http://linux-pam.org/Linux-PAM-html/sag-pam_exec.html I would further assume pam_exec ignores SUID bit on binaries either because of a bug or deliberately because there is no good reason to ever do that.