PAM manages to check the user password, when called from unprivileged screen-lockers. E.g.:

I can't find any SUID-root binary in the screen package on Fedora 26, but the lockscreen command (Ctrla Ctrlx) still works. I can't see any the Makefile in xsecurelock setting SUID root anywhere either.

I'm confused. How does this work? My user does not have read access to /etc/shadow. I am not using the OpenWall pam_tcb for per-user shadow files.


If you look at the binaries installed by pam, it includes unix_checkpwd.

unix_chkpwd is a helper program for the pam_unix module that verifies the password of the current user. It also checks password and account expiration dates in shadow. It is not intended to be run directly from the command line and logs a security violation if done so.

It is typically installed setuid root or setgid shadow.

The interface of the helper - command line options, and input/output data format are internal to the pam_unix module and it should not be called directly from applications.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.