Comment # 23 on bug 1170443 from Stanislav Brabec

>ok, so the "s" bit was not set before on my tumbleweed installation.
>this is what i said.

It was not set in the rpm database. It was set in %post by
%set_permissions %{_bindir}/su

>> You could check your installation log. Maybe this command failed or you set
>
>where should i look for what?
>/var/log/YaST2/y2log?
Yes. Please check for possible util-linux %post failure.

>> paranoid security profile.
>
>where can i set this?

PERMISSION_SECURITY in /etc/sysconfig/security

If you did not touch it, you don't have paranoid more. In this mode, many
things don't work as most users want.

> /etc/permissions.paranoid:
> /usr/bin/su                                             root:root        
> 0755

>i only have /etc/permissions.local which only has comments, and folder >/etc/permissions.d, which only has 2 files:
>-rw-r--r-- 1 root root 214 Apr 29 21:27 postfix
>-rw-r--r-- 1 root root 126 Apr 29 21:27 postfix.paranoid

That looks strange.
If /etc/permissions.easy does not exist, it will not work.

/etc/permissions.easy is part of permissions package, and it contains line:
/bin/su                                                 root:root         4755

Please try "rpm -V permissions".