0

This question already has an answer here:

Can you advise over it..this was question for me to check but was not able to get this ...if the group can help.. can you advise.. my question is clear that we should not be root or root user to do that

marked as duplicate by Scott, Pimp Juice IT, Community Aug 30 '17 at 4:47

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1

Yes. Any user can run passwd to change their own password.

  • ... but ... how? – Scott Aug 28 '17 at 22:03
  • setuid See the other answer – uSlackr Aug 30 '17 at 1:49
  • I know that — see my comments on the question.   My point is that the question the question asks How? and your post doesn’t answer that. – Scott Aug 30 '17 at 2:03
1

The passwd utility has the setuid bit set. It means that it will be run as root.

$ ls -lh /usr/bin/passwd 
-rwsr-xr-x 1 root root 53K May 17 01:37 /usr/bin/passwd

So this utility will be able to modify the /etc/shadow and /etc/passwd files, which are owned by root.

As it is written in the man page,

A normal user may only change the password for his/her own account

Programs using the setuid bit should be really carefully designed, since running as root is a real security risk.

Not the answer you're looking for? Browse other questions tagged or ask your own question.