.
In the docs Lincoln suggests how in order for the script to be able to update password and group files, not only must it have write access to the files themselves, but to the directory that contains them (the script creates lock and other temporary files within the directory). He suggests three alternatives
1. Run as a SUID Script
2. Run as a SGID Script
3. The scary option - Keep the Password and Group Files in a Directory writable by "nobody".