Arch Linux

solidak

Member

Registered: 2018-07-09

Posts: 8

[SOLVED] shadow.service failed

Hey guys

I ran `systemctl --failed` and saw the shadow.service bailed out on me. I have a feeling its a permissions issue.

$ systemctl status shadow.service
● shadow.service - Verify integrity of password and group files
   Loaded: loaded (/usr/lib/systemd/system/shadow.service; static; vendor preset: disabled)
   Active: failed (Result: exit-code) since Fri 2018-07-27 08:15:29 CEST; 7h ago
  Process: 28849 ExecStart=/bin/sh -c /usr/bin/pwck -r || r=1; /usr/bin/grpck -r && exit $r (code=exited, statu>
 Main PID: 28849 (code=exited, status=1/FAILURE)

Also here's the permissions for both those files

$ ls -l /usr/bin/pwck; ls -l /usr/bin/grpck
-rwsr-xr-x 1 root root 46K Dec 16  2017 /usr/bin/pwck
-rwsr-xr-x 1 root root 54K Dec 16  2017 /usr/bin/grpck

Can anyone spot the issue or help me understand it? Are these default permissions for binaries in /usr/bin?

Much obliged

Last edited by solidak (2018-07-27 16:25:47)

loqs

Member

Registered: 2014-03-06

Posts: 19,113

Re: [SOLVED] shadow.service failed

What is the output of the following

pacman -Qkk shadow
pacman -Qi shadow

solidak

Member

Registered: 2018-07-09

Posts: 8

Re: [SOLVED] shadow.service failed

Oh no...

[1] % pacman -Qkk shadow; pacman -Qi shadow
warning: shadow: /usr/bin/chage (Permissions mismatch)
warning: shadow: /usr/bin/expiry (Permissions mismatch)
warning: shadow: /usr/bin/gpasswd (Permissions mismatch)
warning: shadow: /usr/bin/grpck (Permissions mismatch)
warning: shadow: /usr/bin/newgidmap (Permissions mismatch)
warning: shadow: /usr/bin/newuidmap (Permissions mismatch)
warning: shadow: /usr/bin/passwd (Permissions mismatch)
warning: shadow: /usr/bin/pwck (Permissions mismatch)
warning: shadow: /usr/bin/sg (Permissions mismatch)
shadow: 558 total files, 9 altered files
Name            : shadow
Version         : 4.5-4
Description     : Password and account management tool suite with support for shadow files and PAM
Architecture    : x86_64
URL             : https://github.com/shadow-maint/shadow
Licenses        : BSD
Groups          : base
Provides        : None
Depends On      : bash  pam  acl
Optional Deps   : None
Required By     : git  util-linux
Optional For    : None
Conflicts With  : None
Replaces        : None
Installed Size  : 3.46 MiB
Packager        : Sébastien Luttringer <seblu@seblu.net>
Build Date      : Sat 16 Dec 2017 05:03:59 PM CET
Install Date    : Fri 04 May 2018 12:26:06 PM CEST
Install Reason  : Explicitly installed
Install Script  : Yes
Validated By    : Signature

How can one fix permission mismatches from pacman -Qkk?

loqs

Member

Registered: 2014-03-06

Posts: 19,113

Re: [SOLVED] shadow.service failed

Reinstall the shadow package to fix the file permissions.  Any idea how files only writeable by root had their permissions changed?

solidak

Member

Registered: 2018-07-09

Posts: 8

Re: [SOLVED] shadow.service failed

I ran `sudo chown -R root /usr/bin` accidentally. I've been trying to recover ever since.

Any chance to revert the command? With RPM I think there's a command `rpm --setperms -a` that should restore major fuck-ups like that. Is there something like that in Arch?

P.S: I reinstalled `shadow`. pacman -Qkk doesn't give the permissions issue anymore, but running `systemctl restart shadow.service` still gives a failed with the same message.

Last edited by solidak (2018-07-27 15:20:05)

Scimmia

Fellow

Registered: 2012-09-01

Posts: 13,729

Re: [SOLVED] shadow.service failed

and what do pwck  and grpck  give you when run manually?

solidak

Member

Registered: 2018-07-09

Posts: 8

Re: [SOLVED] shadow.service failed

@Scimmia when run without sudo, they say `cannot lock /etc/passwd`.
With sudo, both do not output anything.

loqs

Member

Registered: 2014-03-06

Posts: 19,113

Re: [SOLVED] shadow.service failed

I do not see how 'sudo chown -R root /usr/bin' caused the sticky bit to be set on /usr/bin/pwck

solidak

Member

Registered: 2018-07-09

Posts: 8

Re: [SOLVED] shadow.service failed

What's the default permissions for /usr/bin/pwck?

loqs

Member

Registered: 2014-03-06

Posts: 19,113

Re: [SOLVED] shadow.service failed

(0755/-rwxr-xr-x) not (4755/-rwsr-xr-x)

solidak

Member

Registered: 2018-07-09

Posts: 8

Re: [SOLVED] shadow.service failed

This fixed it! Thanks @loqs!!
I think I played around with `chown u+s` to try and fix it.

eschwartz

Fellow

Registered: 2014-08-08

Posts: 4,097

Re: [SOLVED] shadow.service failed

Use pacrepairfile, from the pacutils package, to reset file permissions back to what pacman thinks they should be.

---

Managing AUR repos The Right Way -- aurpublish (now a standalone tool)