Bug 2094216

+++ This bug was initially created as a clone of Bug #2093166 +++

Description of problem:

lslogins reports incorrect "Password is locked" status

After an account is locked, `lslogins` reports incorrect "Password is locked" status. `passwd -S` reports status correctly.

~~~
# passwd -l bob
Locking password for user bob.
passwd: Success

# passwd -S bob
bob LK 2022-06-02 0 99999 7 -1 (Password locked.)

# lslogins bob
Username:                           bob                                 
UID:                                1002                                
Gecos field:                                                            
Home directory:                     /home/bob                           
Shell:                              /bin/bash                           
No login:                           no                                  
Password is locked:                 no             <<<<<=====
Password not required:              no                                  
Login by password disabled:         yes                                 
Primary group:                      bob                                 
GID:                                1002                                
Hushed:                             no                                  
Password expiration warn interval:  7                                   
Password changed:                   20:00                               
Maximum change time:                99999                               
Running processes:                  0   
~~~

I think the logic in lslogin.c is incorrect. When account is locked by `passwd -l`, two exclamation marks ("!!") are inserted in front of a password hash. The source code checks for the presence of one exclamation marks ("!").

~~~
lslogins.c

case COL_PWDLOCK:
        if (shadow) {
                if (*shadow->sp_pwdp == '!' && valid_pwd(shadow->sp_pwdp + 1))
                        user->pwd_lock = STATUS_TRUE;
        } else
                user->pwd_lock = STATUS_UNKNOWN;
        break;
~~~

Version-Release number of selected component (if applicable):
util-linux-2.32.1-35.el8.x86_64

How reproducible:
100%

Steps to Reproduce:
~~~
# useradd bob

# passwd bob
Changing password for user bob.
New password: 
Retype new password: 
passwd: all authentication tokens updated successfully.

# passwd -S bob
bob PS 2022-06-02 0 99999 7 -1 (Password set, SHA512 crypt.)

# lslogins bob
Username:                           bob                                 
UID:                                1002                                
Gecos field:                                                            
Home directory:                     /home/bob                           
Shell:                              /bin/bash                           
No login:                           no                                  
Password is locked:                 no                                  
Password not required:              no                                  
Login by password disabled:         no                                  
Primary group:                      bob                                 
GID:                                1002                                
Hushed:                             no                                  
Password expiration warn interval:  7                                   
Password changed:                   20:00                               
Maximum change time:                99999                               
Running processes:                  0                                   

Last logs:

# passwd -l bob
Locking password for user bob.
passwd: Success

# passwd -S bob
bob LK 2022-06-02 0 99999 7 -1 (Password locked.)

# lslogins bob
Username:                           bob                                 
UID:                                1002                                
Gecos field:                                                            
Home directory:                     /home/bob                           
Shell:                              /bin/bash                           
No login:                           no                                  
Password is locked:                 no             <<<<<=====
Password not required:              no                                  
Login by password disabled:         yes            <<<<<=====
Primary group:                      bob                                 
GID:                                1002                                
Hushed:                             no                                  
Password expiration warn interval:  7                                   
Password changed:                   20:00                               
Maximum change time:                99999                               
Running processes:                  0                                   

Last logs:

# cat /etc/passwd | grep bob
bob:x:1002:1002::/home/bob:/bin/bash

# cat /etc/shadow | grep bob
bob:!!$6$.18513c.OKQEXCS/$PcBAvB<...>:19146:0:99999:7:::

# vi /etc/shadow

# cat /etc/shadow | grep bob
bob:!$6$.18513c.OKQEXCS/$PcBAvB<...>:19146:0:99999:7:::

# passwd -S bob
bob LK 2022-06-02 0 99999 7 -1 (Password locked.)

# lslogins bob
Username:                           bob                                 
UID:                                1002                                
Gecos field:                                                            
Home directory:                     /home/bob                           
Shell:                              /bin/bash                           
No login:                           no                                  
Password is locked:                 yes            <<<<<=====
Password not required:              no                                  
Login by password disabled:         no             <<<<<=====
Primary group:                      bob                                 
GID:                                1002                                
Hushed:                             no                                  
Password expiration warn interval:  7                                   
Password changed:                   20:00                               
Maximum change time:                99999                               
Running processes:                  0                                   

Last logs:
~~~

Actual results:
"Password is locked" shows "no" when account is locked.

Expected results:
"Password is locked" shows "yes" when account is locked.

Additional info:

--- Additional comment from Karel Zak on 2022-06-07 07:20:11 UTC ---

Good catch. It seems the lslogins code follows shadow(5) documentation rather than a real way of how passed(1) works.

Fixed in upstream repository:
https://github.com/util-linux/util-linux/commit/c51cba1e838ae7e36a843ec785543492bb8737cd