Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I wanted to know if there is a way to prevent the assignment of UID=0 to any other account other than root.

share|improve this question

migrated from stackoverflow.com Sep 30 '10 at 13:18

This question came from our site for professional and enthusiast programmers.

2 Answers 2

You can't. "root" is just a name, and it's perfectly valid to create an account "bennybunny" with UID 0. But that is only possible for a process that already runs as UID 0...

To the UNIX/Linux kernel, all that matters are the numbers. In userspace, through libc, there are mappings to map the numbers to names. It's perfectly possible and valid to have several names map to the same number, BTW.

share|improve this answer

The easiest I can think of is making /etc/passwd a read-only file. As this has the obvious side-effect of disallowing any creation or updates of accounts altogether, I would not do this.

Perhaps instead of thinking about uid 0 you should rather have a look at SELinux which offers mandatory access control and not even root is allowed to do everything.

share|improve this answer
    
However, that means that other users can't be added. –  Delan Azabani Sep 30 '10 at 10:58
3  
And, besides that, I think you'll find that it won't stop root from doing it anyway :-) –  paxdiablo Sep 30 '10 at 11:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.