SUID (set user ID)

What is SUID (set user ID)?#

When the SUID bit is set on an executable, the process runs with the file owner's effective UID. In ls -l it shows as an s in the owner-execute position, e.g. -rwsr-xr-x. Legitimately, this lets unprivileged users perform privileged actions safely (e.g. passwd updating /etc/shadow).

Why LinPEAS checks suid#

LinPEAS lists SUID (and SGID) binaries and cross-references them against known abuse techniques. If a SUID-root binary can be made to run arbitrary commands, read/write arbitrary files, or spawn a shell, it becomes a root escalation — a textbook Linux privilege-escalation vector.

What a normal configuration looks like#

A base system has a known set of SUID-root binaries: passwd, sudo, su, mount, ping and a few others. These are expected. The risk comes from non-standard SUID binaries or standard ones with known abuse paths.

Why it can be security-sensitive#

Custom SUID scripts/binaries, or standard tools that can break out (many listed on GTFOBins — find, nmap (old), vim, bash with -p, cp, tar, etc.), let a normal user execute code as root. A SUID binary that calls another program by relative name can also be hijacked via PATH.

How to check it manually#

Run these read-only commands to inspect this area yourself and validate what LinPEAS reports:

find / -perm -4000 -type f 2>/dev/null

ls -l $(find / -perm -4000 -type f 2>/dev/null)

find / -perm -4000 -type f 2>/dev/null | sort > suid.txt

Defensive remediation#

• Remove the SUID bit from anything that doesn't need it: chmod u-s <file>.
• Never set SUID on shell scripts or on interpreters/tools that can spawn shells.
• Keep a baseline of expected SUID binaries and alert on changes.
• Prefer Linux capabilities or sudo rules over broad SUID where possible.