---
title: "HOST-FS-016 SUID or SGID Programs Outside the Known Baseline"
canonical: https://openvapt.com/checks/HOST-FS-016.html
html: https://openvapt.com/checks/HOST-FS-016.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-FS-016 SUID or SGID Programs Outside the Known Baseline

Lists set-user-ID and set-group-ID programs in the system binary directories that are not on the documented baseline of what distributions ship.

- Domain: Server
- Severity: Medium
- Control category: Access Control
- Fix effort: medium
- CVSS v3.1 vector: `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N`
- CIS Controls v8: 4.1
- NIST CSF 2.0: PR.PS-01
- CWE: CWE-250
- NIST SP 800-53 Rev. 5: AC-6, CM-7
- Benchmark topic: Audit SUID and SGID executables (CIS Controls v8 4.1) (topic only, no benchmark text)

## Why It Matters

Every SUID program is a door into another account, usually root. Programs such as nmap, vim, find, python or a custom helper with the SUID bit are a known route to instant root; the fewer unexplained SUID programs, the smaller that door.

## How It Detects

Walks /bin, /sbin, /usr/bin, /usr/sbin, /usr/libexec and /usr/lib (metadata only, up to 20000 files per tree, symlinks not followed), keeps files with the SUID or SGID bit, and reports those whose file name is not in the baseline list kept in this check's source (passwd, sudo, su, mount, ping, ssh-keysign and about forty others). An empty inventory is reported as incomplete.

## How to Fix

For each listed program decide whether the bit is needed. Remove it with  chmod u-s,g-s <path>  or uninstall the package. Record the ones you keep so the next review is quick. Caution: programs such as passwd, sudo, su, mount and ping need their bit to work for normal users; removing it from those breaks password changes and administrator access.

## How to Verify

```
find /bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/lib -xdev -type f -perm /6000  and compare with your record.
```

## Learn the Theory

- [P1 Linux Server Hardening](https://openvapt.com/academy/p1.md)
- [P17 Kernel, Filesystem and Boot Hardening](https://openvapt.com/academy/p17.md)

## References

- [MITRE ATT&CK T1548.001, Setuid and Setgid](https://attack.mitre.org/techniques/T1548/001/)
- [NIST SP 800-123, Guide to General Server Security](https://csrc.nist.gov/pubs/sp/800/123/final)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/files_mounts.go

Run it: `openvapt scan --only HOST-FS-016`. Read it offline: `openvapt explain HOST-FS-016`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-FS-016.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.