Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.unix.programmer > #871

Re: Why user can change password?

Show all headers | View raw

Mateusz_madi <madi.czadi@gmail.com> writes:

> Hi, why usre cna change his pasword using passwd if he don't have
> access to /etc/shadow ?

That's an excellent question.

Some programs are allowed to run with the permissions, not of the user
who invoked the progrma, but the permissions of the user and/or group
that owns the program file. These are ‘setuid’ and ‘setgid’ permissions,
respectively.

It's common for the program to be owned by the ‘root’ user, and ‘setuid’
permission means that regardless of the user who runs the program, the
permissions of the program will instead be those of the ‘root’ user.
That's how the ‘/usr/bin/passwd’ program, for example, has permission to
write the ‘/etc/passwd’ and ‘/etc/shadow’ files that aren't writeable by
the account which starts the program.

It's a significant security risk, of course. That's why it's considered
a red flag for a program to have ‘setuid’ or ‘setgid’ permission. Be
very wary of any program which claims to require that; there are very
few legitimate reasons to require that, and the set of programs with
those permissions should be very small on any given host.

-- 
 \       “First things first, but not necessarily in that order.” —The |
  `\                                              Doctor, _Doctor Who_ |
_o__)                                                                  |
Ben Finney

Back to comp.unix.programmer | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Why user can change password? Mateusz_madi <madi.czadi@gmail.com> - 2011-06-29 02:44 -0700
  Re: Why user can change password? jt@toerring.de (Jens Thoms Toerring) - 2011-06-29 09:55 +0000
  Re: Why user can change password? Ben Finney <ben+unix@benfinney.id.au> - 2011-06-29 22:36 +1000
    Re: Why user can change password? jt@toerring.de (Jens Thoms Toerring) - 2011-06-29 15:03 +0000
  Re: Why user can change password? John Gordon <gordon@panix.com> - 2011-06-29 14:41 +0000
    Re: Why user can change password? Golden California Girls <gldncagrls@aol.com.mil> - 2011-06-29 18:42 -0700
      Re: Why user can change password? Barry Margolin <barmar@alum.mit.edu> - 2011-06-29 22:29 -0400
      Re: Why user can change password? Eric Sosman <esosman@ieee-dot-org.invalid> - 2011-06-29 22:29 -0400
      Re: Why user can change password? gordonb.h6afl@burditt.org (Gordon Burditt) - 2011-06-29 22:10 -0500
      Re: Why user can change password? Nobody <nobody@nowhere.com> - 2011-06-30 18:10 +0100

csiph-web