How a non root user can change his own password when he does not have write permission to the ETC shadow?
How a non-root user can change his own password when he does not have write permission to the /etc/shadow? The effect is that a passwd process adopts the identity of the owner, in this case root. This is how it can modify the shadow file.
How do I run passwd as root?
How to change root password in Ubuntu
- Type the following command to become root user and issue passwd: sudo -i. passwd.
- OR set a password for root user in a single go: sudo passwd root.
- Test it your root password by typing the following command: su –
Is there anything sudo can do about passwd root?
If that application in turn launches passwd root there is nothing sudo can do about it. Note that this can be done through other applications, too; for example, many of the more advanced editors provide facilities to execute a command through the shell, a shell which will be executed with the effective uid of that editor process (that is, root).
Do you need a password for root access?
PS. There are many ways to arrange root access for yourself without the password; for one, if you’re in /etc/sudoers (without restrictions) you only need your own password to become root, e.g. with sudo bash. But you simply shouldn’t need to go there. It’s probably possible, at least in theory, to do this using SELinux.
Is it possible to change the root password in SELinux?
Even with SELinux, it may be tricky to make it impossible for a user to change the root password, but still able to do whatever they may need to do. Really it depends on what the user who isn’t allowed to change the root password actually does need to be able to do.
Do you need to copy root lines to add to passwd?
To add, you’ll likely need to edit /etc/passwd and /etc/shadow (copy the root lines). It’s all but fail-safe, but if you just need to safeguard against the “main administrator” changing the password without notice, then it will work.