-os 
**Canonical URL:** https://fosswire.org/news/suse-engineer-pushes-to-disable-setuid-binaries-system-wide-.html 

## Summary
At the 2026 All Systems Go! conference, SUSE engineer Thorsten Kukuk presented his efforts to disable setuid and setgid binaries system-wide. SUSE already forbids these binaries in packages unless explicitly reviewed and approved. Kukuk aims to extend this to a complete prohibition, though significant technical hurdles remain. Setuid binaries have historically been a persistent source of security vulnerabilities on Linux systems.

## What replacing setuid involves
- SUSE currently requires explicit security review and approval for any setuid or setgid binary in packages
- Kukuk's goal is to move from package-level restrictions to system-wide elimination
- The talk identified remaining technical hurdles to achieving this, though specific obstacles were not detailed in the source
- Setuid binaries allow a program to run with the privileges of its owner rather than the calling user, creating privilege escalation risks

## Why it matters
If successful, this would represent a fundamental shift in Linux security architecture, potentially eliminating an entire class of privilege escalation vulnerabilities that have plagued systems for decades. Other distributions would likely face pressure to evaluate similar restrictions.