hardening: setuid files: initial revamp