Currently setting up xpra, which wants to run an X instance as non-root using the dummy driver, but the system Xorg binary is SUID. Since the system auto-updates, I would prefer not making and maintaining a non-SUID copy of the binary. I'm also trying to avoid using a hack like copy-execute-delete, e.g. in the tmp directory (would prefer to make it a clean one-liner, which I instinctively believe should be possible, though there may be some subtle security hole this capability would open). Symlinks would be acceptable, though AFAIK they don't provide permission bit masking capabilities.
My current best solution is a nosuid bind mount on the bin directory, which seems to do the trick, but as above I'd still prefer a solution that doesn't leave crunk in my system tree/fstab (e.g. some magic environment variable that disables suid the same way a nosuid mount does, or some commandline execute jutsu that bypasses the suid mechanism).