Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
When a normal user wants to make change to the passwd file, the user will by setuid be given the effective user access. User becomes root temporarily and can edit passwd.
However you can only edit your password right, and not everybody else? However your effective user access is root. So how come you're not allowed to change other passwords beside yours?
When you run a program with setuid, what does it mean actually when effective user is root, but real user id is still your name?
You can't change other passwords because the program won't allow you to. The program has system permissions to change any password it wants, because it is running as root, but the program has been specifically designed not to give the user any way to get it to use those permissions.
It is not quite that the user becomes root temporarily, it is that the trusted program runs with root permissions. Obviously, only programs that are specifically designed to limit users to doing only what they should be permitted to do can safely be made setuid.
You are only allowed to change only your password inspite of having effective user id of root because at the time of password change the real user id is checked not the effective user id . You can only change the effective user id and not the real user id.
Only root user can change the real user id to run the program as non-privileged user. The real user id can not be changed as it is set at the time of session start.
That's why only your password can be changed as the real user id is not changed(as it is still yours not root's).
An early hack in Unix was to make a symbolic link to a setuid shell script and call the link -i. This results in the script being called as sh -i which instead of executing the script called -i as intended launches an interactive shell, which then gives full powers. Effective user ID can be used to modify the passwd file for any user or root itself. The best way to guard against this is to use SELinux to prevent trust scripts or programs from modifying outside the area SELinux allows them to run.
Another technique is to have an immutable bit on important files which one set cannot be modified even by the root user (apart from in single-user mode)
As root you can invite users to log on to your system without a password and appear as any user but normal privileged processes try very hard to prevent this from happening.
If you use network filing systems of some sort the root user will be treated as nobody in that file space instead of root which allows untrusted computers to join a trusted network such as a university campus.
You are only allowed to change your password, because the set-password program, though it has the power to do anything, is programmed to only change passwords. It will check the real user id, to decide which password to change.
Because you can not change your real user id, even by calling a set-uid program, the program can use it to implement security. The operating system relinquishes security to the set uid root program.
Note: the set uid root program could also change the real user id (but this is not of use in this use-case).
Warning: set uid root is considered harmful (well much less than ideal). We should be using capabilities these days ( see What are the different ways to set file permissions etc on gnu/linux and http://man7.org/linux/man-pages/man7/capabilities.7.html)
