What is the SUID bit, and how can passwd change root-owned files?
SUID makes an executable run with the permissions of its file owner instead of the user who launched it. passwd is owned by root with SUID set, so a normal user can update /etc/shadow through it. The bit shows as s in the owner execute slot.
Explain it simply
Think of a bank locker room. You cannot open the vault yourself, but the manager can. SUID is like the manager opening the vault for you, only to do one specific job and nothing else.
Normally a program runs with the privileges of whoever starts it. With setuid on, the process takes the file owner's identity. /usr/bin/passwd is owned by root, so while it runs it can write to /etc/shadow, a file ordinary users cannot touch. The program itself is written to change only the caller's own password.
You see it as s in the owner's execute position: -rwsr-xr-x. Set it with chmod u+s file or chmod 4755 file.
Because it is powerful, a buggy SUID root program is a privilege escalation risk. Audit them with find / -perm -4000 -type f 2>/dev/null.
Example
ls -l /usr/bin/passwd
# -rwsr-xr-x 1 root root 59976 ... /usr/bin/passwd
find /usr/bin -perm -4000 -type fWhat to say in the interview
"SUID makes a program run as its owner rather than as the caller; passwd uses it as root to edit /etc/shadow. It appears as s in the owner execute slot and has numeric value 4000. Since SUID root binaries are a security risk, I keep them minimal and audit them with find -perm -4000."
Common mistakes
- Setting SUID on shell scripts; the kernel ignores it for scripts on most Linux systems.