Remove setuid bit from files

Daniel Pewzner

• September 13, 2026 03:09

Hello,

I would like to remove all unnecessary setuid bits from files on an AlmaLinux 8 cPanel server. Has anyone gone through the list and done so already? I don't want to trigger cPanel errors. Below is a list of files I think I might be able to remove the setuid bit on, on the server. Thanks for any help, Dan

-rwsr-xr-x root root /usr/bin/at
-rwsr-xr-x root root /usr/bin/chage
-rws--x--x root root /usr/bin/chfn
-rwsr-xr-x root root /usr/bin/fusermount3
-rwsr-xr-x root root /usr/bin/gpasswd
-rwsr-xr-x root root /usr/bin/mount
-rwsr-xr-x root root /usr/bin/newgrp
-rwsr-xr-x root root /usr/bin/pkexec
-rwsr-xr-x root root /usr/bin/quota
---s--x--x root root /usr/bin/sudo
-rwsr-xr-x root root /usr/bin/umount
-rwsr-x--- root dbus /usr/libexec/dbus-1/dbus-daemon-launch-helper
-rwsr-xr-x root root /usr/lib/polkit-1/polkit-agent-helper-1
-rwsr-xr-x root root /usr/sbin/usernetctl

• 

  cPRex Jurassic Moderator

  • September 14, 2026 13:41

  Hey there!  I think the better question here is what exactly are you trying to achieve by making this change?

  0
• 

  Daniel Pewzner

  • September 14, 2026 16:02

  Limit exposure to security issues.

  0
• 

  cPRex Jurassic Moderator

  • September 14, 2026 16:32

  It's important to note that none of these packages are managed by cPanel, although we certainly do use them internally.  We don't test things that deviate from the official operating system structure, so I honestly can't say for sure what, if anything, may happen.  I have two general thoughts on this type of work:

  -You'll have to try it.  There really isn't a way to know for sure if it will affect your system without manual testing, and
  -Since these files are all part of operating system packages, your changes could ultimately be reset at any time as part of a system update.

  0
• 

  Daniel Pewzner

  • September 14, 2026 16:51

  Thanks for getting back to me.
  Do you think I should request a new feature? Something like "harden cPanel by removing unnecessary setuid bits"? Or at least have the security scripts just email admins with details of that?

  It seems to me, given the rather large uptick in security issues, that that would be a good idea. On my non-cPanel servers I always remove every setuid bit I can. Then have a script check over things upon dnf updates.

  Thanks again, Dan

  0
• 

  cPRex Jurassic Moderator

  • September 14, 2026 17:16

  It never hurts to make a feature request - I get the request, talk to the team about it, and we go from there.  I honestly don't know what they'd say about this specific one.

  I'd go ahead and submit it and I'll mention it came from a Forums user.

  0

Please sign in to leave a comment.