# As root chmod u+s /bin/busybox
The critical step here is escalating privilege . A normal user process (e.g., your current shell running as UID 1000) cannot, on its own, create a process with UID 0 (root). Only the kernel can elevate UID, and it only does so in specific, controlled ways.
In extremely misconfigured systems, a non-SUID su might not even attempt authentication (since it can't read /etc/shadow ), leading to an instant "success" that changes nothing.
A regular user runs su , but it has no authority to verify credentials or switch accounts, resulting in the "must be suid" error.
Here is the logic flow that leads to the error:
Then /bin/su becomes a standalone binary with SUID already set.
The requirement that busybox su must be SUID to work properly is not a bug or an arbitrary limitation—it is a fundamental consequence of how UNIX privilege separation works. Without SUID, a process cannot elevate its own privileges. The su command, by its very purpose, must move from a lesser-privileged user to a greater-privileged one, and SUID root is the standard, time-tested mechanism for achieving that.