A lot of books state that examples of setuid bit usages include passwd, at etc. But in mac os x el capitan, the /usr/bin/passwd does not have the bit set.
How could it change the /etc/passwd file?
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
/usr/bin/passwd does not write directly to the password file. Instead, it uses a "directory system", e.g., a database or LDAP server (e.g., for networking credentials). To do this, it communicates with a privileged process.
Processes generally find user records using one of the getpwent(3) family of functions. On Mac OS X, these functions interact with the DirectoryService(8) daemon, which reads the /etc/master.passwd file as well as searching other directory information services to find user accounts.
DirectoryService notes that it is obsolete, and that you should read opendirectoryd(8), which in turn says
Open Directory forms the foundation of how Mac OS X accesses all authoritative configuration information (users, groups, mounts, managed desktop data, etc.). This allows use of virtually any directory system via Apple and third party modules.
Open Directory Server utilizes OpenLDAP which is included as part of Mac OS X Client, Mac OS X Server, and Darwin. OpenLDAP provides a robust and scalable platform for serving directory-based information for both standalone and networked systems.
So ultimately (even for standalone systems), it seems that
passwd talks to an LDAP server which stores your credentials. Looking at output from
ps, it seems that might be
passwd can update
/etc/passwd, in practice it does not do this for your user account. It uses
/etc/pwd.db only for "legacy" applications (things that have not been converted to Open Directory).