I am trying to find the correct reason for the stated question. My understanding is that:
sudoneeds to read the
/etc/sudoersfile which is only readable by root, which is why it needs to be set-UID root
suis going to create a new shell with a different real and effective UID, and needs to check the password. To check the password, it needs to read
/etc/shadow, which is why it needs to be set-UID root. After checking password, it would need to call
setuid()on the forked process, and to use an arbitrary UID argument, its parent process must have root as effective UID, so this also makes another reason.
Are the above reasons correct ?