> The /system partition is now mounted nosuid for zygote-spawned processes, preventing Android applications from executing setuid programs. This reduces root attack surface and likelihood of potential security vulnerabilities. Well, that sounds great. It's almost like they're trying even harder to prevent people from having control over their device.
Well, there is a problem - root exploits give people control of their device, but are also, by definition, a security hole which can be exploited by malicious apps to break the sandboxing and do bad things (tm). The right solution to the issue of user control is to convince manufacturers (which many already do) to make their devices open without needing exploits, not purposefully making the OS less secure.
Android 4.3 now includes Digital Restrictions Management framework. In order to prevent users from accessing their data (or running apps) in a ways they're not allowed (copying files, advertisement blocking, tethering and so on), Google (and vendors) certainly wouldn't like users to have unrestricted access to their phones.
I really think tightening security with nosuid and SELinux is at least partially due to DRM introduction.