UNIX passwd 所需的功能
如果 /usr/bin/passwd 不是一个设置 UID 程序，那么需要什么功能才能让普通用户仍然可以更改其密码？
If /usr/bin/passwd was not a set-UID program, what capabilities would it require for a normal user to still be allowed to change his password?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
它需要能够修改 /etc/passwd、/etc/shadow 和/或各种其他文件（取决于身份验证的配置方式）。
因此 CAP_DAC_OVERRIDE 似乎就足够了，但是，用 CAP_DAC_OVERRIDE 来 root 一个盒子是微不足道的，因为任何二进制文件都可以被替换（例如 /bin/sh 通常由 root cron-jobs 执行）。
在某些系统上，更改密码不需要特权，因为已经使用了守护程序，例如大多数分散式身份验证系统（nis+等）
It would need to be able to modify /etc/passwd, /etc/shadow and/or various other files (depending on how authentication is configured).
So CAP_DAC_OVERRIDE would seem to be sufficient, however, it is trivial to root a box with CAP_DAC_OVERRIDE, because any binary can be replaced (such as /bin/sh which is often executed by root cron-jobs).
On some systems, privileges are not required to change passwords because a daemon is used already, e.g. most decentralised authentication systems (nis+ etc)
不可能，除非你想破坏系统的安全。
如果“passwd”实用程序可以作为普通用户完成其工作，那么任何用户都可以编写自己的版本来更改任何其他用户的密码。 （也就是说，将源代码带到实用程序中，修改它以跳过询问当前密码，编译并运行。）
我想您可以创建一个以 root 身份运行并侦听套接字的“密码守护程序”，以便服务密码更改请求。不过，为什么你会想要它而不是 set-uid /usr/bin/passwd ？安全影响是相同的。
但无论您做什么，只能允许某些受信任的进程更改密码数据库。否则任何人都可以更改其他人的密码，这违背了多用户操作系统的目的。
Impossible unless you want to destroy the security of the system.
If the "passwd" utility can do its job as a normal user, then any user could write their own version to change the password of any other user. (That is, take the source code to the utility, modify it to skip asking for the current password, compile, and run.)
I suppose you could create a "password daemon" that runs as root and listens on a socket in order to service password change requests. Why you would want that instead of a set-uid /usr/bin/passwd is beyond me, though; the security implications are identical.
But no matter what you do, changing the password database can only be allowed for some trusted process. Otherwise anybody can change anybody else's password, which kind of defeats the purpose of a multi-user OS.
您需要以 root 身份运行。
passwd需要对 /etc/passwd 和 /etc/shadow 进行读/写访问，而这些文件只有 root 可以直接操作。You'd need to be running as root.
passwdrequires read/write access to /etc/passwd and /etc/shadow, and those are files that only root can directly manipulate.