auth_pam_tool should be suid user, 4777.

Since 9d18b624675 this is done by packaging auth_pam_tool already with correct permissions into the rpm.

For example,

$ rpm -qvlp MariaDB-server-10.5.10-1.el8.x86_64.rpm|grep -w auth_pam_tool

...

-rwsr-xr-x 1 root root  12480 May 6 10:29 /usr/lib64/mysql/plugin/auth_pam_tool_dir/auth_pam_tool

same for Fedoras.

But on CentOS 7 it shows rwxr-xr-x. Supposedly rpmbuild strips the SUID bit before packaging the file.