Arch Linux

ectospasm

Member

Registered: 2015-08-28

Posts: 303

[SOLVED] cannot change user password, add users, etc.

I ran into this problem today when trying to change my password:

Changing password for ectospasm.
Current password:
New password:
Retype new password:
passwd: Authentication token lock busy
passwd: password unchanged

Googling for answers, the most obvious solution is that the root partition is mounted read-only.  However, that is NOT my issue.  This is what I see in /proc/mounts for my root ('/') partition:

$ grep -P ' / ' /proc/mounts                                                                                         
/dev/mapper/luks / btrfs rw,noatime,compress=zstd:3,ssd,space_cache,subvolid=256,subvol=/root 0 0

If you see ro after your root filesystem type, then that is your problem.  Correct the problem in /etc/fstab, and remount your root filesystem (or reboot).

My root partition is clearly mounted read-write.  Many answers (even on this BBS) were only able to fix this problem with a reinstall.  As I've been running this system for several months without serious issues, that is an untenable solution for me.  I did see the culprit:

$ ls -l /usr/bin/passwd
-rwxr-xr-x 1 root root 63K Sep  7 09:42 /usr/bin/passwd*

See what the problem is?  /usr/bin/passwd is NOT SUID root.  /usr/bin/passwd (and many other utilities) need to be executed with root privileges in order to properly function, as they update files only writable by root (e.g., /etc/shadow).  I fixed it with this:

# chmod u+s /usr/bin/passwd

Or...

$ sudo chmod u+s /usr/bin/passwd

Now, /usr/bin/passwd has the right permissions:

$ ls -l /usr/bin/passwd
-rwsr-xr-x 1 root root 63K Sep  7 09:42 /usr/bin/passwd*

And I was able to change my password as a normal user!

Changing password for ectospasm.
Current password:
New password:
Retype new password:
passwd: password updated successfully

Another clue that I had was that as root I could change my password, like so:

# passwd ectospasm
Changing password for ectospasm.
New password:
Retype new password:
passwd: password updated successfully

If even root can't change your password, ensure your root partition is not mounted read-only.

I probably broke this when I made a mistake several weeks ago and didn't properly restore permissions on a bunch of files in my system.  I'm likely to find more problems like this, but for now I'm considering this solved.

ectospasm

Member

Registered: 2015-08-28

Posts: 303

Re: [SOLVED] cannot change user password, add users, etc.

I was able to find other programs that needed to be setuid 0 by searching for them on another Arch Linux system:

$ /usr/bin/ls -l /usr/bin | grep -P '^-rws' | awk '{print $NF}' > suid_progs.list

Then, I copied suid_progs.list over to my affected Arch Linux system, and ran the following anonymous shell script:

while read; do
    sudo chmod u+s /usr/bin/${REPLY}
done < suid_progs.list

Some of the programs didn't exist on my target system, and that's OK.  The programs not found are related to optical discs, and my target system doesn't have an optical drive (it's a relatively modern laptop).