rpmgrill has a setxid whitelist, as seen here: https://github.com/default-to-open/rpmgrill/blob/master/lib/RPM/Grill/Plugin/Setxid.pm#L37

ksu is not on the whitelist, which causes the failure seen in bodhi:

            {
               "arch" : "armv7hl,x86_64",
               "code" : "UnauthorizedSetxid",
               "context" : {
                  "path" : "/usr/bin/ksu"
               },
               "diag" : "File <var>/usr/bin/ksu</var> is setuid root but is not on the setxid whitelist.",
               "subpackage" : "krb5-workstation"
            }

ksu has been setuid since 2005 (when package git history starts) and probably since 1996 (when the rpm history begins).

In investigating, I was unable to find out where the whitelist actually lives. Since there isn't one here, and I assume we're not just flagging every setuid binary in the distro with this test (right?), I'm opening this ticket in the hopes that you'll know where the whitelist is, or the proper procedure for adding to it.

Thanks!