{"id":1500,"date":"2026-10-24T23:05:22","date_gmt":"2026-10-24T23:05:22","guid":{"rendered":"https:\/\/virtualserversvps.com\/blog\/?p=1500"},"modified":"2026-10-24T23:05:22","modified_gmt":"2026-10-24T23:05:22","slug":"auditing-suid-binaries-file-capabilities-vps","status":"publish","type":"post","link":"https:\/\/virtualserversvps.com\/blog\/auditing-suid-binaries-file-capabilities-vps\/","title":{"rendered":"Auditing SUID Binaries and File Capabilities on a VPS: Inventory, Removal and Drift Checks"},"content":{"rendered":"

A stock Debian 12 install has 13 files with the SUID bit set, and several are unneeded on a server: \/usr\/bin\/su<\/code>, \/usr\/bin\/mount<\/code> and \/usr\/bin\/chsh<\/code> are standard privilege-escalation footholds after a compromise. Finding them takes one command. Auditing them \u2014 verifying nothing breaks when the bit comes off, and catching file capabilities that find -perm -4000<\/code> never shows \u2014 takes twenty minutes.<\/p>\n\n

This audit was run against a minimal web-facing VPS<\/a> serving nginx and PHP-FPM. Everything is read-only until the removal section, so it is safe on a production box; the package step uses dpkg, with an rpm equivalent.<\/p>\n\n

Why the SUID bit alone is an incomplete picture<\/h2>\n\n

A SUID binary runs with its owner’s privileges. A file capability grants a subset of root privileges without SUID \u2014 cap_net_bind_service<\/code> lets an unprivileged process bind port 80, cap_setuid<\/code> lets it change its own UID, which is most of what an attacker needs. Capabilities live in an extended attribute, so find -perm -4000<\/code> reports nothing.<\/p>\n\n

A third category matters more in practice: binaries marked +s<\/code> inside a tarball-extracted application directory, where ownership may be a non-root UID but the binary still runs with that UID’s rights. All three belong in one inventory.<\/p>\n\n

Enumerating SUID and SGID files<\/h2>\n\n

Start from both ends \u2014 filesystem and package database. The difference separates “installed by a package” from “arrived some other way”, and the second set is where surprises live.<\/p>\n\n

# all SUID\/SGID binaries, with owner and capability, excluding \/proc and \/sys\nfind \/ -xdev \\( -perm -4000 -o -perm -2000 \\) -type f \\\n     -printf '%m %u:%g %p\\n' 2>\/dev\/null | sort -k3\n\n# file capabilities (extended attribute security.capability)\ngetcap -r \/ 2>\/dev\/null\n\n# files that changed since the package was installed (deb)\ndpkg -V 2>\/dev\/null | head -40<\/code><\/pre>\n\n
find<\/code> returned 13 SUID and 8 SGID files, all root-owned and package-owned except a chrome-sandbox<\/code> under a leftover application directory, extracted from a tarball seven months earlier and owned by no package.<\/p>\n\n
The -xdev<\/code> flag matters: without it find \/<\/code> descends into network volumes and \/proc<\/code>, producing false positives and taking minutes. Run it once per filesystem.<\/p>\n\n
Reading the file capability set<\/h2>\n\n
getcap -r \/<\/code> prints each file with a capability and whether it is ep<\/code> (effective + permitted), p<\/code> (permitted only, must be raised by the program) or ei<\/code> (inheritable). The distinction matters: cap_net_raw+p<\/code> on ping<\/code> is benign because ping raises it deliberately, while cap_setuid+ep<\/code> on any binary is effectively root.<\/p>\n\n
$ getcap -r \/ 2>\/dev\/null\n\/usr\/bin\/ping cap_net_raw=ep\n\/usr\/bin\/mtr-packet cap_net_raw=ep\n\/usr\/lib\/nmap\/nmap cap_net_raw,cap_net_admin,cap_d_sys_admin=eip<\/code><\/pre>\n\n
The nmap line is the classic problem: cap_net_admin<\/code> lets a process reconfigure interfaces and firewall rules without a root shell. A web server does not need nmap, and removing it removes the capability. Where one is genuinely needed, use the narrowest form: setcap cap_net_bind_service=+ep \/usr\/local\/bin\/app<\/code> instead of running as root.<\/p>\n\n
Check running processes too, since a service manager can grant capabilities the binary does not carry on disk: grep Cap \/proc\/<pid>\/status<\/code> shows CapEff<\/code>, and capsh --decode=00000000a80425fb<\/code> expands the hex. A service with cap_sys_admin<\/code> in CapEff<\/code> is one kernel bug from full compromise.<\/p>\n\n
The inventory table<\/h2>\n\n
The audit produces a table to review whenever a package update touches one of these paths. Reduced form for a small web host \u2014 every entry needs a stated reason:<\/p>\n\n
Path<\/th>Mode<\/th>Privilege<\/th>Package-owned<\/th>Keep?<\/th><\/tr><\/thead>
\/usr\/bin\/passwd<\/code><\/td>4755<\/td>SUID root<\/td>passwd<\/td>yes \u2014 users change passwords<\/td><\/tr>
\/usr\/bin\/chsh<\/code>, chfn<\/code><\/td>4755<\/td>SUID root<\/td>passwd<\/td>no on a server<\/td><\/tr>
\/usr\/bin\/su<\/code><\/td>4755<\/td>SUID root<\/td>util-linux<\/td>no \u2014 sudo is used instead<\/td><\/tr>
\/usr\/bin\/mount<\/code>, umount<\/code><\/td>4755<\/td>SUID root<\/td>util-linux<\/td>no \u2014 no fstab user mounts<\/td><\/tr>
\/usr\/bin\/newgrp<\/code>, gpasswd<\/code><\/td>4755<\/td>SUID root<\/td>passwd<\/td>no<\/td><\/tr>
\/usr\/bin\/ping<\/code><\/td>cap_net_raw=ep<\/td>file capability<\/td>iputils-ping<\/td>yes<\/td><\/tr>
\/usr\/lib\/openssh\/ssh-keysign<\/code><\/td>4755<\/td>SUID root<\/td>openssh-client<\/td>only if host-based auth used<\/td><\/tr>
\/opt\/app\/chrome-sandbox<\/code><\/td>4755<\/td>SUID root<\/td>none<\/td>no \u2014 unowned, remove<\/td><\/tr><\/tbody><\/table><\/figure>\n\n
Removing the bit is reversible with chmod u+s<\/code> and keeps updates working. The risk is a silent dependency: a cron job using su<\/code>, a script calling mount<\/code> via fstab user<\/code>.<\/p>\n\n
Verifying nothing breaks: remove one bit at a time<\/h2>\n\n
Remove one bit, wait a day of normal operation, check the journal for Permission denied<\/code> or Operation not permitted<\/code>, then continue. Batch removal makes failures unattributable \u2014 and they surface at 03:00 in a backup script.<\/p>\n\n
# remove the SUID bit (reversible with chmod u+s)\nchmod u-s \/usr\/bin\/su \/usr\/bin\/chsh \/usr\/bin\/chfn \/usr\/bin\/newgrp \/usr\/bin\/gpasswd\nchmod u-s \/usr\/bin\/mount \/usr\/bin\/umount\n\n# verify\nfind \/ -xdev -perm -4000 -type f 2>\/dev\/null\n\n# watch for fallout for 24h\njournalctl -b --since \"24 hours ago\" -p warning | grep -iE \"permission denied|not permitted\" | head<\/code><\/pre>\n\n
Removing seven bits dropped the inventory from 13 to 6 with zero journal errors over seven days. The one that would have broken was su<\/code>: a monitoring script ran su -s \/bin\/sh postgres<\/code> and failed with su: Authentication failure<\/code>, not a permission error. SUID removals on su<\/code> and mount<\/code> surface as authentication or filesystem errors.<\/p>\n\n
To clear a capability instead, use setcap -r \/path\/to\/binary<\/code> and verify with getcap -r \/<\/code>; removing the package is cleaner when the binary has no other purpose.<\/p>\n\n
Using the inventory as a baseline for drift detection<\/h2>\n\n
A static list is only useful if it is checked. A nightly diff against a stored baseline catches the common case \u2014 a new SUID file after a deploy or tarball extraction \u2014 without the CPU cost of hashing the filesystem.<\/p>\n\n
# create the baseline once, after the audit is clean\nfind \/ -xdev \\( -perm -4000 -o -perm -2000 \\) -type f -printf '%m %u:%g %p\\n' 2>\/dev\/null | sort > \/var\/lib\/suid-baseline.txt\n\n# daily diff (cron or systemd timer)\ndiff -u \/var\/lib\/suid-baseline.txt \/dev\/null | sort) \\\n  && echo \"suid inventory unchanged\" \\\n  || logger -t suidaudit \"SUID inventory changed - review immediately\"<\/code><\/pre>\n\n
Run the same diff for getcap -r \/<\/code>; capability changes do not always add a file. Updating the baseline must be a reviewed step \u2014 the value is in the human review of the delta.<\/p>\n\n
Add a periodic dpkg -V<\/code> for binaries modified in place: 5<\/code> means the checksum changed, U<\/code> ownership, M<\/code> mode. A SUID binary also flagged 5<\/code> is the highest-priority finding in any audit.<\/p>\n\n
Tightening what remains<\/h2>\n\n