tightening root program modes

[Matthew Patton <matthew.patton@ra.pae.osd.mil>]

Some of you may have seen the little thread on smtp(fwd)d being mode 500
and why. The question is:

Does it make any sense (or even worth our while) to mark all programs
that only root can possibly execute as mode 500 instead of the default
555? Yes, any program that gains increased security by virtue of going
500 is need of a rewrite. However, if only root is supposed to be
running it, why even pretend that others can?

If touching root programs is not considered useful, what to do about
smtpd and friends? Let it's currently unique situation continue? Or
bring it into compliance with the rest of the system?