Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Normally only root can access /etc/shadow. But programs like su and sudo can check passwords without running as root. So the question is: Why can these programs access /etc/shadow without privileges? I tried to access it without privileges via python with the spwd module, but I didn't get access (like expected). Which mechanism do these programs use?

share|improve this question
sudo and su do run as root. see unix.stackexchange.com/questions/11285/how-does-sudo-work for the internals how all that goes down. – strugee Sep 17 '13 at 1:16
up vote 10 down vote accepted

why have programs like su access to /etc/shadow

Because Program like su and passwd has set SetUID, You can check by using :

[root@tpserver tmp]#  ls -l /usr/bin/passwd
-r-s--x--x  1 root root 21200 Aug 22  2013 /usr/bin/passwd

When you look around in your file permission you will see "s". If anybody trying to run passwd program, by default its taking the privilege of owner(root here) of the file. means any user can get root privilege to execute the passwd program. because only root user edit or update /etc/passwd and /etc/shadow file. other user's cant. when the normal user runs passwd program on his terminal, the passwd program is run as "root". because effective UID set to "root". So the normal user can easily update the file.

You can use the chmod command with the u+s or g+s arguments to set the setuid and setgid bits on an executable file, respectively

Long Answer : Set-User_Id (SUID): Power for a Moment:

By default, when a user executes a file, the process which results in this execution has the same permissions as those of the user. In fact, the process inherits his default group and user identification.

If you set the SUID attribute on an executable file, the process res- ulting in its execution doesn't use the user's identification but the user identification of the file owner.

The SUID mechanism,invented by Dennis Ritchie,is a potential security hazard. It lets a user acquire hidden powers by running such a file owned by root.

$ ls -l /etc/passwd /etc/shadow /usr/bin/passwd
-rw-r--r-- 1 root root 2232 Mar 15 00:26 /etc/passwd
-r-------- 1 root root 1447 Mar 19 19:01 /etc/shadow

The listing shows that passwd is readable by all, but shadow is unre- adable by group and others. When a user running the program belongs to one of these two categories (probably, others), so access fails in the read test on shadow. suppose normal user wants to change his password, How can he do that? He can do that by running /usr/bin/passwd. Many UNIX/Linux programs have a special permission mode that lets users update sensitive system files –like /etc/shadow --something they can't do directly with an editor. This is true of the passwd program.

$ ls -l /usr/bin/passwd
-rwsr-xr-x 1 root root 22984 Jan 6 2007 /usr/bin/passwd

The s letter in the user category of the permission field represents a special mode known as the set-user-id (SUID). This mode lets a process have the privileges of the owner of the file during the instance of the program. Thus when a non privileged user executes passwd, the eff- ective UID of the process is not the user's, but of root's – the owner of the program. This SUID privilege is then used by passwd to edit /etc/shadow.

Reference Link

share|improve this answer
Thanks! Now i finally also got what the S execution bit does. – Kritzefitz Sep 16 '13 at 20:30
S is actually different from s. s means: execute + setuid, while S means just setuid without execute. This ensures that you can tell if the respective user still has the execute permission, because the s/S flag uses the space that is normally used by the x flag. – Martin von Wittich Sep 16 '13 at 20:34
The capital S indicates the file has a setuid bit set but is not executable. – Rahul Patil Sep 16 '13 at 20:39
Check more by using info ls "What information is listed" – Rahul Patil Sep 16 '13 at 20:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.