Why is setting the SUID bit on a text editor like nano a serious security hole?

nano is owned by root, so with SUID it always runs as root: any user who can start it can read and change every file on the system, which is a permanent root backdoor.

* With SUID, nano runs as UID 0 for everyone, so every protected file is open. *

The scenario: bob needs one protected file, so instead of changing that file's permissions someone runs sudo chmod u+s /bin/nano. It works, but far too well. Now every user's nano runs with UID 0, and the file permissions no longer protect anything:

cat  /etc/shadow                  # permission denied
nano /etc/shadow                  # opens: change root's password hash
nano /root/.ssh/authorized_keys   # add your own key, log in as root over SSH
nano /etc/sudoers                 # give yourself full sudo

An attacker who only gets an unprivileged account can then take over the whole machine whenever they like. This is a privilege escalation path, and it stays open until someone notices.

Lessons:

• Grant access to the file (ownership, group, mode), never to a general-purpose program.
• SUID is only safe on small programs built for it, like passwd, that check exactly what the caller may do.
• Audit with find / -perm -4000 -type f and remove what does not belong (chmod u-s). GTFOBins lists the binaries that become root shells when they have SUID.

Go deeper:

• GitHub gist: How to use setuid to install a root backdoor — the exact attack, step by step.
• GTFOBins: nano — how nano becomes a root shell or file writer when it has SUID or sudo.