pam_unix: workaround the problem caused by libnss_systemd

The getspnam(3) manual page says that errno shall be set to EACCES when
the caller does not have permission to access the shadow password file.
Unfortunately, this contract is broken when libnss_systemd is used in
the nss stack.

Workaround this problem by falling back to the helper invocation when
pam_modutil_getspnam returns NULL regardless of errno.  As pam_unix
already behaves this way when selinux is enabled, it should be OK
for the case when selinux is not enabled, too.

* modules/pam_unix/passverify.c (get_account_info): When
pam_modutil_getspnam returns NULL, unconditionally fall back
to the helper invocation.

Complements: f220cace2053 ("Permit unix_chkpwd & pam_unix.so to run without being setuid-root")
Resolves: https://github.com/linux-pam/linux-pam/issues/379

0 files changed, 0 insertions, 0 deletions