From: Pat Riehecky <riehecky@fnal.gov>
Date: Mon, 9 Mar 2026 16:43:12 +0000 (-0500)
Subject: usermod: only lock shadow file as needed
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1e0f5299272bfbfa57cb0d01fd5271cc5b285634;p=thirdparty%2Fshadow.git

usermod: only lock shadow file as needed

When setting user attributes that have nothing to do with shadow
we don't need to lock it.

Closes: https://github.com/shadow-maint/shadow/issues/1540

Signed-off-by: Pat Riehecky <riehecky@fnal.gov>
---

diff --git a/src/usermod.c b/src/usermod.c
index 30acde424..27fba2bfb 100644
--- a/src/usermod.c
+++ b/src/usermod.c
@@ -1652,18 +1652,20 @@ static void open_files (bool process_selinux)
 		         Prog, pw_dbname ());
 		fail_exit (E_PW_UPDATE, process_selinux);
 	}
-	if (is_shadow_pwd && (spw_lock () == 0)) {
-		fprintf (stderr,
-		         _("%s: cannot lock %s; try again later.\n"),
-		         Prog, spw_dbname ());
-		fail_exit (E_PW_UPDATE, process_selinux);
-	}
-	spw_locked = true;
-	if (is_shadow_pwd && (spw_open (O_CREAT | O_RDWR) == 0)) {
-		fprintf (stderr,
-		         _("%s: cannot open %s\n"),
-		         Prog, spw_dbname ());
-		fail_exit (E_PW_UPDATE, process_selinux);
+	if (is_shadow_pwd && (lflg || pflg || eflg || fflg || Lflg || Uflg)) {
+		if (spw_lock () == 0) {
+			fprintf (stderr,
+				_("%s: cannot lock %s; try again later.\n"),
+				Prog, spw_dbname ());
+			fail_exit (E_PW_UPDATE, process_selinux);
+		}
+		spw_locked = true;
+		if (is_shadow_pwd && (spw_open (O_CREAT | O_RDWR) == 0)) {
+			fprintf (stderr,
+				_("%s: cannot open %s\n"),
+				Prog, spw_dbname ());
+			fail_exit (E_PW_UPDATE, process_selinux);
+		}
 	}
 
 	if (Gflg || lflg) {