Programming

Hi guys,

I have a doubt on shadow file ... In the Unix servers in which I am working, I cud see that the shadow file has only one permission set .. tht is read permission for only root user ... (-r--------) ....

So my basic doubt here is that how this file is being written then ... only through pwconv ??? Does even root user cant edit the file manually .....
If so, how pwconv which has the permissions (-r-xr-xr-x) do update the shadow file ???

Thanks & regards,

SNS

As far as the kernel is concerned, with a local filesystem, root can read any file and write to any non-directory. Most editors will see the lack of a write permission for root and open /etc/shadow in read-only mode. So removing write permission for root prevents root from overwriting the accidentally with most editors and a very few other programs.

A good administrator should be very careful while operating as root and notice the lack of write permissions before modifying a file. So it also serves as a signal to administrators.

You can override the read-only status with most editors. In vi, the command is: ":w!", but it is a little risky.

Oh ... tht's great ... so though root does not have write permission, does it mean that still he can open it in vi and overwrite it with w! .. rite ...

Does vi give this special overwrite permission for root alone ...

Because I created a file with write permission only to the owner .. and opened the file in vi as another user of same group and tried to save it with w! .. it said permission denied .. ;-( ... the same as expected .. then how come it allow the same for root alone .... does vi recognize root and grants him the privilege to overwrite ...

Really appreciate if anyone cud elaborate on this ..

Thanks in advance,

SNS

vi does not really write to the file. It makes a system call for this. It is at the syscall level that the permissions and other things are checked. It is the OS that permits a user to write to a file or otherwise.

Sabari,
/etc/shadow is owned by root, thus root can modify at will permissions, be it read-only or no permission at all!