How can I require root privileges for invoking 'gpio' from WiringPi?

Question

I removed my user from the gpio group, logged out and back in. I can still run e.g. gpio write 25 1.

I see from this answer how the memory mapping and permissions changed between Jessie and Stretch, but the instructions for leaving the gpio group did not seem to work. I asked on IRC, and someone told me that WiringPi now uses "set uid" for the permission structure, and I see that mentioned on the WiringPi website here:

The gpio command is designed to be installed as a setuid program and called by a normal user without using the sudo command or logging in as root.

Am I going to have to compile WiringPi from source in order to change this behaviour?

$ lsb_release -a
Distributor ID: Raspbian
Description:    Raspbian GNU/Linux 10 (buster)
Release:    10
Codename:   buster

$ gpio -v
gpio version: 2.50
Copyright (c) 2012-2018 Gordon Henderson
This is free software with ABSOLUTELY NO WARRANTY.
For details type: gpio -warranty

Raspberry Pi Details:
  Type: Pi 3, Revision: 02, Memory: 1024MB, Maker: Unknown05 
  * Device tree is enabled.
  *--> Raspberry Pi 3 Model B Rev 1.2
  * This Raspberry Pi supports user-level GPIO access.

Answer 1

Installing WiringPi from the official Raspbian repositories (on Stretch or later, I believe) will create an executable file at /usr/bin/gpio.

• By default, the owner of the file is root, i.e. 0, and the group is root, i.e. 0.
• By default, the permissions on the file is 4755. The interesting part of this is the 4, which is the setuid bit. It enables executables to be run with the same privileges as the file's owner, in this case 0, or root.

I fixed the problem simply by removing the setuid bit with chmod 0755 $(which gpio). GPIO can now only be controlled by the root user, even if a user is a member of the gpio group. Considering that there are other groups like i2c and spi, I'm not sure if this completely mitigates security problems.

I wish the gpio group could enable/disable GPIO control for users.