Re: su changes in snapshot?

["Todd C. Miller" <Todd.Miller@courtesan.com>]

Either /usr/libexec/auth/login_krb4-or-pwd does not exist or
one or more components of its path is writable by someone other
than the owner.

The checks are done via secure_path(3):
     The secure_path() function takes a path name and returns 0 if
     the path name is secure, -1 if not.  To be secure a path must
     exist, be a regular file (and not a directory), owned by root,
     and only writable by the owner (root).

 - todd