freebsd stable - May 2008 - /usr/bin/ksu and missing suid bit

Greetings,

What the reason /usr/bin/ksu to be without setuid bit?
Are there any security concerns?
I'm asking because the only way to get ksu working is adding by hand the 
suid bit.
For example when you install heimdal from ports it activate the setuid 
bit on $prefix/bin/su.

And my second question - is there a option that I can define in src.conf 
or make.conf, next time when I build/installworld
ksu to have setuid bit ? (in manual I found only knobs for disabling 
kerberos)

-- 

Best Wishes,
Stefan Lambrev
ICQ# 24134177

On Sat, May 10, 2008 at 06:18:46PM +0300, Stefan Lambrev
wrote:
> ...
> And my second question - is there a option that I can define in src.conf 
> or make.conf, next time when I build/installworld
> ksu to have setuid bit ? (in manual I found only knobs for disabling 
> kerberos)
Define ENABLE_SUID_K5SU to be true.

Ref. the stanza from /usr/share/examples/etc/make.conf:

# Kerberos 5 su (k5su)
# If you want to use the k5su utility, define this to have it installed
# set-user-ID.
#ENABLE_SUID_K5SU
Peace,
david
-- 
David H. Wolfskill				david@catwhisker.org
I submit that "conspiracy" would be an appropriate collective noun for
cats.

See http://www.catwhisker.org/~david/publickey.gpg for my public key.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
Url :
http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20080510/a0d2e64c/attachment.pgp