main/krb5: allow suid bins