1

The groupmems command that allows us to edit group membership has a peculiar trait: When executed as root, it again asks for root password when trying to edit any group membership for any system user.

In fact it even acts for the root password pre-emptively, before it checks if such group exists (it checks if user exists before it asks for password)

If you for example execute groupmems -g 12345 -a nobody as root it will ask you to type in the root password anyway, before letting you know that group 12345 does not exist.

Why ( and actually how too) is it done this way for this specific command, given the omnipotence of root when it comes to passwd /etc/sudoers and well...everything else.

Also, this part taken straight from the man groupmems

The groupmems command allows a user to administer their own group membership list without the requirement of superuser privileges. The groupmems utility is for systems that configure its users to be in their own name sake primary group (i.e., guest / guest).

Only the superuser, as administrator, can use groupmems to alter the memberships of other groups.

makes me wonder what would happen if I removed root from group root. Would root then possibly lose privileges to add himself back to group root with groupmems? ( I didn't want to attempt this not yet knowing how this groupmems command behaves

When I tried to read up on it and groups using man I eventually got to this interesting tidbit:

The /etc/group file is a text file that defines the groups on the system. There is one entry per line, with the following format:

group_name:password:GID:user_list

I have personally never set a password for a group in linux. What would it do/accomplish/help? When would it ever be asked instead of user's password given particualar privileges ? Would then every user's password that belongs to that particular group work as the group password also?

One last thing from the man group and this one we can at least laugh about:

As the 4.2BSD initgroups(3) man page says: no one seems to keep /etc/group up-to-date.

Improve this question

1 Answer 1

Reset to default
1

The "how" is via a call to pam_authenticate. I have no idea why, but the behavior can be eliminated by creating a file named /etc/pam.d/groupmems containing the following:

auth       sufficient pam_rootok.so

Recompiling groupmems without PAM support is another way to get rid of the prompt.

Improve this answer
1
  • Thank you so much! I never imagined I'd one day get an answer to this one, not to mention an answer that also describes how to circumvent this strange behavior (other than recompiling).
    – NetIceCat
    Jan 22, 2021 at 1:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .