Prevent ordinary users from freely reading /etc/shadow while allowing account-management tools to operate.
Which description is appropriate?
/etc/shadow contains password hashes, so read access should be limited to root or other narrowly authorized principals.
Detailed explanation
Incorrect. World-readable hashes would weaken password protection.
Correct. Limit reads to root or other required privileged principals.
Incorrect. Execute permission does not replace read control for a regular file.
Incorrect. Removing shadow separation would undermine its security purpose.
Try it yourself
An example you can run in a temporary verification environment.
printf '%s
' 'shadow: rootだけが読み取り可能な権限を持つ'Expected result
通常ユーザーへ読み取り権限を広げないKey points
- Protect hashes
- Least privilege
- Keep separate from passwd
Notes
- Environment: printf / 概念確認のみ
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Protected account data
Sensitive authentication data stored separately from ordinary account records.
Service availability
Whether a service can start automatically or be activated on demand.
Packet filter
A host firewall rule set that permits or rejects network packets.