Prevent ordinary users from freely reading /etc/shadow while allowing account-management tools to operate.
Which description is appropriate?
/etc/shadow contains password hashes, so read access should be limited to root or other narrowly authorized principals.
Detailed explanation
Incorrect. World-readable hashes would weaken password protection.
Incorrect. World-readable hashes would weaken password protection.
Correct. Limit reads to root or other required privileged principals.
Correct. Limit reads to root or other required privileged principals.
Incorrect. Execute permission does not replace read control for a regular file.
Incorrect. Execute permission does not replace read control for a regular file.
Incorrect. Removing shadow separation would undermine its security purpose.
Incorrect. Removing shadow separation would undermine its security purpose.
Try it yourself
An example you can run in a temporary verification environment.
printf '%s
' 'shadow: rootだけが読み取り可能な権限を持つ'Expected result
通常ユーザーへ読み取り権限を広げないKey points
- Protect hashes
- Least privilege
- Keep separate from passwd
Notes
- Environment: printf / 概念確認のみ
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.