From 2193021e6dcb30faca6bff0d6c3862389ad1d8b1 Mon Sep 17 00:00:00 2001
From: Ray Strode <rstrode@redhat.com>
Date: Tue, 1 Oct 2013 10:50:46 -0400
Subject: [PATCH] user: treat NULL shadow entry as "password handled remotely"

Right now we set the password mode of a user based on the password
hash in shadow.  SSSD (and other remote login facilities
presumably) don't send the password hash over the wire to the client,
but of course those users do have a password set.

This commit changes the code to notice when there's no shadow entry
for a user and treat that case conservatively (assume user has a password).

Related to

https://bugzilla.gnome.org/show_bug.cgi?id=708997

https://bugs.freedesktop.org/show_bug.cgi?id=70005
---
 src/user.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/user.c b/src/user.c
index 6492a62..0a5a1f2 100644
--- a/src/user.c
+++ b/src/user.c
@@ -243,61 +243,61 @@ user_update_from_pwent (User          *user,
         }
 
         /* Shell */
         if (g_strcmp0 (user->shell, pwent->pw_shell) != 0) {
                 g_free (user->shell);
                 user->shell = g_strdup (pwent->pw_shell);
                 changed = TRUE;
                 g_object_notify (G_OBJECT (user), "shell");
         }
 
         passwd = NULL;
 #ifdef HAVE_SHADOW_H
         spent = getspnam (pwent->pw_name);
         if (spent)
                 passwd = spent->sp_pwdp;
 #endif
 
         if (passwd && passwd[0] == '!') {
                 locked = TRUE;
         }
         else {
                 locked = FALSE;
         }
 
         if (user->locked != locked) {
                 user->locked = locked;
                 changed = TRUE;
                 g_object_notify (G_OBJECT (user), "locked");
         }
 
-        if (passwd && passwd[0] != 0) {
+        if (passwd == NULL || passwd[0] != 0) {
                 mode = PASSWORD_MODE_REGULAR;
         }
         else {
                 mode = PASSWORD_MODE_NONE;
         }
 
 #ifdef HAVE_SHADOW_H
         if (spent) {
                 if (spent->sp_lstchg == 0) {
                         mode = PASSWORD_MODE_SET_AT_LOGIN;
                 }
         }
 #endif
 
         if (user->password_mode != mode) {
                 user->password_mode = mode;
                 changed = TRUE;
                 g_object_notify (G_OBJECT (user), "password-mode");
         }
 
         /* FIXME: this relies on heuristics that don't always come out
          * right.
          */
         user->system_account = daemon_local_user_is_excluded (user->daemon,
                                                               user->user_name,
                                                               pwent->pw_shell,
                                                               passwd);
 
         g_object_thaw_notify (G_OBJECT (user));
 
-- 
1.8.3.1