usermod: only lock shadow file as needed

When setting user attributes that have nothing to do with shadow
we don't need to lock it.

Closes: https://github.com/shadow-maint/shadow/issues/1540
Signed-off-by: Pat Riehecky <riehecky@fnal.gov>

diff --git a/src/usermod.c b/src/usermod.c
index 30acde424cfa516153175a52a8ba3c5e8ed5685a..27fba2bfb2872ad290bdbe61234a77399530676c 100644 (file)
--- a/src/usermod.c
+++ b/src/usermod.c
@@ -1652,18 +1652,20 @@ static void open_files (bool process_selinux)
                         Prog, pw_dbname ());
                fail_exit (E_PW_UPDATE, process_selinux);
        }
-       if (is_shadow_pwd && (spw_lock () == 0)) {
-               fprintf (stderr,
-                        _("%s: cannot lock %s; try again later.\n"),
-                        Prog, spw_dbname ());
-               fail_exit (E_PW_UPDATE, process_selinux);
-       }
-       spw_locked = true;
-       if (is_shadow_pwd && (spw_open (O_CREAT | O_RDWR) == 0)) {
-               fprintf (stderr,
-                        _("%s: cannot open %s\n"),
-                        Prog, spw_dbname ());
-               fail_exit (E_PW_UPDATE, process_selinux);
+       if (is_shadow_pwd && (lflg || pflg || eflg || fflg || Lflg || Uflg)) {
+               if (spw_lock () == 0) {
+                       fprintf (stderr,
+                               _("%s: cannot lock %s; try again later.\n"),
+                               Prog, spw_dbname ());
+                       fail_exit (E_PW_UPDATE, process_selinux);
+               }
+               spw_locked = true;
+               if (is_shadow_pwd && (spw_open (O_CREAT | O_RDWR) == 0)) {
+                       fprintf (stderr,
+                               _("%s: cannot open %s\n"),
+                               Prog, spw_dbname ());
+                       fail_exit (E_PW_UPDATE, process_selinux);
+               }
        }
 
        if (Gflg || lflg) {