From 2e630a9f4d13d84d745f9f9799a12a1aecf84c40 Mon Sep 17 00:00:00 2001
From: bjorn3 <17426603+bjorn3@users.noreply.github.com>
Date: Sun, 20 Apr 2025 20:23:17 +0200
Subject: [PATCH] passwd: Only allow locking accounts as root

This is consistent with how Linux works and prevents accidentally
locking yourself out.
---
 src/bin/passwd.rs | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/src/bin/passwd.rs b/src/bin/passwd.rs
index 1f5865641c..ef88106d48 100644
--- a/src/bin/passwd.rs
+++ b/src/bin/passwd.rs
@@ -51,6 +51,31 @@ fn main() {
     )
     .get_matches();
 
+    if args.is_present("LOCK") {
+        if get_uid().unwrap_or_exit(1) != 0 {
+            eprintln!("passwd: only root is allowed to lock accounts");
+            exit(1);
+        }
+
+        let mut users =
+            AllUsers::authenticator(Config::default().writeable(true)).unwrap_or_exit(1);
+
+        let Some(login) = args.value_of("LOGIN") else {
+            eprintln!("passwd: no account specified to lock");
+            exit(1);
+        };
+
+        let user = users.get_mut_by_name(login).unwrap_or_else(|| {
+            eprintln!("passwd: user does not exist: {}", login);
+            exit(1);
+        });
+
+        user.unset_passwd();
+        users.save().unwrap_or_exit(1);
+
+        return;
+    }
+
     let uid = get_uid().unwrap_or_exit(1);
     let mut users = AllUsers::authenticator(Config::default().writeable(true)).unwrap_or_exit(1);
 
@@ -65,12 +90,6 @@ fn main() {
         }),
     };
 
-    if args.is_present("LOCK") {
-        user.unset_passwd();
-        users.save().unwrap_or_exit(1);
-        return;
-    }
-
     if user.uid != uid && uid != 0 {
         eprintln!(
             "passwd: you do not have permission to set the password of '{}'",