2

I have debootstraped version of wheezy on my Archlinux machine and would like to change it's root password:

echo "root:toor" | chpasswd --root /home/containers/wheezy/

However I get an error:

chpasswd: PAM: Permission denied

Works fine on my local root user (without --root option).

The man page clearly states the following:

-R, --root CHROOT_DIR
Apply changes in the CHROOT_DIR directory and use the configuration files from the CHROOT_DIR directory.

So what am I doing wrong? And how does PAM get involved anyway? Other methods to do this?

EDIT

# echo "root:toor" | sudo strace -f -efile,execve chpasswd --root /home/containers/wheezy/

Below is the output where chpasswd starts complaining.

open("/usr/share/locale/locale.alias", O_RDONLY|O_CLOEXEC) = 3
open("/usr/share/locale/en_GB.UTF-8/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_GB.utf8/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_GB/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.UTF-8/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.utf8/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_GB.UTF-8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_GB.utf8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_GB/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.UTF-8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.utf8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
chpasswd: PAM: Permission denied
+++ exited with 1 +++

EDIT2

I have found that the files chpasswd is expecting on the target container can be found for many other languages except English:

# find /usr/share/locale/ -iname '*Linux-PAM.mo*'
/usr/share/locale/hu/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/zh_CN/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/it/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/zu/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/ko/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/or/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/nl/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/sk/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/ja/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/da/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/uk/LC_MESSAGES/Linux-PAM.mo
...
/usr/share/locale/pt_BR/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/ta/LC_MESSAGES/Linux-PAM.mo

Note: en_GB which chpasswd is expecting might be equal to uk on the target container?..

I've tried to reinstall packages which seem to have required files:

apt-get install --reinstall libpam-runtime login locales locales-all

But that didn't help at all.

EDIT3

When I run strace on the target container it is not looking for these files:

# echo "root:toor2" | strace -f -e open chpasswd --root /
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/lib/x86_64-linux-gnu/libpam.so.0", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libpam_misc.so.0", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libselinux.so.1", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libcrypt.so.1", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libdl.so.2", O_RDONLY) = 3
open("/proc/filesystems", O_RDONLY)     = 3
open("/etc/pam.d/chpasswd", O_RDONLY)   = 3
open("/etc/pam.d/common-password", O_RDONLY) = 4
open("/lib/x86_64-linux-gnu/security/pam_unix.so", O_RDONLY) = 5
open("/etc/ld.so.cache", O_RDONLY)      = 5
open("/lib/x86_64-linux-gnu/libnsl.so.1", O_RDONLY) = 5
open("/lib/x86_64-linux-gnu/security/pam_deny.so", O_RDONLY) = 5
open("/lib/x86_64-linux-gnu/security/pam_permit.so", O_RDONLY) = 5
open("/etc/pam.d/other", O_RDONLY)      = 3
open("/etc/pam.d/common-auth", O_RDONLY) = 4
open("/etc/pam.d/common-account", O_RDONLY) = 4
open("/etc/pam.d/common-password", O_RDONLY) = 4
open("/etc/pam.d/common-session", O_RDONLY) = 4
open("/etc/passwd", O_RDONLY)           = 3
open("/etc/passwd", O_RDONLY)           = 3
open("/etc/nsswitch.conf", O_RDONLY)    = 3
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/lib/x86_64-linux-gnu/libnss_compat.so.2", O_RDONLY) = 3
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/lib/x86_64-linux-gnu/libnss_nis.so.2", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libnss_files.so.2", O_RDONLY) = 3
open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3
open("/etc/shadow", O_RDONLY|O_CLOEXEC) = 3
open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3
open("/etc/shadow", O_RDONLY|O_CLOEXEC) = 3
open("/etc/passwd", O_RDONLY)           = 3
open("/etc/passwd", O_RDONLY)           = 3
open("/etc/.pwd.lock", O_WRONLY|O_CREAT|O_CLOEXEC, 0600) = 3
open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 4
open("/etc/shadow", O_RDONLY|O_CLOEXEC) = 4
open("/dev/urandom", O_RDONLY)          = 4
open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 4
open("/etc/passwd", O_RDONLY)           = 4
open("/etc/nshadow", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
open("/etc/shadow", O_RDONLY)           = 5
open("/etc/localtime", O_RDONLY)        = 4
Process 7760 attached
Process 7759 suspended
Process 7759 resumed
Process 7760 detached
--- SIGCHLD (Child exited) @ 0 (0) ---

EDIT4

Eventually I've run the same command on the same container on Debian Jessie and it worked.
The case is solved - Wheezy and Archlinux simply has different implementations of chpasswd.

I think the best portable workaround for this problem is as suggested by @Peter Cordes:

echo 'root:toor' | chroot /home/containers/wheezy/ /usr/sbin/chpasswd
  • And you're running that as root? And the files in your chroot have normal ownership? – Peter Cordes Aug 11 '15 at 21:19
  • Yes, I run these commands as a root user and files/directories in the chroot dir are owned by the root user. – NarūnasK Aug 11 '15 at 21:45
  • Maybe try echo | sudo strace -f -efile,execve chpasswd --root /home/containers/wheezy/? – Peter Cordes Aug 11 '15 at 22:21
  • Apparently the problem starts here: open("/usr/share/locale/en_GB.UTF-8/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory) – NarūnasK Aug 11 '15 at 22:45
  • It's common to see a lot of attempts to open files that don't exist. That's just opening the translations into British-English, in case there are any. (en-GB, en-CA, etc. are very light on translations. A couple programs might have colour instead of color in a translated string, but unfortunately a complete lack of lorries, bonnets, petrol, and mobiles. Not to mention bangers and mash.) – Peter Cordes Aug 11 '15 at 22:50
1

Why not just chroot into your installation?

chroot /home/containers/wheezy
passwd root
  • because this is executed in the script – NarūnasK Aug 11 '15 at 20:59
  • does echo ... | chroot /home/containers/wheezy chpasswd work? – Peter Cordes Aug 11 '15 at 21:20
  • 2
    Nope, but echo 'root:toor' | chroot /home/containers/wheezy/ /usr/sbin/chpasswd did :) When I chroot my $PATH environment variable lacks /bin so I had to use full paths... Hence your answer shows a good workaround, but it would be good to know why the original line didn't work... – NarūnasK Aug 11 '15 at 21:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.