# ScrapLinux - busybox per-applet SUID policy (busybox.conf(5) format).
# busybox itself is one setuid-root binary once packaged; this file is what
# keeps that from handing root to everything it can run. Every applet that
# busybox's own source marks BB_SUID_MAYBE (checked at build time: currently
# ping, traceroute, findfs, mount) needs a line here - one left unlisted
# stays fully root for any caller, since BB_SUID_MAYBE means busybox never
# drops the privilege on its own.
#
# Must stay mode 600, owned root:root - busybox refuses to read this file
# otherwise (see parse_config_file() in libbb/appletlib.c).

[SUID]
ping      = sx- root.wheel
traceroute = --- root.root
findfs    = --- root.root
mount     = --- root.root