From b0ccad2527fdc191fa909ce0f229e115142cda4a Mon Sep 17 00:00:00 2001
From: Serge Hallyn <serge@hallyn.com>
Date: Sat, 22 Mar 2025 07:54:27 -0500
Subject: [PATCH] passwd: document exit code when PAM has errored

closes #1219

When pam returns an error, we were exiting with exit code 10,
which was hardcoded and not documented.  Create a name for it,
and document it in the manpage.

Signed-off-by: Serge Hallyn <serge@hallyn.com>
Reported-by: Marc Haber <githubvisible@zugschlus.de>
Reviewed-by: Alejandro Colomar <alx@kernel.org>
---
 lib/pam_pass.c   | 4 ++--
 man/passwd.1.xml | 6 ++++++
 src/passwd.c     | 1 +
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/lib/pam_pass.c b/lib/pam_pass.c
index ff4917395..0e3ec4c03 100644
--- a/lib/pam_pass.c
+++ b/lib/pam_pass.c
@@ -40,7 +40,7 @@ void do_pam_passwd (const char *user, bool silent, bool change_expired)
 	if (ret != PAM_SUCCESS) {
 		fprintf (shadow_logfd,
 			 _("passwd: pam_start() failed, error %d\n"), ret);
-		exit (10);	/* XXX */
+		exit (E_PAM_ERR);
 	}
 
 	ret = pam_chauthtok (pamh, flags);
@@ -48,7 +48,7 @@ void do_pam_passwd (const char *user, bool silent, bool change_expired)
 		fprintf (shadow_logfd, _("passwd: %s\n"), pam_strerror (pamh, ret));
 		fputs (_("passwd: password unchanged\n"), shadow_logfd);
 		pam_end (pamh, ret);
-		exit (10);	/* XXX */
+		exit (E_PAM_ERR);
 	}
 
 	fputs (_("passwd: password updated successfully\n"), shadow_logfd);
diff --git a/man/passwd.1.xml b/man/passwd.1.xml
index c1540990f..a407f10b7 100644
--- a/man/passwd.1.xml
+++ b/man/passwd.1.xml
@@ -484,6 +484,12 @@
 	    <para>invalid argument to option</para>
 	  </listitem>
 	</varlistentry>
+	<varlistentry>
+	  <term><replaceable>10</replaceable></term>
+	  <listitem>
+	    <para>an error was returned by <refentrytitle>pam</refentrytitle><manvolnum>3</manvolnum></para>
+	  </listitem>
+	</varlistentry>
       </variablelist>
     </para>
   </refsect1>
diff --git a/src/passwd.c b/src/passwd.c
index cc79960a5..c545550fd 100644
--- a/src/passwd.c
+++ b/src/passwd.c
@@ -51,6 +51,7 @@
 #define E_MISSING	4	/* unexpected failure, passwd file missing */
 #define E_PWDBUSY	5	/* passwd file busy, try again later */
 #define E_BAD_ARG	6	/* invalid argument to option */
+#define E_PAM_ERR	10	/* PAM returned an error */
 /*
  * Global variables
  */
-- 
2.47.2