`usermod --add-subuids` needs to read `/etc/shadow`?

[jcpunk]

When I run usermod with all capabilities dropped and have no access to /etc/shadow, usermod fails complaining that it can't read /etc/shadow.

I don't think it should need access for sub{u,g}id processing?

[alejandro-colomar]

Would you mind sending a patch?

[jcpunk]

I fear I'm not a sufficiently skilled C programer that I'd trust a patch from me for something like shadow-utils. I don't really see where the call is taking place (unless it is https://github.com/shadow-maint/shadow/blob/master/src/usermod.c#L2192 in which case I have no idea the risks of putting a flag around it).

[alejandro-colomar]

Okay, could you please show a reproducer shell session and I'll inspect where the error comes from?

[jcpunk]

I discovered this playing around with removal of all capbilities for interactive root sessions. Since /etc/subuid appears writable to root in general I thought this might be workable.

root@leibniz:~# rpm -q shadow-utils
shadow-utils-4.18.0-3.fc43.x86_64
root@leibniz:~# ls -l /etc/subuid
-rw-r--r--. 1 root root 22 Sep  5 14:20 /etc/subuid
root@leibniz:~# cat /etc/subuid
riehecky:524288:65536
root@leibniz:~# capsh --drop=all --inh= --secbits=0 --uid=$(id -u) --gid=$(id -g) --
root@leibniz:~# strace -ff usermod --add-subuid 10000-11000 testuser
execve("/usr/sbin/usermod", ["usermod", "--add-subuid", "10000-11000", "testuser"], 0x7ffd7a6b7c20 /* 44 vars */) = 0
brk(NULL)                               = 0x55c38972c000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=112811, ...}) = 0
mmap(NULL, 112811, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f8b99bb3000
close(3)                                = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8b99bb1000
openat(AT_FDCWD, "/lib64/libaudit.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=180032, ...}) = 0
mmap(NULL, 229824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f8b99b78000
mmap(0x7f8b99b86000, 118784, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xe000) = 0x7f8b99b86000
mmap(0x7f8b99ba3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2a000) = 0x7f8b99ba3000
mmap(0x7f8b99ba5000, 45504, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f8b99ba5000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libselinux.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=196664, ...}) = 0
mmap(NULL, 198088, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f8b99b47000
mmap(0x7f8b99b67000, 53248, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x20000) = 0x7f8b99b67000
mmap(0x7f8b99b74000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2d000) = 0x7f8b99b74000
mmap(0x7f8b99b76000, 5576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f8b99b76000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libsemanage.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=284096, ...}) = 0
mmap(NULL, 275592, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f8b99b03000
mmap(0x7f8b99b2b000, 102400, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x28000) = 0x7f8b99b2b000
mmap(0x7f8b99b44000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x41000) = 0x7f8b99b44000
mmap(0x7f8b99b46000, 1160, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f8b99b46000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libacl.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=36728, ...}) = 0
mmap(NULL, 36888, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f8b99af9000
mmap(0x7f8b99afe000, 12288, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x5000) = 0x7f8b99afe000
mmap(0x7f8b99b01000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x7000) = 0x7f8b99b01000
mmap(0x7f8b99b02000, 24, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f8b99b02000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libeconf.so.0", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=53352, ...}) = 0
mmap(NULL, 50304, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f8b99aec000
mmap(0x7f8b99af4000, 12288, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x8000) = 0x7f8b99af4000
mmap(0x7f8b99af7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xb000) = 0x7f8b99af7000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p7\0\0\0\0\0\0"..., 832) = 832
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 784, 64) = 784
fstat(3, {st_mode=S_IFREG|0755, st_size=2455432, ...}) = 0
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 784, 64) = 784
mmap(NULL, 2042928, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f8b998f9000
mmap(0x7f8b99a68000, 483328, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x16f000) = 0x7f8b99a68000
mmap(0x7f8b99ade000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1e4000) = 0x7f8b99ade000
mmap(0x7f8b99ae4000, 31792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f8b99ae4000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libcap-ng.so.0", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=32200, ...}) = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8b998f7000
mmap(NULL, 28760, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f8b998ef000
mmap(0x7f8b998f3000, 8192, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4000) = 0x7f8b998f3000
mmap(0x7f8b998f5000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x6000) = 0x7f8b998f5000
mmap(0x7f8b998f6000, 88, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f8b998f6000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libpcre2-8.so.0", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=707840, ...}) = 0
mmap(NULL, 704984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f8b99842000
mmap(0x7f8b998c0000, 184320, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x7e000) = 0x7f8b998c0000
mmap(0x7f8b998ed000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xaa000) = 0x7f8b998ed000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libsepol.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=815216, ...}) = 0
mmap(NULL, 802280, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f8b9977e000
mmap(0x7f8b99819000, 159744, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x9b000) = 0x7f8b99819000
mmap(0x7f8b99840000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xc2000) = 0x7f8b99840000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libbz2.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=80576, ...}) = 0
mmap(NULL, 80904, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f8b9976a000
mmap(0x7f8b99779000, 12288, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xf000) = 0x7f8b99779000
mmap(0x7f8b9977c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x11000) = 0x7f8b9977c000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libattr.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=24128, ...}) = 0
mmap(NULL, 24592, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f8b99763000
mmap(0x7f8b99766000, 8192, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x7f8b99766000
mmap(0x7f8b99768000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4000) = 0x7f8b99768000
mmap(0x7f8b99769000, 16, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f8b99769000
close(3)                                = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8b99761000
mmap(NULL, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8b9975e000
arch_prctl(ARCH_SET_FS, 0x7f8b9975e880) = 0
set_tid_address(0x7f8b9975eb50)         = 201116
set_robust_list(0x7f8b9975eb60, 24)     = 0
rseq(0x7f8b9975e6a0, 0x20, 0, 0x53053053) = 0
mprotect(0x7f8b99ade000, 16384, PROT_READ) = 0
mprotect(0x7f8b99768000, 4096, PROT_READ) = 0
mprotect(0x7f8b9977c000, 4096, PROT_READ) = 0
mprotect(0x7f8b99840000, 4096, PROT_READ) = 0
mprotect(0x7f8b998ed000, 4096, PROT_READ) = 0
mprotect(0x7f8b998f5000, 4096, PROT_READ) = 0
mprotect(0x7f8b99af7000, 4096, PROT_READ) = 0
mprotect(0x7f8b99b01000, 4096, PROT_READ) = 0
mprotect(0x7f8b99ba3000, 4096, PROT_READ) = 0
mprotect(0x7f8b99b74000, 4096, PROT_READ) = 0
mprotect(0x7f8b99b44000, 8192, PROT_READ) = 0
mprotect(0x55c384efe000, 4096, PROT_READ) = 0
mprotect(0x7f8b99c0d000, 8192, PROT_READ) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
getrandom("\x53\x92\x30\x27\x15\xb4\xa7\x89", 8, GRND_NONBLOCK) = 8
munmap(0x7f8b99bb3000, 112811)          = 0
openat(AT_FDCWD, "/proc/sys/kernel/cap_last_cap", O_RDONLY) = 3
fstatfs(3, {f_type=PROC_SUPER_MAGIC, f_bsize=4096, f_blocks=0, f_bfree=0, f_bavail=0, f_files=0, f_ffree=0, f_fsid={val=[0x18, 0]}, f_namelen=255, f_frsize=4096, f_flags=ST_VALID|ST_NOSUID|ST_NODEV|ST_NOEXEC|ST_RELATIME}) = 0
read(3, "40\n", 7)                      = 3
close(3)                                = 0
prctl(PR_CAPBSET_READ, CAP_CHOWN)       = 0
prctl(PR_GET_SECUREBITS)                = 0
prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)  = 0
prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) = 0
statfs("/sys/fs/selinux", {f_type=SELINUX_MAGIC, f_bsize=4096, f_blocks=0, f_bfree=0, f_bavail=0, f_files=0, f_ffree=0, f_fsid={val=[0x16, 0]}, f_namelen=255, f_frsize=4096, f_flags=ST_VALID|ST_NOSUID|ST_NOEXEC|ST_RELATIME}) = 0
statfs("/sys/fs/selinux", {f_type=SELINUX_MAGIC, f_bsize=4096, f_blocks=0, f_bfree=0, f_bavail=0, f_files=0, f_ffree=0, f_fsid={val=[0x16, 0]}, f_namelen=255, f_frsize=4096, f_flags=ST_VALID|ST_NOSUID|ST_NOEXEC|ST_RELATIME}) = 0
brk(NULL)                               = 0x55c38972c000
brk(0x55c38974d000)                     = 0x55c38974d000
access("/etc/selinux/config", F_OK)     = 0
openat(AT_FDCWD, "/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=233242544, ...}) = 0
mmap(NULL, 233242544, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f8b8b800000
close(3)                                = 0
socket(AF_NETLINK, SOCK_RAW|SOCK_CLOEXEC, NETLINK_AUDIT) = 3
openat(AT_FDCWD, "/proc/sys/kernel/ngroups_max", O_RDONLY|O_CLOEXEC) = 4
read(4, "65536\n", 31)                  = 6
close(4)                                = 0
mmap(NULL, 528384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8b996dd000
newfstatat(AT_FDCWD, "/etc/login.defs", {st_mode=S_IFREG|0644, st_size=8888, ...}, AT_SYMLINK_NOFOLLOW) = 0
openat(AT_FDCWD, "/etc/login.defs", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=8888, ...}) = 0
read(4, "#\n# Please note that the paramet"..., 4096) = 4096
read(4, "ID_MIN                  1000\nUID"..., 4096) = 4096
read(4, " line length in the\n# group file"..., 4096) = 696
read(4, "", 4096)                       = 0
close(4)                                = 0
openat(AT_FDCWD, "/login.defs.d", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/login.defs.d", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = -1 ENOENT (No such file or directory)
access("/etc/shadow", F_OK)             = 0
access("/etc/gshadow", F_OK)            = 0
access("/etc/subuid", F_OK)             = 0
access("/etc/subgid", F_OK)             = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=687, ...}, 0) = 0
newfstatat(AT_FDCWD, "/", {st_mode=S_IFDIR|0555, st_size=170, ...}, 0) = 0
openat(AT_FDCWD, "/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=687, ...}) = 0
read(4, "# Generated by authselect\n# Do n"..., 4096) = 687
read(4, "", 4096)                       = 0
fstat(4, {st_mode=S_IFREG|0644, st_size=687, ...}) = 0
close(4)                                = 0
openat(AT_FDCWD, "/etc/passwd", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=3327, ...}) = 0
lseek(4, 0, SEEK_SET)                   = 0
read(4, "root:x:0:0:Super User:/root:/bin"..., 4096) = 3327
close(4)                                = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=687, ...}, 0) = 0
openat(AT_FDCWD, "/etc/shadow", O_RDONLY|O_CLOEXEC) = -1 EACCES (Permission denied)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=112811, ...}) = 0
mmap(NULL, 112811, PROT_READ, MAP_PRIVATE, 4, 0) = 0x7f8b99bb3000
close(4)                                = 0
openat(AT_FDCWD, "/lib64/libnss_systemd.so.2", O_RDONLY|O_CLOEXEC) = 4
read(4, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(4, {st_mode=S_IFREG|0755, st_size=466344, ...}) = 0
mmap(NULL, 457384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7f8b8b790000
mmap(0x7f8b8b7df000, 106496, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x4f000) = 0x7f8b8b7df000
mmap(0x7f8b8b7f9000, 28672, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x69000) = 0x7f8b8b7f9000
close(4)                                = 0
openat(AT_FDCWD, "/lib64/libm.so.6", O_RDONLY|O_CLOEXEC) = 4
read(4, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(4, {st_mode=S_IFREG|0755, st_size=1013376, ...}) = 0
mmap(NULL, 999440, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7f8b8b69b000
mmap(0x7f8b8b71d000, 462848, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x82000) = 0x7f8b8b71d000
mmap(0x7f8b8b78e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0xf2000) = 0x7f8b8b78e000
close(4)                                = 0
openat(AT_FDCWD, "/lib64/libcap.so.2", O_RDONLY|O_CLOEXEC) = 4
read(4, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 V\0\0\0\0\0\0"..., 832) = 832
fstat(4, {st_mode=S_IFREG|0755, st_size=44992, ...}) = 0
mmap(NULL, 45128, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7f8b996d1000
mmap(0x7f8b996d7000, 16384, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x6000) = 0x7f8b996d7000
mmap(0x7f8b996db000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x9000) = 0x7f8b996db000
close(4)                                = 0
openat(AT_FDCWD, "/lib64/libgcc_s.so.1", O_RDONLY|O_CLOEXEC) = 4
read(4, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(4, {st_mode=S_IFREG|0755, st_size=182376, ...}) = 0
mmap(NULL, 176584, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7f8b996a5000
mmap(0x7f8b996c8000, 28672, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x23000) = 0x7f8b996c8000
mmap(0x7f8b996cf000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x2a000) = 0x7f8b996cf000
mmap(0x7f8b996d0000, 456, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f8b996d0000
close(4)                                = 0
mprotect(0x7f8b996cf000, 4096, PROT_READ) = 0
mprotect(0x7f8b996db000, 4096, PROT_READ) = 0
mprotect(0x7f8b8b78e000, 4096, PROT_READ) = 0
mprotect(0x7f8b8b7f9000, 24576, PROT_READ) = 0
prctl(PR_CAPBSET_READ, CAP_MAC_OVERRIDE) = 0
prctl(PR_CAPBSET_READ, 0x30 /* CAP_??? */) = -1 EINVAL (Invalid argument)
prctl(PR_CAPBSET_READ, CAP_CHECKPOINT_RESTORE) = 0
prctl(PR_CAPBSET_READ, 0x2c /* CAP_??? */) = -1 EINVAL (Invalid argument)
prctl(PR_CAPBSET_READ, 0x2a /* CAP_??? */) = -1 EINVAL (Invalid argument)
prctl(PR_CAPBSET_READ, 0x29 /* CAP_??? */) = -1 EINVAL (Invalid argument)
munmap(0x7f8b99bb3000, 112811)          = 0
futex(0x7f8b8b7ffa58, FUTEX_WAKE_PRIVATE, 2147483647) = 0
rt_sigprocmask(SIG_BLOCK, [HUP USR1 USR2 PIPE ALRM CHLD TSTP URG VTALRM PROF WINCH IO], [], 8) = 0
openat(AT_FDCWD, "/run/systemd/userdb/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0755, st_size=140, ...}) = 0
getdents64(4, 0x55c389744210 /* 7 entries */, 32768) = 272
socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5
connect(5, {sa_family=AF_UNIX, sun_path="/run/systemd/userdb/io.systemd.Machine"}, 41) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [HUP USR1 USR2 PIPE ALRM CHLD TSTP URG VTALRM PROF WINCH IO], 8) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_DROPPABLE|MAP_ANONYMOUS, -1, 0) = 0x7f8b99bce000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8b99bcd000
rt_sigprocmask(SIG_SETMASK, [HUP USR1 USR2 PIPE ALRM CHLD TSTP URG VTALRM PROF WINCH IO], NULL, 8) = 0
getrandom("\x6c\x48\x76\xf2\x05\x04\x73\xed\xae\xed\x29\xcf\x8b\x5c\x95\xda\x61\xc7\x7a\x7a\x8a\x46\xc8\x52\x71\x23\x76\xb3\x76\x9f\x8f\xd6", 32, 0) = 32
futex(0x7f8b8b7ffa90, FUTEX_WAKE_PRIVATE, 2147483647) = 0
getpid()                                = 201116
epoll_create1(EPOLL_CLOEXEC)            = 6
timerfd_create(CLOCK_MONOTONIC, TFD_CLOEXEC|TFD_NONBLOCK) = 7
epoll_ctl(6, EPOLL_CTL_ADD, 7, {events=EPOLLIN, data=0x55c38973f1f0}) = 0
epoll_ctl(6, EPOLL_CTL_ADD, 5, {events=0, data=0x55c389739f80}) = 0
brk(0x55c38976f000)                     = 0x55c38976f000
brk(0x55c38976d000)                     = 0x55c38976d000
futex(0x7f8b8b7ffa74, FUTEX_WAKE_PRIVATE, 2147483647) = 0
socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 8
connect(8, {sa_family=AF_UNIX, sun_path="/run/systemd/userdb/io.systemd.DropIn"}, 40) = 0
epoll_ctl(6, EPOLL_CTL_ADD, 8, {events=0, data=0x55c389743d70}) = 0
socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 9
connect(9, {sa_family=AF_UNIX, sun_path="/run/systemd/userdb/io.systemd.DynamicUser"}, 45) = 0
epoll_ctl(6, EPOLL_CTL_ADD, 9, {events=0, data=0x55c38973d6a0}) = 0
getdents64(4, 0x55c389744210 /* 0 entries */, 32768) = 0
close(4)                                = 0
epoll_ctl(6, EPOLL_CTL_MOD, 5, {events=EPOLLIN|EPOLLOUT, data=0x55c389739f80}) = 0
epoll_ctl(6, EPOLL_CTL_MOD, 8, {events=EPOLLIN|EPOLLOUT, data=0x55c389743d70}) = 0
epoll_ctl(6, EPOLL_CTL_MOD, 9, {events=EPOLLIN|EPOLLOUT, data=0x55c38973d6a0}) = 0
openat(AT_FDCWD, "/proc/sys/kernel/random/boot_id", O_RDONLY|O_NOCTTY|O_CLOEXEC) = 4
read(4, "3bb5d665-26f9-497a-b761-9e2ecfaf"..., 38) = 37
read(4, "", 1)                          = 0
close(4)                                = 0
timerfd_settime(7, TFD_TIMER_ABSTIME, {it_interval={tv_sec=0, tv_nsec=0}, it_value={tv_sec=158015, tv_nsec=974092000}}, NULL) = 0
epoll_pwait2(6, [{events=EPOLLOUT, data=0x55c389739f80}, {events=EPOLLOUT, data=0x55c389743d70}, {events=EPOLLOUT, data=0x55c38973d6a0}], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 3
sendto(5, "{\"method\":\"io.systemd.UserDataba"..., 119, MSG_DONTWAIT|MSG_NOSIGNAL, NULL, 0) = 119
epoll_ctl(6, EPOLL_CTL_MOD, 5, {events=EPOLLIN, data=0x55c389739f80}) = 0
epoll_pwait2(6, [{events=EPOLLOUT, data=0x55c389743d70}, {events=EPOLLOUT, data=0x55c38973d6a0}], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 2
sendto(8, "{\"method\":\"io.systemd.UserDataba"..., 118, MSG_DONTWAIT|MSG_NOSIGNAL, NULL, 0) = 118
epoll_ctl(6, EPOLL_CTL_MOD, 8, {events=EPOLLIN, data=0x55c389743d70}) = 0
epoll_pwait2(6, [{events=EPOLLOUT, data=0x55c38973d6a0}, {events=EPOLLIN, data=0x55c389739f80}], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 2
recvfrom(5, "{\"error\":\"io.systemd.UserDatabas"..., 131080, MSG_DONTWAIT, NULL, NULL) = 50
epoll_ctl(6, EPOLL_CTL_MOD, 5, {events=0, data=0x55c389739f80}) = 0
epoll_pwait2(6, [{events=EPOLLOUT, data=0x55c38973d6a0}], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 1
epoll_pwait2(6, [{events=EPOLLOUT, data=0x55c38973d6a0}], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 1
epoll_ctl(6, EPOLL_CTL_DEL, 5, NULL)    = 0
close(5)                                = 0
epoll_pwait2(6, [{events=EPOLLOUT, data=0x55c38973d6a0}], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 1
recvfrom(8, 0x55c38974c3b0, 131080, MSG_DONTWAIT, NULL, NULL) = -1 EAGAIN (Resource temporarily unavailable)
epoll_pwait2(6, [{events=EPOLLOUT, data=0x55c38973d6a0}, {events=EPOLLIN, data=0x55c389743d70}], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 2
sendto(9, "{\"method\":\"io.systemd.UserDataba"..., 123, MSG_DONTWAIT|MSG_NOSIGNAL, NULL, 0) = 123
epoll_ctl(6, EPOLL_CTL_MOD, 9, {events=EPOLLIN, data=0x55c38973d6a0}) = 0
epoll_pwait2(6, [{events=EPOLLIN, data=0x55c389743d70}], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 1
mmap(NULL, 135168, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8b99684000
recvfrom(9, "{\"error\":\"io.systemd.UserDatabas"..., 135152, MSG_DONTWAIT, NULL, NULL) = 50
epoll_ctl(6, EPOLL_CTL_MOD, 9, {events=0, data=0x55c38973d6a0}) = 0
epoll_pwait2(6, [{events=EPOLLIN, data=0x55c389743d70}], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 1
epoll_pwait2(6, [{events=EPOLLIN, data=0x55c389743d70}], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 1
epoll_ctl(6, EPOLL_CTL_DEL, 9, NULL)    = 0
close(9)                                = 0
munmap(0x7f8b99684000, 135168)          = 0
epoll_pwait2(6, [{events=EPOLLIN, data=0x55c389743d70}], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 1
recvfrom(8, "{\"error\":\"io.systemd.UserDatabas"..., 131080, MSG_DONTWAIT, NULL, NULL) = 50
epoll_ctl(6, EPOLL_CTL_MOD, 8, {events=0, data=0x55c389743d70}) = 0
epoll_pwait2(6, [], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 0
epoll_pwait2(6, [], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 0
epoll_ctl(6, EPOLL_CTL_DEL, 8, NULL)    = 0
close(8)                                = 0
close(6)                                = 0
close(7)                                = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
openat(AT_FDCWD, "/etc/.pwd.lock", O_WRONLY|O_CREAT|O_CLOEXEC, 0600) = 4
rt_sigaction(SIGALRM, {sa_handler=0x7f8b99a24650, sa_mask=~[], sa_flags=SA_RESTORER, sa_restorer=0x7f8b99913290}, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [ALRM], [], 8) = 0
alarm(15)                               = 0
fcntl(4, F_SETLKW, {l_type=F_WRLCK, l_whence=SEEK_SET, l_start=0, l_len=0}) = 0
alarm(0)                                = 15
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigaction(SIGALRM, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f8b99913290}, NULL, 8) = 0
getpid()                                = 201116
openat(AT_FDCWD, "/etc/passwd.201116", O_WRONLY|O_CREAT|O_TRUNC, 0600) = 5
getpid()                                = 201116
write(5, "201116\0", 7)                 = 7
fdatasync(5)                            = 0
close(5)                                = 0
link("/etc/passwd.201116", "/etc/passwd.lock") = 0
newfstatat(AT_FDCWD, "/etc/passwd.201116", {st_mode=S_IFREG|0600, st_size=7, ...}, 0) = 0
unlink("/etc/passwd.201116")            = 0
openat(AT_FDCWD, "/etc/passwd", O_RDWR|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW|O_CLOEXEC) = 5
fcntl(5, F_GETFL)                       = 0x28802 (flags O_RDWR|O_NONBLOCK|O_LARGEFILE|O_NOFOLLOW)
fstat(5, {st_mode=S_IFREG|0644, st_size=3327, ...}) = 0
read(5, "root:x:0:0:Super User:/root:/bin"..., 4096) = 3327
read(5, "", 4096)                       = 0
getpid()                                = 201116
openat(AT_FDCWD, "/etc/shadow.201116", O_WRONLY|O_CREAT|O_TRUNC, 0600) = 6
getpid()                                = 201116
write(6, "201116\0", 7)                 = 7
fdatasync(6)                            = 0
close(6)                                = 0
link("/etc/shadow.201116", "/etc/shadow.lock") = 0
newfstatat(AT_FDCWD, "/etc/shadow.201116", {st_mode=S_IFREG|0600, st_size=7, ...}, 0) = 0
unlink("/etc/shadow.201116")            = 0
openat(AT_FDCWD, "/etc/shadow", O_RDWR|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW|O_CLOEXEC) = -1 EACCES (Permission denied)
openat(AT_FDCWD, "/usr/share/locale/locale.alias", O_RDONLY|O_CLOEXEC) = 6
fstat(6, {st_mode=S_IFREG|0644, st_size=2998, ...}) = 0
read(6, "# Locale name alias data base.\n#"..., 4096) = 2998
read(6, "", 4096)                       = 0
close(6)                                = 0
openat(AT_FDCWD, "/usr/share/locale/en_US.UTF-8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/share/locale/en_US.utf8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/share/locale/en_US/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/share/locale/en.UTF-8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/share/locale/en.utf8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/share/locale/en/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
write(2, "usermod: cannot open /etc/shadow"..., 33usermod: cannot open /etc/shadow
) = 33
unlink("/etc/shadow.lock")              = 0
close(5)                                = 0
unlink("/etc/passwd.lock")              = 0
close(4)                                = 0
readlink("/proc/self/exe", "/usr/bin/usermod", 4096) = 16
ioctl(0, TCGETS2, {c_iflag=ICRNL|IXON|IUTF8, c_oflag=NL0|CR0|TAB0|BS0|VT0|FF0|OPOST|ONLCR, c_cflag=B38400|B38400<<IBSHIFT|CS8|CREAD, c_lflag=ISIG|ICANON|ECHO|ECHOE|ECHOK|IEXTEN|ECHOCTL|ECHOKE, ...}) = 0
fstat(0, {st_mode=S_IFCHR|0600, st_rdev=makedev(0x88, 0x2), ...}) = 0
readlink("/proc/self/fd/0", "/dev/pts/2", 31) = 10
newfstatat(AT_FDCWD, "/dev/pts/2", {st_mode=S_IFCHR|0600, st_rdev=makedev(0x88, 0x2), ...}, 0) = 0
newfstatat(AT_FDCWD, "/dev/pts/2", {st_mode=S_IFCHR|0600, st_rdev=makedev(0x88, 0x2), ...}, AT_SYMLINK_NOFOLLOW) = 0
uname({sysname="Linux", nodename="leibniz.local", ...}) = 0
sendto(3, [{nlmsg_len=132, nlmsg_type=0x44e /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=1, nlmsg_pid=0}, "\x6f\x70\x3d\x6d\x6f\x64\x69\x66\x79\x2d\x61\x63\x63\x6f\x75\x6e\x74\x20\x61\x63\x63\x74\x3d\x22\x74\x65\x73\x74\x75\x73\x65\x72"...], 132, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 132
poll([{fd=3, events=POLLIN}], 1, 500)   = 1 ([{fd=3, revents=POLLIN}])
recvfrom(3, [{nlmsg_len=152, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=1, nlmsg_pid=201116}, {error=-EPERM, msg=[{nlmsg_len=132, nlmsg_type=0x44e /* AUDIT_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=1, nlmsg_pid=0}, "\x6f\x70\x3d\x6d\x6f\x64\x69\x66\x79\x2d\x61\x63\x63\x6f\x75\x6e\x74\x20\x61\x63\x63\x74\x3d\x22\x74\x65\x73\x74\x75\x73\x65\x72"...]}], 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, [12]) = 152
recvfrom(3, [{nlmsg_len=152, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=1, nlmsg_pid=201116}, {error=-EPERM, msg=[{nlmsg_len=132, nlmsg_type=0x44e /* AUDIT_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=1, nlmsg_pid=0}, "\x6f\x70\x3d\x6d\x6f\x64\x69\x66\x79\x2d\x61\x63\x63\x6f\x75\x6e\x74\x20\x61\x63\x63\x74\x3d\x22\x74\x65\x73\x74\x75\x73\x65\x72"...]}], 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, [12]) = 152
capget({version=0 /* _LINUX_CAPABILITY_VERSION_??? */, pid=0}, NULL) = 0
gettid()                                = 201116
capget({version=_LINUX_CAPABILITY_VERSION_3, pid=201116}, {effective=0, permitted=0, inheritable=0}) = 0
openat(AT_FDCWD, "/proc/201116/status", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
read(4, "Name:\tusermod\nUmask:\t0022\nState:"..., 1024) = 1024
lseek(4, 0, SEEK_CUR)                   = 1024
lseek(4, 860, SEEK_SET)                 = 860
close(4)                                = 0
openat(AT_FDCWD, "/proc/201116/status", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
read(4, "Name:\tusermod\nUmask:\t0022\nState:"..., 1024) = 1024
lseek(4, 0, SEEK_CUR)                   = 1024
lseek(4, 885, SEEK_SET)                 = 885
close(4)                                = 0
exit_group(1)                           = ?
+++ exited with 1 +++
root@leibniz:~# usermod --add-subuid 10000-11000 testuser
usermod: cannot open /etc/shadow

[jcpunk]

I forgot stat /etc/shadow:

stat /etc/shadow
  File: /etc/shadow
  Size: 1506            Blocks: 8          IO Block: 4096   regular file
Device: 0,36    Inode: 17080655    Links: 1
Access: (0000/----------)  Uid: (    0/    root)   Gid: (    0/    root)
Context: system_u:object_r:shadow_t:s0
Access: 2026-02-16 04:05:00.053989840 -0600
Modify: 2026-01-28 14:05:42.801738166 -0600
Change: 2026-01-28 14:05:42.802535779 -0600
 Birth: 2026-01-28 14:05:42.800535755 -0600

Locks on /etc/passwd, etc probably make sense to ensure the user has a consistent state when fiddling with the attributes, but since these are non-shadow attribs it feels odd to lock it.

[alejandro-colomar]

I discovered this playing around with removal of all capbilities for interactive root sessions. Since /etc/subuid appears writable to root in general I thought this might be workable.

root@leibniz:~# rpm -q shadow-utils
shadow-utils-4.18.0-3.fc43.x86_64
root@leibniz:~# ls -l /etc/subuid
-rw-r--r--. 1 root root 22 Sep  5 14:20 /etc/subuid
root@leibniz:~# cat /etc/subuid
riehecky:524288:65536
root@leibniz:~# capsh --drop=all --inh= --secbits=0 --uid=$(id -u) --gid=$(id -g) --
root@leibniz:~# strace -ff usermod --add-subuid 10000-11000 testuser

Hummm, this is weird. The flag should be --add-subuids with a trailing 's'.

alx@devuan:~/src/shadow/shadow/master$ grep -rn 'add-subuid' src/usermod.c 
420:	(void) fputs (_("  -v, --add-subuids FIRST-LAST  add range of subordinate uids\n"), usageout);
1037:			{"add-subuids",  required_argument, NULL, 'v'},

And it has been unchanged since at least 2013.

alx@devuan:~/src/shadow/shadow/master$ git blame -- src/usermod.c | grep add-subuid
d5b3092331d59 (Eric W. Biederman       2013-01-22 01:18:24 -0800  420) 	(void) fputs (_("  -v, --add-subuids FIRST-LAST  add range of subordinate uids\n"), usageout);
d5b3092331d59 (Eric W. Biederman       2013-01-22 01:18:24 -0800 1037) 		{"add-subuids",  required_argument, NULL, 'v'},

Do you have a patched usermod(8)?

This is vital to understanding the path the program is running.

execve("/usr/sbin/usermod", ["usermod", "--add-subuid", "10000-11000", "testuser"], 0x7ffd7a6b7c20 /* 44 vars */) = 0

[...]

openat(AT_FDCWD, "/etc/login.defs.d", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = -1 ENOENT (No such file or directory)
access("/etc/shadow", F_OK)             = 0
access("/etc/gshadow", F_OK)            = 0

The two access(2) calls above, I'm pretty sure they come from

shadow/src/usermod.c

Lines 2192 to 2195 in eaf5b83

	is_shadow_pwd = spw_file_present ();
	#ifdef SHADOWGRP
	is_shadow_grp = sgr_file_present ();
	#endif

Those two are just access(2) calls:

alx@devuan:~/src/shadow/shadow/master$ grepc spw_file_present .
./lib/shadowio.c:bool spw_file_present (void)
{
	if (getdef_bool ("FORCE_SHADOW"))
		return true;
	return commonio_present (&shadow_db);
}
./lib/shadowio.h:extern bool spw_file_present (void);
alx@devuan:~/src/shadow/shadow/master$ grepc commonio_present .
./lib/commonio.c:bool commonio_present (const struct commonio_db *db)
{
	return (access (db->filename, F_OK) == 0);
}
./lib/commonio.h:extern bool commonio_present (const struct commonio_db *db);
alx@devuan:~/src/shadow/shadow/master$ grepc sgr_file_present .
./lib/sgroupio.h:extern bool sgr_file_present (void);
./lib/sgroupio.c:bool sgr_file_present (void)
{
	if (getdef_bool ("FORCE_SHADOW"))
		return true;
	return commonio_present (&gshadow_db);
}

access("/etc/subuid", F_OK)             = 0
access("/etc/subgid", F_OK)             = 0

These two most likely come from

shadow/src/usermod.c

Lines 2196 to 2199 in eaf5b83

	#ifdef ENABLE_SUBIDS
	is_sub_uid = want_subuid_file() && sub_uid_file_present();
	is_sub_gid = want_subgid_file() && sub_gid_file_present();
	#endif /* ENABLE_SUBIDS */

(from sub_uid_file_present() and sub_gid_file_present())

newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=687, ...}, 0) = 0

I'm a bit surprised to see this after the access(2) calls above, since the nss stuff is part of want_subuid_file(). The optimizer might be shuffling these around...

I can't continue analyzing the source code past here, since it starts branching, and the flag you passed is not upstream, so I don't know what branches it might take. Please show any downstream patches that might provide that flag.

newfstatat(AT_FDCWD, "/", {st_mode=S_IFDIR|0555, st_size=170, ...}, 0) = 0
[...]
exit_group(1) = ?
+++ exited with 1 +++
root@leibniz:~# usermod --add-subuid 10000-11000 testuser
usermod: cannot open /etc/shadow

This error almost certainly comes from:

shadow/src/usermod.c

Lines 1642 to 1647 in eaf5b83

	if (is_shadow_pwd && (spw_open (O_CREAT | O_RDWR) == 0)) {
	fprintf (stderr,
	_("%s: cannot open %s\n"),
	Prog, spw_dbname ());
	fail_exit (E_PW_UPDATE, process_selinux);
	}

[jcpunk]

In my haste to provide a reproducer, I made a typo. It is interesting that it tries to lock those files when I've provided a garbage argument!

This should be a sample with the normal flags for usermod. I'm running the stock shadow-utils from Fedora and show only the patches listed here https://src.fedoraproject.org/rpms/shadow-utils/tree/f43:

• shadow-4.18.0-account-tools-setuid.patch
• shadow-4.15.0-manfix.patch

root@leibniz:/home/riehecky# cd 
root@leibniz:~# rpm -q shadow-utils
shadow-utils-4.18.0-3.fc43.x86_64
root@leibniz:~# ls -l /etc/subuid
-rw-r--r--. 1 root root 22 Sep  5 14:20 /etc/subuid
root@leibniz:~# cat /etc/subuid
riehecky:524288:65536
root@leibniz:~# capsh --drop=all --inh= --secbits=0 --uid=$(id -u) --gid=$(id -g) --
root@leibniz:~# usermod --add-subuids 10000-11000 testuser
usermod: cannot open /etc/shadow
root@leibniz:~# exit
root@leibniz:~# usermod --add-subuids 10000-11000 testuser
root@leibniz:~# cat /etc/subuid
riehecky:524288:65536
testuser:10000:1001
root@leibniz:~# capsh --drop=all --inh= --secbits=0 --uid=$(id -u) --gid=$(id -g) --
root@leibniz:~# strace -ff usermod --add-subuids 12000-13000 testuser
execve("/usr/sbin/usermod", ["usermod", "--add-subuids", "12000-13000", "testuser"], 0x7ffdc4696190 /* 44 vars */) = 0
brk(NULL)                               = 0x564aafda9000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=112811, ...}) = 0
mmap(NULL, 112811, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f728d0d7000
close(3)                                = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f728d0d5000
openat(AT_FDCWD, "/lib64/libaudit.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=180032, ...}) = 0
mmap(NULL, 229824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f728d09c000
mmap(0x7f728d0aa000, 118784, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xe000) = 0x7f728d0aa000
mmap(0x7f728d0c7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2a000) = 0x7f728d0c7000
mmap(0x7f728d0c9000, 45504, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f728d0c9000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libselinux.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=196664, ...}) = 0
mmap(NULL, 198088, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f728d06b000
mmap(0x7f728d08b000, 53248, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x20000) = 0x7f728d08b000
mmap(0x7f728d098000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2d000) = 0x7f728d098000
mmap(0x7f728d09a000, 5576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f728d09a000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libsemanage.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=284096, ...}) = 0
mmap(NULL, 275592, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f728d027000
mmap(0x7f728d04f000, 102400, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x28000) = 0x7f728d04f000
mmap(0x7f728d068000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x41000) = 0x7f728d068000
mmap(0x7f728d06a000, 1160, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f728d06a000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libacl.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=36728, ...}) = 0
mmap(NULL, 36888, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f728d01d000
mmap(0x7f728d022000, 12288, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x5000) = 0x7f728d022000
mmap(0x7f728d025000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x7000) = 0x7f728d025000
mmap(0x7f728d026000, 24, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f728d026000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libeconf.so.0", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=53352, ...}) = 0
mmap(NULL, 50304, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f728d010000
mmap(0x7f728d018000, 12288, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x8000) = 0x7f728d018000
mmap(0x7f728d01b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xb000) = 0x7f728d01b000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p7\0\0\0\0\0\0"..., 832) = 832
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 784, 64) = 784
fstat(3, {st_mode=S_IFREG|0755, st_size=2455432, ...}) = 0
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 784, 64) = 784
mmap(NULL, 2042928, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f728ce1d000
mmap(0x7f728cf8c000, 483328, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x16f000) = 0x7f728cf8c000
mmap(0x7f728d002000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1e4000) = 0x7f728d002000
mmap(0x7f728d008000, 31792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f728d008000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libcap-ng.so.0", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=32200, ...}) = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f728ce1b000
mmap(NULL, 28760, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f728ce13000
mmap(0x7f728ce17000, 8192, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4000) = 0x7f728ce17000
mmap(0x7f728ce19000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x6000) = 0x7f728ce19000
mmap(0x7f728ce1a000, 88, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f728ce1a000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libpcre2-8.so.0", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=707840, ...}) = 0
mmap(NULL, 704984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f728cd66000
mmap(0x7f728cde4000, 184320, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x7e000) = 0x7f728cde4000
mmap(0x7f728ce11000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xaa000) = 0x7f728ce11000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libsepol.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=815216, ...}) = 0
mmap(NULL, 802280, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f728cca2000
mmap(0x7f728cd3d000, 159744, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x9b000) = 0x7f728cd3d000
mmap(0x7f728cd64000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xc2000) = 0x7f728cd64000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libbz2.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=80576, ...}) = 0
mmap(NULL, 80904, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f728cc8e000
mmap(0x7f728cc9d000, 12288, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xf000) = 0x7f728cc9d000
mmap(0x7f728cca0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x11000) = 0x7f728cca0000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libattr.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=24128, ...}) = 0
mmap(NULL, 24592, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f728cc87000
mmap(0x7f728cc8a000, 8192, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x7f728cc8a000
mmap(0x7f728cc8c000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4000) = 0x7f728cc8c000
mmap(0x7f728cc8d000, 16, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f728cc8d000
close(3)                                = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f728cc85000
mmap(NULL, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f728cc82000
arch_prctl(ARCH_SET_FS, 0x7f728cc82880) = 0
set_tid_address(0x7f728cc82b50)         = 204054
set_robust_list(0x7f728cc82b60, 24)     = 0
rseq(0x7f728cc826a0, 0x20, 0, 0x53053053) = 0
mprotect(0x7f728d002000, 16384, PROT_READ) = 0
mprotect(0x7f728cc8c000, 4096, PROT_READ) = 0
mprotect(0x7f728cca0000, 4096, PROT_READ) = 0
mprotect(0x7f728cd64000, 4096, PROT_READ) = 0
mprotect(0x7f728ce11000, 4096, PROT_READ) = 0
mprotect(0x7f728ce19000, 4096, PROT_READ) = 0
mprotect(0x7f728d01b000, 4096, PROT_READ) = 0
mprotect(0x7f728d025000, 4096, PROT_READ) = 0
mprotect(0x7f728d0c7000, 4096, PROT_READ) = 0
mprotect(0x7f728d098000, 4096, PROT_READ) = 0
mprotect(0x7f728d068000, 8192, PROT_READ) = 0
mprotect(0x564a99f96000, 4096, PROT_READ) = 0
mprotect(0x7f728d131000, 8192, PROT_READ) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
getrandom("\xe3\xe4\x47\xe2\xd1\xcb\xa8\x0f", 8, GRND_NONBLOCK) = 8
munmap(0x7f728d0d7000, 112811)          = 0
openat(AT_FDCWD, "/proc/sys/kernel/cap_last_cap", O_RDONLY) = 3
fstatfs(3, {f_type=PROC_SUPER_MAGIC, f_bsize=4096, f_blocks=0, f_bfree=0, f_bavail=0, f_files=0, f_ffree=0, f_fsid={val=[0x18, 0]}, f_namelen=255, f_frsize=4096, f_flags=ST_VALID|ST_NOSUID|ST_NODEV|ST_NOEXEC|ST_RELATIME}) = 0
read(3, "40\n", 7)                      = 3
close(3)                                = 0
prctl(PR_CAPBSET_READ, CAP_CHOWN)       = 0
prctl(PR_GET_SECUREBITS)                = 0
prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)  = 0
prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) = 0
statfs("/sys/fs/selinux", {f_type=SELINUX_MAGIC, f_bsize=4096, f_blocks=0, f_bfree=0, f_bavail=0, f_files=0, f_ffree=0, f_fsid={val=[0x16, 0]}, f_namelen=255, f_frsize=4096, f_flags=ST_VALID|ST_NOSUID|ST_NOEXEC|ST_RELATIME}) = 0
statfs("/sys/fs/selinux", {f_type=SELINUX_MAGIC, f_bsize=4096, f_blocks=0, f_bfree=0, f_bavail=0, f_files=0, f_ffree=0, f_fsid={val=[0x16, 0]}, f_namelen=255, f_frsize=4096, f_flags=ST_VALID|ST_NOSUID|ST_NOEXEC|ST_RELATIME}) = 0
brk(NULL)                               = 0x564aafda9000
brk(0x564aafdca000)                     = 0x564aafdca000
access("/etc/selinux/config", F_OK)     = 0
openat(AT_FDCWD, "/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=233242544, ...}) = 0
mmap(NULL, 233242544, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f727ee00000
close(3)                                = 0
socket(AF_NETLINK, SOCK_RAW|SOCK_CLOEXEC, NETLINK_AUDIT) = 3
openat(AT_FDCWD, "/proc/sys/kernel/ngroups_max", O_RDONLY|O_CLOEXEC) = 4
read(4, "65536\n", 31)                  = 6
close(4)                                = 0
mmap(NULL, 528384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f727ed7f000
newfstatat(AT_FDCWD, "/etc/login.defs", {st_mode=S_IFREG|0644, st_size=8888, ...}, AT_SYMLINK_NOFOLLOW) = 0
openat(AT_FDCWD, "/etc/login.defs", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=8888, ...}) = 0
read(4, "#\n# Please note that the paramet"..., 4096) = 4096
read(4, "ID_MIN                  1000\nUID"..., 4096) = 4096
read(4, " line length in the\n# group file"..., 4096) = 696
read(4, "", 4096)                       = 0
close(4)                                = 0
openat(AT_FDCWD, "/login.defs.d", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/login.defs.d", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = -1 ENOENT (No such file or directory)
access("/etc/shadow", F_OK)             = 0
access("/etc/gshadow", F_OK)            = 0
access("/etc/subuid", F_OK)             = 0
access("/etc/subgid", F_OK)             = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=687, ...}, 0) = 0
newfstatat(AT_FDCWD, "/", {st_mode=S_IFDIR|0555, st_size=170, ...}, 0) = 0
openat(AT_FDCWD, "/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=687, ...}) = 0
read(4, "# Generated by authselect\n# Do n"..., 4096) = 687
read(4, "", 4096)                       = 0
fstat(4, {st_mode=S_IFREG|0644, st_size=687, ...}) = 0
close(4)                                = 0
openat(AT_FDCWD, "/etc/passwd", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=3327, ...}) = 0
lseek(4, 0, SEEK_SET)                   = 0
read(4, "root:x:0:0:Super User:/root:/bin"..., 4096) = 3327
close(4)                                = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=687, ...}, 0) = 0
openat(AT_FDCWD, "/etc/shadow", O_RDONLY|O_CLOEXEC) = -1 EACCES (Permission denied)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=112811, ...}) = 0
mmap(NULL, 112811, PROT_READ, MAP_PRIVATE, 4, 0) = 0x7f728d0d7000
close(4)                                = 0
openat(AT_FDCWD, "/lib64/libnss_systemd.so.2", O_RDONLY|O_CLOEXEC) = 4
read(4, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(4, {st_mode=S_IFREG|0755, st_size=466344, ...}) = 0
mmap(NULL, 457384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7f727ed0f000
mmap(0x7f727ed5e000, 106496, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x4f000) = 0x7f727ed5e000
mmap(0x7f727ed78000, 28672, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x69000) = 0x7f727ed78000
close(4)                                = 0
openat(AT_FDCWD, "/lib64/libm.so.6", O_RDONLY|O_CLOEXEC) = 4
read(4, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(4, {st_mode=S_IFREG|0755, st_size=1013376, ...}) = 0
mmap(NULL, 999440, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7f727ec1a000
mmap(0x7f727ec9c000, 462848, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x82000) = 0x7f727ec9c000
mmap(0x7f727ed0d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0xf2000) = 0x7f727ed0d000
close(4)                                = 0
openat(AT_FDCWD, "/lib64/libcap.so.2", O_RDONLY|O_CLOEXEC) = 4
read(4, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 V\0\0\0\0\0\0"..., 832) = 832
fstat(4, {st_mode=S_IFREG|0755, st_size=44992, ...}) = 0
mmap(NULL, 45128, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7f728cc76000
mmap(0x7f728cc7c000, 16384, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x6000) = 0x7f728cc7c000
mmap(0x7f728cc80000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x9000) = 0x7f728cc80000
close(4)                                = 0
openat(AT_FDCWD, "/lib64/libgcc_s.so.1", O_RDONLY|O_CLOEXEC) = 4
read(4, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(4, {st_mode=S_IFREG|0755, st_size=182376, ...}) = 0
mmap(NULL, 176584, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7f727ebee000
mmap(0x7f727ec11000, 28672, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x23000) = 0x7f727ec11000
mmap(0x7f727ec18000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x2a000) = 0x7f727ec18000
mmap(0x7f727ec19000, 456, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f727ec19000
close(4)                                = 0
mprotect(0x7f727ec18000, 4096, PROT_READ) = 0
mprotect(0x7f728cc80000, 4096, PROT_READ) = 0
mprotect(0x7f727ed0d000, 4096, PROT_READ) = 0
mprotect(0x7f727ed78000, 24576, PROT_READ) = 0
prctl(PR_CAPBSET_READ, CAP_MAC_OVERRIDE) = 0
prctl(PR_CAPBSET_READ, 0x30 /* CAP_??? */) = -1 EINVAL (Invalid argument)
prctl(PR_CAPBSET_READ, CAP_CHECKPOINT_RESTORE) = 0
prctl(PR_CAPBSET_READ, 0x2c /* CAP_??? */) = -1 EINVAL (Invalid argument)
prctl(PR_CAPBSET_READ, 0x2a /* CAP_??? */) = -1 EINVAL (Invalid argument)
prctl(PR_CAPBSET_READ, 0x29 /* CAP_??? */) = -1 EINVAL (Invalid argument)
munmap(0x7f728d0d7000, 112811)          = 0
futex(0x7f727ed7ea58, FUTEX_WAKE_PRIVATE, 2147483647) = 0
rt_sigprocmask(SIG_BLOCK, [HUP USR1 USR2 PIPE ALRM CHLD TSTP URG VTALRM PROF WINCH IO], [], 8) = 0
openat(AT_FDCWD, "/run/systemd/userdb/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0755, st_size=140, ...}) = 0
getdents64(4, 0x564aafdc1210 /* 7 entries */, 32768) = 272
socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5
connect(5, {sa_family=AF_UNIX, sun_path="/run/systemd/userdb/io.systemd.Machine"}, 41) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [HUP USR1 USR2 PIPE ALRM CHLD TSTP URG VTALRM PROF WINCH IO], 8) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_DROPPABLE|MAP_ANONYMOUS, -1, 0) = 0x7f728d0f2000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f728d0f1000
rt_sigprocmask(SIG_SETMASK, [HUP USR1 USR2 PIPE ALRM CHLD TSTP URG VTALRM PROF WINCH IO], NULL, 8) = 0
getrandom("\x66\xfc\x34\xfc\x4e\xcc\xd8\x26\xaa\x55\xfa\xad\x9d\x51\x34\x03\xd4\xbc\x88\xd0\x8a\x94\x9e\x6c\xbc\xb2\x6c\x11\x39\xe1\xd9\xf5", 32, 0) = 32
futex(0x7f727ed7ea90, FUTEX_WAKE_PRIVATE, 2147483647) = 0
getpid()                                = 204054
epoll_create1(EPOLL_CLOEXEC)            = 6
timerfd_create(CLOCK_MONOTONIC, TFD_CLOEXEC|TFD_NONBLOCK) = 7
epoll_ctl(6, EPOLL_CTL_ADD, 7, {events=EPOLLIN, data=0x564aafdbc1f0}) = 0
epoll_ctl(6, EPOLL_CTL_ADD, 5, {events=0, data=0x564aafdb6f80}) = 0
brk(0x564aafdec000)                     = 0x564aafdec000
brk(0x564aafdea000)                     = 0x564aafdea000
futex(0x7f727ed7ea74, FUTEX_WAKE_PRIVATE, 2147483647) = 0
socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 8
connect(8, {sa_family=AF_UNIX, sun_path="/run/systemd/userdb/io.systemd.DropIn"}, 40) = 0
epoll_ctl(6, EPOLL_CTL_ADD, 8, {events=0, data=0x564aafdc0d70}) = 0
socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 9
connect(9, {sa_family=AF_UNIX, sun_path="/run/systemd/userdb/io.systemd.DynamicUser"}, 45) = 0
epoll_ctl(6, EPOLL_CTL_ADD, 9, {events=0, data=0x564aafdba6a0}) = 0
getdents64(4, 0x564aafdc1210 /* 0 entries */, 32768) = 0
close(4)                                = 0
epoll_ctl(6, EPOLL_CTL_MOD, 5, {events=EPOLLIN|EPOLLOUT, data=0x564aafdb6f80}) = 0
epoll_ctl(6, EPOLL_CTL_MOD, 8, {events=EPOLLIN|EPOLLOUT, data=0x564aafdc0d70}) = 0
epoll_ctl(6, EPOLL_CTL_MOD, 9, {events=EPOLLIN|EPOLLOUT, data=0x564aafdba6a0}) = 0
openat(AT_FDCWD, "/proc/sys/kernel/random/boot_id", O_RDONLY|O_NOCTTY|O_CLOEXEC) = 4
read(4, "3bb5d665-26f9-497a-b761-9e2ecfaf"..., 38) = 37
read(4, "", 1)                          = 0
close(4)                                = 0
timerfd_settime(7, TFD_TIMER_ABSTIME, {it_interval={tv_sec=0, tv_nsec=0}, it_value={tv_sec=160405, tv_nsec=724092000}}, NULL) = 0
epoll_pwait2(6, [{events=EPOLLOUT, data=0x564aafdb6f80}, {events=EPOLLOUT, data=0x564aafdc0d70}, {events=EPOLLOUT, data=0x564aafdba6a0}], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 3
sendto(5, "{\"method\":\"io.systemd.UserDataba"..., 119, MSG_DONTWAIT|MSG_NOSIGNAL, NULL, 0) = 119
epoll_ctl(6, EPOLL_CTL_MOD, 5, {events=EPOLLIN, data=0x564aafdb6f80}) = 0
epoll_pwait2(6, [{events=EPOLLOUT, data=0x564aafdc0d70}, {events=EPOLLOUT, data=0x564aafdba6a0}], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 2
sendto(8, "{\"method\":\"io.systemd.UserDataba"..., 118, MSG_DONTWAIT|MSG_NOSIGNAL, NULL, 0) = 118
epoll_ctl(6, EPOLL_CTL_MOD, 8, {events=EPOLLIN, data=0x564aafdc0d70}) = 0
epoll_pwait2(6, [{events=EPOLLOUT, data=0x564aafdba6a0}, {events=EPOLLIN, data=0x564aafdb6f80}], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 2
recvfrom(5, "{\"error\":\"io.systemd.UserDatabas"..., 131080, MSG_DONTWAIT, NULL, NULL) = 50
epoll_ctl(6, EPOLL_CTL_MOD, 5, {events=0, data=0x564aafdb6f80}) = 0
epoll_pwait2(6, [{events=EPOLLOUT, data=0x564aafdba6a0}], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 1
epoll_pwait2(6, [{events=EPOLLOUT, data=0x564aafdba6a0}, {events=EPOLLIN, data=0x564aafdc0d70}], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 2
epoll_ctl(6, EPOLL_CTL_DEL, 5, NULL)    = 0
close(5)                                = 0
epoll_pwait2(6, [{events=EPOLLOUT, data=0x564aafdba6a0}, {events=EPOLLIN, data=0x564aafdc0d70}], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 2
recvfrom(8, "{\"error\":\"io.systemd.UserDatabas"..., 131080, MSG_DONTWAIT, NULL, NULL) = 50
epoll_ctl(6, EPOLL_CTL_MOD, 8, {events=0, data=0x564aafdc0d70}) = 0
epoll_pwait2(6, [{events=EPOLLOUT, data=0x564aafdba6a0}], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 1
epoll_pwait2(6, [{events=EPOLLOUT, data=0x564aafdba6a0}], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 1
epoll_ctl(6, EPOLL_CTL_DEL, 8, NULL)    = 0
close(8)                                = 0
epoll_pwait2(6, [{events=EPOLLOUT, data=0x564aafdba6a0}], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 1
sendto(9, "{\"method\":\"io.systemd.UserDataba"..., 123, MSG_DONTWAIT|MSG_NOSIGNAL, NULL, 0) = 123
epoll_ctl(6, EPOLL_CTL_MOD, 9, {events=EPOLLIN, data=0x564aafdba6a0}) = 0
epoll_pwait2(6, [], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 0
recvfrom(9, 0x564aafdc93b0, 131080, MSG_DONTWAIT, NULL, NULL) = -1 EAGAIN (Resource temporarily unavailable)
epoll_wait(6, [{events=EPOLLIN, data=0x564aafdba6a0}], 24, -1) = 1
recvfrom(9, "{\"error\":\"io.systemd.UserDatabas"..., 131080, MSG_DONTWAIT, NULL, NULL) = 50
epoll_ctl(6, EPOLL_CTL_MOD, 9, {events=0, data=0x564aafdba6a0}) = 0
epoll_pwait2(6, [], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 0
epoll_pwait2(6, [], 24, {tv_sec=0, tv_nsec=0}, NULL, 8) = 0
epoll_ctl(6, EPOLL_CTL_DEL, 9, NULL)    = 0
close(9)                                = 0
close(6)                                = 0
close(7)                                = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
openat(AT_FDCWD, "/etc/.pwd.lock", O_WRONLY|O_CREAT|O_CLOEXEC, 0600) = 4
rt_sigaction(SIGALRM, {sa_handler=0x7f728cf48650, sa_mask=~[], sa_flags=SA_RESTORER, sa_restorer=0x7f728ce37290}, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [ALRM], [], 8) = 0
alarm(15)                               = 0
fcntl(4, F_SETLKW, {l_type=F_WRLCK, l_whence=SEEK_SET, l_start=0, l_len=0}) = 0
alarm(0)                                = 15
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigaction(SIGALRM, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f728ce37290}, NULL, 8) = 0
getpid()                                = 204054
openat(AT_FDCWD, "/etc/passwd.204054", O_WRONLY|O_CREAT|O_TRUNC, 0600) = 5
getpid()                                = 204054
write(5, "204054\0", 7)                 = 7
fdatasync(5)                            = 0
close(5)                                = 0
link("/etc/passwd.204054", "/etc/passwd.lock") = 0
newfstatat(AT_FDCWD, "/etc/passwd.204054", {st_mode=S_IFREG|0600, st_size=7, ...}, 0) = 0
unlink("/etc/passwd.204054")            = 0
openat(AT_FDCWD, "/etc/passwd", O_RDWR|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW|O_CLOEXEC) = 5
fcntl(5, F_GETFL)                       = 0x28802 (flags O_RDWR|O_NONBLOCK|O_LARGEFILE|O_NOFOLLOW)
fstat(5, {st_mode=S_IFREG|0644, st_size=3327, ...}) = 0
read(5, "root:x:0:0:Super User:/root:/bin"..., 4096) = 3327
read(5, "", 4096)                       = 0
getpid()                                = 204054
openat(AT_FDCWD, "/etc/shadow.204054", O_WRONLY|O_CREAT|O_TRUNC, 0600) = 6
getpid()                                = 204054
write(6, "204054\0", 7)                 = 7
fdatasync(6)                            = 0
close(6)                                = 0
link("/etc/shadow.204054", "/etc/shadow.lock") = 0
newfstatat(AT_FDCWD, "/etc/shadow.204054", {st_mode=S_IFREG|0600, st_size=7, ...}, 0) = 0
unlink("/etc/shadow.204054")            = 0
openat(AT_FDCWD, "/etc/shadow", O_RDWR|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW|O_CLOEXEC) = -1 EACCES (Permission denied)
openat(AT_FDCWD, "/usr/share/locale/locale.alias", O_RDONLY|O_CLOEXEC) = 6
fstat(6, {st_mode=S_IFREG|0644, st_size=2998, ...}) = 0
read(6, "# Locale name alias data base.\n#"..., 4096) = 2998
read(6, "", 4096)                       = 0
close(6)                                = 0
openat(AT_FDCWD, "/usr/share/locale/en_US.UTF-8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/share/locale/en_US.utf8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/share/locale/en_US/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/share/locale/en.UTF-8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/share/locale/en.utf8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/share/locale/en/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
write(2, "usermod: cannot open /etc/shadow"..., 33usermod: cannot open /etc/shadow
) = 33
unlink("/etc/shadow.lock")              = 0
close(5)                                = 0
unlink("/etc/passwd.lock")              = 0
close(4)                                = 0
readlink("/proc/self/exe", "/usr/bin/usermod", 4096) = 16
ioctl(0, TCGETS2, {c_iflag=ICRNL|IXON|IUTF8, c_oflag=NL0|CR0|TAB0|BS0|VT0|FF0|OPOST|ONLCR, c_cflag=B38400|B38400<<IBSHIFT|CS8|CREAD, c_lflag=ISIG|ICANON|ECHO|ECHOE|ECHOK|IEXTEN|ECHOCTL|ECHOKE, ...}) = 0
fstat(0, {st_mode=S_IFCHR|0600, st_rdev=makedev(0x88, 0x2), ...}) = 0
readlink("/proc/self/fd/0", "/dev/pts/2", 31) = 10
newfstatat(AT_FDCWD, "/dev/pts/2", {st_mode=S_IFCHR|0600, st_rdev=makedev(0x88, 0x2), ...}, 0) = 0
newfstatat(AT_FDCWD, "/dev/pts/2", {st_mode=S_IFCHR|0600, st_rdev=makedev(0x88, 0x2), ...}, AT_SYMLINK_NOFOLLOW) = 0
uname({sysname="Linux", nodename="leibniz.local", ...}) = 0
sendto(3, [{nlmsg_len=132, nlmsg_type=0x44e /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=1, nlmsg_pid=0}, "\x6f\x70\x3d\x6d\x6f\x64\x69\x66\x79\x2d\x61\x63\x63\x6f\x75\x6e\x74\x20\x61\x63\x63\x74\x3d\x22\x74\x65\x73\x74\x75\x73\x65\x72"...], 132, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 132
poll([{fd=3, events=POLLIN}], 1, 500)   = 1 ([{fd=3, revents=POLLIN}])
recvfrom(3, [{nlmsg_len=152, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=1, nlmsg_pid=204054}, {error=-EPERM, msg=[{nlmsg_len=132, nlmsg_type=0x44e /* AUDIT_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=1, nlmsg_pid=0}, "\x6f\x70\x3d\x6d\x6f\x64\x69\x66\x79\x2d\x61\x63\x63\x6f\x75\x6e\x74\x20\x61\x63\x63\x74\x3d\x22\x74\x65\x73\x74\x75\x73\x65\x72"...]}], 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, [12]) = 152
recvfrom(3, [{nlmsg_len=152, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=1, nlmsg_pid=204054}, {error=-EPERM, msg=[{nlmsg_len=132, nlmsg_type=0x44e /* AUDIT_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=1, nlmsg_pid=0}, "\x6f\x70\x3d\x6d\x6f\x64\x69\x66\x79\x2d\x61\x63\x63\x6f\x75\x6e\x74\x20\x61\x63\x63\x74\x3d\x22\x74\x65\x73\x74\x75\x73\x65\x72"...]}], 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, [12]) = 152
capget({version=0 /* _LINUX_CAPABILITY_VERSION_??? */, pid=0}, NULL) = 0
gettid()                                = 204054
capget({version=_LINUX_CAPABILITY_VERSION_3, pid=204054}, {effective=0, permitted=0, inheritable=0}) = 0
openat(AT_FDCWD, "/proc/204054/status", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
read(4, "Name:\tusermod\nUmask:\t0022\nState:"..., 1024) = 1024
lseek(4, 0, SEEK_CUR)                   = 1024
lseek(4, 860, SEEK_SET)                 = 860
close(4)                                = 0
openat(AT_FDCWD, "/proc/204054/status", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
read(4, "Name:\tusermod\nUmask:\t0022\nState:"..., 1024) = 1024
lseek(4, 0, SEEK_CUR)                   = 1024
lseek(4, 885, SEEK_SET)                 = 885
close(4)                                = 0
exit_group(1)                           = ?
+++ exited with 1 +++
root@leibniz:~# stat /etc/shadow
  File: /etc/shadow
  Size: 1506            Blocks: 8          IO Block: 4096   regular file
Device: 0,36    Inode: 17080655    Links: 1
Access: (0000/----------)  Uid: (    0/    root)   Gid: (    0/    root)
Context: system_u:object_r:shadow_t:s0
Access: 2026-02-16 04:05:00.053989840 -0600
Modify: 2026-01-28 14:05:42.801738166 -0600
Change: 2026-01-28 14:05:42.802535779 -0600
 Birth: 2026-01-28 14:05:42.800535755 -0600
root@leibniz:~# 

[alejandro-colomar]

In my haste to provide a reproducer, I made a typo. It is interesting that it tries to lock those files when I've provided a garbage argument!

This should be a sample with the normal flags for usermod. I'm running the stock shadow-utils from Fedora and show only the patches listed here https://src.fedoraproject.org/rpms/shadow-utils/tree/f43:

* shadow-4.18.0-account-tools-setuid.patch

* shadow-4.15.0-manfix.patch

root@leibniz:/home/riehecky# cd 
root@leibniz:~# rpm -q shadow-utils
shadow-utils-4.18.0-3.fc43.x86_64
root@leibniz:~# ls -l /etc/subuid
-rw-r--r--. 1 root root 22 Sep  5 14:20 /etc/subuid
root@leibniz:~# cat /etc/subuid
riehecky:524288:65536
root@leibniz:~# capsh --drop=all --inh= --secbits=0 --uid=$(id -u) --gid=$(id -g) --
root@leibniz:~# usermod --add-subuids 10000-11000 testuser
usermod: cannot open /etc/shadow
root@leibniz:~# exit
root@leibniz:~# usermod --add-subuids 10000-11000 testuser
root@leibniz:~# cat /etc/subuid
riehecky:524288:65536
testuser:10000:1001
root@leibniz:~# capsh --drop=all --inh= --secbits=0 --uid=$(id -u) --gid=$(id -g) --
root@leibniz:~# strace -ff usermod --add-subuids 12000-13000 testuser
execve("/usr/sbin/usermod", ["usermod", "--add-subuids", "12000-13000", "testuser"], 0x7ffdc4696190 /* 44 vars */) = 0
brk(NULL)                               = 0x564aafda9000

[...]

access("/etc/shadow", F_OK)             = 0
access("/etc/gshadow", F_OK)            = 0
access("/etc/subuid", F_OK)             = 0
access("/etc/subgid", F_OK)             = 0

These we know already.

[...]

openat(AT_FDCWD, "/etc/passwd", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=3327, ...}) = 0
lseek(4, 0, SEEK_SET) = 0
read(4, "root:x:0:0:Super User:/root:/bin"..., 4096) = 3327
close(4) = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=687, ...}, 0) = 0
openat(AT_FDCWD, "/etc/shadow", O_RDONLY|O_CLOEXEC) = -1 EACCES (Permission denied)

Could you please add a few fprintf(stderr, "XXX 42"); (with different numbers) in places to find out which are printed and which not? That would allow us to see which code is being run.

You could add them in main(), near the code we know that calls access (and especially in branches after it), and also near the code we know that prints the error.

Then run it without strace (to see cleanly the strings). Feel free to then run again with strace, if that helps.

I can't test it myself because I don't have subuids configured in my system (and don't even know how those work, so I fear breaking some stuff).

[...]

+++ exited with 1 +++
root@leibniz:# stat /etc/shadow
File: /etc/shadow
Size: 1506 Blocks: 8 IO Block: 4096 regular file
Device: 0,36 Inode: 17080655 Links: 1
Access: (0000/----------) Uid: ( 0/ root) Gid: ( 0/ root)
Context: system_u:object_r:shadow_t:s0
Access: 2026-02-16 04:05:00.053989840 -0600
Modify: 2026-01-28 14:05:42.801738166 -0600
Change: 2026-01-28 14:05:42.802535779 -0600
Birth: 2026-01-28 14:05:42.800535755 -0600
root@leibniz:#

[jcpunk]

I'll see about getting that built up.

My cleanest reproducer works on a system without subuid's setup:

# touch /etc/subuid
# cat /etc/subuid
# capsh --drop=all --inh= --secbits=0 --uid=$(id -u) --gid=$(id -g) --
# usermod --del-subuids 10000-11000 testuser

So long as /etc/subuid exists, even if it has no content, usermod --del-subuids 10000-11000 testuser (provided testuser exists) will try to lock /etc/shadow.

[jcpunk]

I think I've been able to isolate the issue a bit further.

It has to do with the unconditional locking in https://github.com/shadow-maint/shadow/blob/master/src/usermod.c#L1620

I've got a non-subid reproducer:

# capsh --drop=all --inh= --secbits=0 --uid=$(id -u) --gid=$(id -g) --
# usermod --shell /usr/bin/bash testuser

When patched with this:

diff --git a/src/usermod.c b/src/usermod.c
index a0f4d7d..5db4083 100644
--- a/src/usermod.c
+++ b/src/usermod.c
@@ -1619,12 +1619,14 @@ static void open_files (void)
                         Prog, pw_dbname ());
                fail_exit (E_PW_UPDATE);
        }
+fprintf(stderr, "XXX 001\n");
        if (is_shadow_pwd && (spw_lock () == 0)) {
                fprintf (stderr,
                         _("%s: cannot lock %s; try again later.\n"),
                         Prog, spw_dbname ());
                fail_exit (E_PW_UPDATE);
        }
+fprintf(stderr, "XXX 002\n");
        spw_locked = true;
        if (is_shadow_pwd && (spw_open (O_CREAT | O_RDWR) == 0)) {
                fprintf (stderr,
@@ -1632,6 +1634,7 @@ static void open_files (void)
                         Prog, spw_dbname ());
                fail_exit (E_PW_UPDATE);
        }
+fprintf(stderr, "XXX 003\n");
 
        if (Gflg || lflg) {
                /*

I get:

root@leibniz:~# usermod --shell /usr/bin/bash testuser
XXX 001
XXX 002
XXX 003
root@leibniz:~# 

I'm not sure why my patched version doesn't say "usermod: cannot open /etc/shadow" any longer?

Unconditionally locking /etc/passwd makes sense since the user's information is controlling/authoritative for all usermod actions. Since open_files only takes one argument, I'm not sure how more fancy flags might be introduced.

[alejandro-colomar]

I think I've been able to isolate the issue a bit further.

It has to do with the unconditional locking in https://github.com/shadow-maint/shadow/blob/master/src/usermod.c#L1620

I've got a non-subid reproducer:

# capsh --drop=all --inh= --secbits=0 --uid=$(id -u) --gid=$(id -g) --
# usermod --shell /usr/bin/bash testuser

When patched with this:

diff --git a/src/usermod.c b/src/usermod.c
index a0f4d7d..5db4083 100644
--- a/src/usermod.c
+++ b/src/usermod.c
@@ -1619,12 +1619,14 @@ static void open_files (void)
                         Prog, pw_dbname ());
                fail_exit (E_PW_UPDATE);
        }
+fprintf(stderr, "XXX 001\n");
        if (is_shadow_pwd && (spw_lock () == 0)) {
                fprintf (stderr,
                         _("%s: cannot lock %s; try again later.\n"),
                         Prog, spw_dbname ());
                fail_exit (E_PW_UPDATE);
        }
+fprintf(stderr, "XXX 002\n");
        spw_locked = true;
        if (is_shadow_pwd && (spw_open (O_CREAT | O_RDWR) == 0)) {
                fprintf (stderr,
@@ -1632,6 +1634,7 @@ static void open_files (void)
                         Prog, spw_dbname ());
                fail_exit (E_PW_UPDATE);
        }
+fprintf(stderr, "XXX 003\n");
 
        if (Gflg || lflg) {
                /*

I get:

root@leibniz:# usermod --shell /usr/bin/bash testuser
XXX 001
XXX 002
XXX 003
root@leibniz:#

I'm not sure why my patched version doesn't say "usermod: cannot open /etc/shadow" any longer?

Actually, when you fixed the typo in the flag, the cannot open error disappeared already, right? (See last strace session above).

Unconditionally locking /etc/passwd makes sense since the user's information is controlling/authoritative for all usermod actions.

Since open_files only takes one argument, I'm not sure how more fancy flags might be introduced.

We could add a second argument; it's our internal function, so we don't break any ABI.

[jcpunk]

With:

# capsh --drop=all --inh= --secbits=0 --uid=$(id -u) --gid=$(id -g) --
# usermod --shell /usr/bin/bash testuser

I still get a locking error:

root@leibniz:~# capsh --drop=all --inh= --secbits=0 --uid=$(id -u) --gid=$(id -g) --
root@leibniz:~# usermod --shell /usr/bin/bash testuser
usermod: no changes
root@leibniz:~# usermod --shell /bin/bash testuser
XXX 001
XXX 002
usermod: cannot open /etc/shadow

[ikerexxe]

Hi everyone, jumping in with some thoughts on this.

I agree with the point being made: if we aren't modifying any fields hosted in /etc/shadow, the tool technically shouldn't need to access or lock that file.

However, we should also consider that the vast majority of binaries in this project are designed under the assumption that the caller has the full set of capabilities required for administrative tasks. While the report is certainly valid, refactoring the logic to make the file selection 'intelligent' might not be the most efficient use of development time at this stage.

Curious to see what Alejandro thinks about the priority of this refactor once the root cause is fully pinpointed.

[alejandro-colomar]

Hi everyone, jumping in with some thoughts on this.

Hi @ikerexxe

[...]

However, we should also consider that the vast majority of binaries in this project are designed under the assumption that the caller has the full set of capabilities required for administrative tasks. While the report is certainly valid, refactoring the logic to make the file selection 'intelligent' might not be the most efficient use of development time at this stage.

I agree with this.

Curious to see what Alejandro thinks about the priority of this refactor once the root cause is fully pinpointed.

To me, it has low priority. If distros or someone else is very interested and wants to provide the code, and other interested parties (i.e., distros) want to review and test it, then it could happen soon-ish.

I'm a bit scared about bypassing locks. They might be unnecessary, but corner cases and races are difficult to correctly understand. So, I don't see this being merged in less than a year without important amount of work by distros.

However, I'm happy to help understand the current behavior, as that part is relatively cheap for me, and I might also learn more about this part of the code, so it's not wasted time for me. That's why I am engaging with the OP so far.

[alejandro-colomar]

With:

# capsh --drop=all --inh= --secbits=0 --uid=$(id -u) --gid=$(id -g) --
# usermod --shell /usr/bin/bash testuser

I still get a locking error:

root@leibniz:~# capsh --drop=all --inh= --secbits=0 --uid=$(id -u) --gid=$(id -g) --
root@leibniz:~# usermod --shell /usr/bin/bash testuser
usermod: no changes
root@leibniz:~# usermod --shell /bin/bash testuser
XXX 001
XXX 002
usermod: cannot open /etc/shadow

@jcpunk

This reproducer shows that usermod(8) locks /etc/shadow for an invocation that only needs to modify /etc/passwd,
and the question would be whether we can skip that lock or not (maybe lock /etc/passwd), right?

If anyone is interested in that, it'd need quite a lot of research and testing (distros are probably best placed to do that).