Want to create an interactive transcript for this episode?
Podcast: Chaos Computer Club - recent events feed
Episode: Accessing shadow records via varlink (asg2025)
Description: Provide a varlink service to access /etc/passwd and /etc/shadow so that no setuid and setgid binaries are necessary for this task.
There are two independent "problems" which can be solved with the same idea: all files in /usr should be owned by root:root and no setuid binary should be needed. The first one is a requirement of image based updates of /usr to avoid UID/GID drift, the second one is a security feature wished by systemd developers and security teams.
Currently most setuid binaries (or setgid binaries owned by group shadow) beside su and sudo only...