Changing root password by user

[Razriel3]

We are using cockpit 220 on a yocto build.
We develop headless gateway(similar in a way to home router) , cockpit enables our users to configure the system.( mostley changing network configuration).
Our users log in with user and password without administrator permissions. by clicking administrative access on top they become adminstrator and can change user names and password including the root password without provding the existing root password.
We would like to prevent the user from being able to change the root password. is it possible ?

[jelly]

If a user can click on administrative access they implicitly become superuser/root so they will be able to do any action as "root". Can these users become root via polkit/sudo if so then even giving the option to change the root password makes little sense in terms of security.

[martinpitt]

We would like to prevent the user from being able to change the root password. is it possible ?

Right, if you provide passwordless root to a user, that user has 100% full control over the system, including editing /etc/shadow (aka. changing root password). This isn't cockpit specific at all.