Arch Linux

emanresul

Member

Registered: 2020-06-02

Posts: 7

[SOLVED] root uid went 1!

Hi .*

Can someone explain what just happened to my Arch installation?

After booting my laptop this morning and logging in as a regular user I realized that I cannot perform any actions that require superuser level privileges. It all started with the discovery that I cannot start NetworkManager. Then after logging as root I realized that I cannot see system logs, cannot edit config files in /etc or setup network connection from CLI. I was really confused to see that I cannot even create files in /root, despite file system being in read-write mode.

'id' command quickly unveiled the reason: root's uid was set to 1... Hmmm!? Only uid was 1, gid was 0, as usual.

I recovered by booting from Kali pendrive and changing uid for root in /etc/passwd back to 0.

But how this could happen?

Below is the pacman log collected between the 'last good' reboot and today morning.

Other than that, I remember creating a new user but nothing more than using 'useradd', 'passwd', and setting home directory in /etc/passwd has been done.
I don't remember performing any other activities that could potentially create such a 'funny' issue.

[2020-05-30T12:27:33+0200] [PACMAN] Running 'pacman -Syu'
[2020-05-30T12:27:33+0200] [PACMAN] synchronizing package lists
[2020-05-30T12:27:34+0200] [PACMAN] starting full system upgrade
[2020-05-30T12:27:38+0200] [ALPM] transaction started
[2020-05-30T12:27:38+0200] [ALPM] upgraded cryptsetup (2.3.2-2 -> 2.3.3-1)
[2020-05-30T12:27:38+0200] [ALPM] upgraded lib32-libnsl (1.2.0-1 -> 1.2.0-2)
[2020-05-30T12:27:38+0200] [ALPM] upgraded librsvg (2:2.48.4-1 -> 2:2.48.5-1)
[2020-05-30T12:27:38+0200] [ALPM] upgraded md4c (0.4.3-1 -> 0.4.4-1)
[2020-05-30T12:27:38+0200] [ALPM] upgraded vte-common (0.60.2-2 -> 0.60.3-1)
[2020-05-30T12:27:38+0200] [ALPM] upgraded vte3 (0.60.2-2 -> 0.60.3-1)
[2020-05-30T12:27:38+0200] [ALPM] transaction completed
[2020-05-30T12:27:38+0200] [ALPM] running '30-systemd-update.hook'...
[2020-05-30T12:27:38+0200] [ALPM] running '90-mkinitcpio-install.hook'...
[2020-05-30T12:27:38+0200] [ALPM-SCRIPTLET] ==> Building image from preset: /etc/mkinitcpio.d/linux-lts.preset: 'default'
[2020-05-30T12:27:38+0200] [ALPM-SCRIPTLET]   -> -k /boot/vmlinuz-linux-lts -c /etc/mkinitcpio.conf -g /boot/initramfs-linux-lts.img
[2020-05-30T12:27:38+0200] [ALPM-SCRIPTLET] ==> Starting build: 5.4.43-1-lts
[2020-05-30T12:27:38+0200] [ALPM-SCRIPTLET]   -> Running build hook: [base]
[2020-05-30T12:27:38+0200] [ALPM-SCRIPTLET]   -> Running build hook: [udev]
[2020-05-30T12:27:39+0200] [ALPM-SCRIPTLET]   -> Running build hook: [autodetect]
[2020-05-30T12:27:39+0200] [ALPM-SCRIPTLET]   -> Running build hook: [modconf]
[2020-05-30T12:27:39+0200] [ALPM-SCRIPTLET]   -> Running build hook: [block]
[2020-05-30T12:27:40+0200] [ALPM-SCRIPTLET]   -> Running build hook: [encrypt]
[2020-05-30T12:27:41+0200] [ALPM-SCRIPTLET]   -> Running build hook: [lvm2]
[2020-05-30T12:27:41+0200] [ALPM-SCRIPTLET]   -> Running build hook: [filesystems]
[2020-05-30T12:27:41+0200] [ALPM-SCRIPTLET]   -> Running build hook: [keyboard]
[2020-05-30T12:27:42+0200] [ALPM-SCRIPTLET]   -> Running build hook: [fsck]
[2020-05-30T12:27:42+0200] [ALPM-SCRIPTLET] ==> Generating module dependencies
[2020-05-30T12:27:42+0200] [ALPM-SCRIPTLET] ==> Creating gzip-compressed initcpio image: /boot/initramfs-linux-lts.img
[2020-05-30T12:27:44+0200] [ALPM-SCRIPTLET] ==> Image generation successful
[2020-05-30T12:27:44+0200] [ALPM-SCRIPTLET] ==> Building image from preset: /etc/mkinitcpio.d/linux-lts.preset: 'fallback'
[2020-05-30T12:27:44+0200] [ALPM-SCRIPTLET]   -> -k /boot/vmlinuz-linux-lts -c /etc/mkinitcpio.conf -g /boot/initramfs-linux-lts-fallback.img -S autodetect
[2020-05-30T12:27:44+0200] [ALPM-SCRIPTLET] ==> Starting build: 5.4.43-1-lts
[2020-05-30T12:27:44+0200] [ALPM-SCRIPTLET]   -> Running build hook: [base]
[2020-05-30T12:27:44+0200] [ALPM-SCRIPTLET]   -> Running build hook: [udev]
[2020-05-30T12:27:45+0200] [ALPM-SCRIPTLET]   -> Running build hook: [modconf]
[2020-05-30T12:27:45+0200] [ALPM-SCRIPTLET]   -> Running build hook: [block]
[2020-05-30T12:27:45+0200] [ALPM-SCRIPTLET] ==> WARNING: Possibly missing firmware for module: wd719x
[2020-05-30T12:27:45+0200] [ALPM-SCRIPTLET] ==> WARNING: Possibly missing firmware for module: aic94xx
[2020-05-30T12:27:48+0200] [ALPM-SCRIPTLET]   -> Running build hook: [encrypt]
[2020-05-30T12:27:48+0200] [ALPM-SCRIPTLET]   -> Running build hook: [lvm2]
[2020-05-30T12:27:48+0200] [ALPM-SCRIPTLET]   -> Running build hook: [filesystems]
[2020-05-30T12:27:49+0200] [ALPM-SCRIPTLET]   -> Running build hook: [keyboard]
[2020-05-30T12:27:50+0200] [ALPM-SCRIPTLET]   -> Running build hook: [fsck]
[2020-05-30T12:27:51+0200] [ALPM-SCRIPTLET] ==> Generating module dependencies
[2020-05-30T12:27:51+0200] [ALPM-SCRIPTLET] ==> Creating gzip-compressed initcpio image: /boot/initramfs-linux-lts-fallback.img
[2020-05-30T12:27:57+0200] [ALPM-SCRIPTLET] ==> Image generation successful
[2020-05-30T12:27:57+0200] [ALPM-SCRIPTLET] ==> Building image from preset: /etc/mkinitcpio.d/linux.preset: 'default'
[2020-05-30T12:27:57+0200] [ALPM-SCRIPTLET]   -> -k /boot/vmlinuz-linux -c /etc/mkinitcpio.conf -g /boot/initramfs-linux.img
[2020-05-30T12:27:57+0200] [ALPM-SCRIPTLET] ==> Starting build: 5.6.15-arch1-1
[2020-05-30T12:27:57+0200] [ALPM-SCRIPTLET]   -> Running build hook: [base]
[2020-05-30T12:27:57+0200] [ALPM-SCRIPTLET]   -> Running build hook: [udev]
[2020-05-30T12:27:57+0200] [ALPM-SCRIPTLET]   -> Running build hook: [autodetect]
[2020-05-30T12:27:57+0200] [ALPM-SCRIPTLET]   -> Running build hook: [modconf]
[2020-05-30T12:27:57+0200] [ALPM-SCRIPTLET]   -> Running build hook: [block]
[2020-05-30T12:27:59+0200] [ALPM-SCRIPTLET]   -> Running build hook: [encrypt]
[2020-05-30T12:28:00+0200] [ALPM-SCRIPTLET]   -> Running build hook: [lvm2]
[2020-05-30T12:28:00+0200] [ALPM-SCRIPTLET]   -> Running build hook: [filesystems]
[2020-05-30T12:28:00+0200] [ALPM-SCRIPTLET]   -> Running build hook: [keyboard]
[2020-05-30T12:28:00+0200] [ALPM-SCRIPTLET]   -> Running build hook: [fsck]
[2020-05-30T12:28:00+0200] [ALPM-SCRIPTLET] ==> Generating module dependencies
[2020-05-30T12:28:00+0200] [ALPM-SCRIPTLET] ==> Creating gzip-compressed initcpio image: /boot/initramfs-linux.img
[2020-05-30T12:28:03+0200] [ALPM-SCRIPTLET] ==> Image generation successful
[2020-05-30T12:28:03+0200] [ALPM-SCRIPTLET] ==> Building image from preset: /etc/mkinitcpio.d/linux.preset: 'fallback'
[2020-05-30T12:28:03+0200] [ALPM-SCRIPTLET]   -> -k /boot/vmlinuz-linux -c /etc/mkinitcpio.conf -g /boot/initramfs-linux-fallback.img -S autodetect
[2020-05-30T12:28:03+0200] [ALPM-SCRIPTLET] ==> Starting build: 5.6.15-arch1-1
[2020-05-30T12:28:03+0200] [ALPM-SCRIPTLET]   -> Running build hook: [base]
[2020-05-30T12:28:03+0200] [ALPM-SCRIPTLET]   -> Running build hook: [udev]
[2020-05-30T12:28:03+0200] [ALPM-SCRIPTLET]   -> Running build hook: [modconf]
[2020-05-30T12:28:03+0200] [ALPM-SCRIPTLET]   -> Running build hook: [block]
[2020-05-30T12:28:04+0200] [ALPM-SCRIPTLET] ==> WARNING: Possibly missing firmware for module: wd719x
[2020-05-30T12:28:04+0200] [ALPM-SCRIPTLET] ==> WARNING: Possibly missing firmware for module: aic94xx
[2020-05-30T12:28:07+0200] [ALPM-SCRIPTLET]   -> Running build hook: [encrypt]
[2020-05-30T12:28:07+0200] [ALPM-SCRIPTLET]   -> Running build hook: [lvm2]
[2020-05-30T12:28:08+0200] [ALPM-SCRIPTLET]   -> Running build hook: [filesystems]
[2020-05-30T12:28:09+0200] [ALPM-SCRIPTLET]   -> Running build hook: [keyboard]
[2020-05-30T12:28:10+0200] [ALPM-SCRIPTLET]   -> Running build hook: [fsck]
[2020-05-30T12:28:11+0200] [ALPM-SCRIPTLET] ==> Generating module dependencies
[2020-05-30T12:28:11+0200] [ALPM-SCRIPTLET] ==> Creating gzip-compressed initcpio image: /boot/initramfs-linux-fallback.img
[2020-05-30T12:28:18+0200] [ALPM-SCRIPTLET] ==> Image generation successful
[2020-05-30T12:28:18+0200] [ALPM] running 'gdk-pixbuf-query-loaders.hook'...
[2020-05-31T17:14:47+0200] [PACMAN] Running 'pacman -R parole'
[2020-05-31T17:14:49+0200] [ALPM] transaction started
[2020-05-31T17:14:50+0200] [ALPM] removed parole (1.0.5-1)
[2020-05-31T17:14:50+0200] [ALPM] transaction completed
[2020-05-31T17:14:50+0200] [ALPM] running '30-systemd-update.hook'...
[2020-05-31T17:14:50+0200] [ALPM] running 'gtk-update-icon-cache.hook'...
[2020-05-31T17:14:51+0200] [ALPM] running 'update-desktop-database.hook'...
[2020-06-02T00:54:35+0200] [PACMAN] Running 'pacman -Syu'
[2020-06-02T00:54:35+0200] [PACMAN] synchronizing package lists
[2020-06-02T00:54:36+0200] [PACMAN] starting full system upgrade
[2020-06-02T00:54:42+0200] [ALPM] transaction started
[2020-06-02T00:54:42+0200] [ALPM] upgraded libgpg-error (1.37-1 -> 1.38-1)
[2020-06-02T00:54:42+0200] [ALPM] upgraded ca-certificates-mozilla (3.52.1-2 -> 3.53-1)
[2020-06-02T00:54:42+0200] [ALPM] upgraded gtksourceview3 (3.24.11-1 -> 3.24.11+28+g73e57b57-1)
[2020-06-02T00:54:42+0200] [ALPM] upgraded gxplugins.lv2 (0.7-2 -> 0.8-1)
[2020-06-02T00:54:42+0200] [ALPM] upgraded imagemagick (7.0.10.14-1 -> 7.0.10.16-2)
[2020-06-02T00:54:42+0200] [ALPM] upgraded nss (3.52.1-2 -> 3.53-1)
[2020-06-02T00:54:42+0200] [ALPM] upgraded lib32-nss (3.52.1-2 -> 3.53-1)
[2020-06-02T00:54:42+0200] [ALPM] upgraded lib32-vulkan-icd-loader (1.2.140-1 -> 1.2.141-1)
[2020-06-02T00:54:42+0200] [ALPM] upgraded libmagick6 (6.9.11.14-1 -> 6.9.11.15-1)
[2020-06-02T00:54:42+0200] [ALPM] upgraded re2 (1:20200501-1 -> 1:20200601-1)
[2020-06-02T00:54:42+0200] [ALPM] upgraded rmlint (2.9.0-2 -> 2.10.0-1)
[2020-06-02T00:54:42+0200] [ALPM] upgraded vulkan-icd-loader (1.2.140-1 -> 1.2.141-1)
[2020-06-02T00:54:42+0200] [ALPM] transaction completed
[2020-06-02T00:54:42+0200] [ALPM] running '30-systemd-update.hook'...
[2020-06-02T00:54:42+0200] [ALPM] running 'detect-old-perl-modules.hook'...
[2020-06-02T00:54:42+0200] [ALPM] running 'texinfo-install.hook'...
[2020-06-02T00:54:42+0200] [ALPM] running 'update-ca-trust.hook'...

/cheers

Last edited by emanresul (2020-06-22 11:04:12)

V1del

Forum Moderator

Registered: 2012-10-16

Posts: 25,376

Re: [SOLVED] root uid went 1!

Other than that, I remember creating a new user but nothing more than using 'useradd', 'passwd', and setting home directory in /etc/passwd has been done.

What exactly did you do? Dig up the commands from the history if need be. It's highly likely that these are responsible.

Trilby

Inspector Parrot

Registered: 2011-11-29

Posts: 30,518

Website

Re: [SOLVED] root uid went 1!

... and setting home directory in /etc/passwd

This should not (have to) be done manually and is almost certainly the source of the problem.

---

"UNIX is simple and coherent" - Dennis Ritchie; "GNU's Not Unix" - Richard Stallman

emanresul

Member

Registered: 2020-06-02

Posts: 7

Re: [SOLVED] root uid went 1!

Other than that, I remember creating a new user but nothing more than using 'useradd', 'passwd', and setting home directory in /etc/passwd has been done.

What exactly did you do? Dig up the commands from the history if need be. It's highly likely that these are responsible.

As I wrote, just the basic commands, here's the .bash_history excerpt:

  468  useradd zuser
  469  passwd zuser
  470  vim /etc/passwd

Of course you can suspect that I accidentally messed up the entry for root in /etc/passwd. If I won't find any other explanation, I will start to believe it too. But, man, I wasn't drunk when I was doing that...

frostschutz

Member

Registered: 2013-11-15

Posts: 1,653

Re: [SOLVED] root uid went 1!

Of course you can suspect that I accidentally messed up the entry for root in /etc/passwd.

It's the most likely explanation after seeing vim /etc/passwd which you never ought to do...

Setting a new home directory and such things can be done with usermod

Trilby

Inspector Parrot

Registered: 2011-11-29

Posts: 30,518

Website

Re: [SOLVED] root uid went 1!

Or just specify it in the initial useradd command.

---

"UNIX is simple and coherent" - Dennis Ritchie; "GNU's Not Unix" - Richard Stallman

emanresul

Member

Registered: 2020-06-02

Posts: 7

Re: [SOLVED] root uid went 1!

Yeah, well. I didn't find an explanation for that, other than me causing a mess in /etc/passwd.

Don't know how it happened though, perhaps I'm just getting older or that was the first symptom of some brain disease...

Of course you guys are right, there are safe methods to do such a changes. I just used to edit the files manually, since I started to use Slackware many years ago

rowdog

Member

From: East Texas

Registered: 2009-08-19

Posts: 118

Re: [SOLVED] root uid went 1!

Even on Slackware, back in the 90s, it was a bad idea to directly edit passwd. That's what vipw is for.

twelveeighty

Member

Registered: 2011-09-04

Posts: 1,456

Re: [SOLVED] root uid went 1!

Either post your entire /etc/passwd, or at least:

cat /etc/passwd | grep root

emanresul

Member

Registered: 2020-06-02

Posts: 7

Re: [SOLVED] root uid went 1!

Even on Slackware, back in the 90s, it was a bad idea to directly edit passwd. That's what vipw is for.

Yeah, true. But also, Slackware had/has the idea of allowing you to do a lot of modifications by editing system files manually. You just should know what you do, or at least know what did you just break, so you can recover yourself.

And sometimes you actually need to edit /etc/passwd manually. For example some time ago I was working for a company, that used a set of scripts to manage various user settings based on the GECOS field. That field was populated by a script and of course using script is not manual, but before you can use it, you need to write it, which is a very manual task.

Other example I remember is a Linux course attended by my friend. He told me that he was taught how to add a new user only by editing system files manually, so then he can understand the process.

But, just to make it clear. I do agree with you that touching system files is risky, and if you want to play safe, you should use dedicated tools. And of course since I posted that thread in the "Newbie Corner" the takeaway for the newbies from my situation should be as follows:

use 'useradd' and 'usermod' and not 'vim /etc/passwd'

But on the other hand, if you're not afraid to break your system, perhaps you can learn something new

Either post your entire /etc/passwd, or at least:

cat /etc/passwd | grep root

Well, thanks, but I think you missed some parts of my original post. The problem has been solved before I've created that thread. My post was created just for 'investigation purposes'.

Last edited by emanresul (2020-06-19 17:35:58)