The user 'sync' and 'shutdown'

vistastar · September 21, 2011, 12:05am

there are 'sync' and 'shutdown' users in my /etc/passwd.
...
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
...

What does these mean?

sysgate · September 21, 2011, 3:06am

These aren't typical users, but rather a processes that the system uses internally, for example, to shutdown the system - it will simply invoke the process of shutting down.

Also, generally users usually takes numbers above 500 in this file, and numbers below 100 are reserved for system use, as in this case. As you can see, they have no shell assigned.

There's also a legacy reason - on some older Linux distros you could use SU to these users and shutdown the system.

vistastar · September 21, 2011, 4:54am

How the processes use the 'shutdown' user internally?

Corona688 · September 21, 2011, 1:39pm

They don't; rather, the shutdown user uses the processes.

'shutdown' has /sbin/shutdown assigned as the login shell. So when you login to it, it runs /sbin/shutdown.

I'm not quite sure how they get the permissions to successfully shutdown the system, though. Perhaps it's because the 'shutdown' user belongs to the root group(group 0)?

vistastar · September 22, 2011, 1:29am

Is it useful except logging in it to shutdown the system?

Corona688 · September 22, 2011, 12:01pm

There's not much a shutdown user which is hardwired into /sbin/shutdown can do except /sbin/shutdown, no.

vistastar · September 24, 2011, 9:55pm

Is this a privilege control method that let some non-root users can shutdown the system using the 'shutdonw' user's password?

On my fedora15 any non-root user can shutdown the system, why? the shutdown command is a soft link to consolehelper command. Also, there is a /sbin/shutdown.

Corona688 · September 26, 2011, 12:13pm

What are the permissions on consolehelper?

As opposed to what?

vistastar · September 27, 2011, 8:54am

[alien@fedora~]:)ls -l /sbin/shutdown
lrwxrwxrwx. 1 root root 16  9  5 20:40 /sbin/shutdown -> ../bin/systemctl
[alien@fedora~]:)ls -l /bin/systemctl
-rwxr-xr-x. 1 root root 165632  4 30 10:51 /bin/systemctl
lrwxrwxrwx. 1 root root 13  9  5 20:40 /usr/bin/poweroff -> consolehelper
[alien@fedora~]:(ls -l /usr/bin/poweroff
lrwxrwxrwx. 1 root root 13  9  5 20:40 /usr/bin/poweroff -> consolehelper
[alien@fedora~]:)ls -l /usr/bin/reboot
lrwxrwxrwx. 1 root root 13  9  5 20:40 /usr/bin/reboot -> consolehelper
[alien@fedora~]:)ls -l /usr/bin/consolehelper
-rwxr-xr-x. 1 root root 6488  4  1 05:24 /usr/bin/consolehelper

PS: the user 'shutdown' is not in any group.

Corona688 · September 30, 2011, 4:17pm

first google hit for 'man consolehelper':

consolehelper(8) - Linux man page
Name
consolehelper - A wrapper that helps console users run system programs
Synopsis
progname [ options ]
Description
consolehelper is a tool that makes it easy for console users to run system programs, doing authentication via PAM (which can be set up to trust all console users or to ask for a password at the system administrator's discretion). When possible, the authentication is done graphically; otherwise, it is done within the text console from which consolehelper was started.

It is intended to be completely transparent. This means that the user will never run the consolehelper program directly. Instead, programs like /sbin/shutdown are paired with a link from /usr/bin/shutdown to /usr/bin/consolehelper. Then when non-root users (specifically, users without /sbin in their path, or /sbin after /usr/bin) call the "shutdown" program, consolehelper will be invoked to authenticate the action and then invoke /sbin/shutdown. (consolehelper itself has no priviledges; it calls the userhelper(8) program do the real work.)

consolehelper requires that a PAM configuration for every managed program exist. So to make /sbin/foo or /usr/sbin/foo managed, you need to create a link from /usr/bin/foo to /usr/bin/consolehelper and create the file /etc/pam.d/foo, normally using the pam_console(8) PAM module.

So it uses special PAM settings to decide who's allowed to shutdown and so forth.

This is a Redhat-specific thing.

vistastar · September 30, 2011, 11:05pm

Thank you very much.