$NetBSD: patch-ao,v 1.2 2002/01/29 17:10:11 jlam Exp $

--- modules/pam_unix/pam_unix_passwd.c.orig	Sun Feb 11 01:33:53 2001
+++ modules/pam_unix/pam_unix_passwd.c
@@ -47,7 +47,10 @@
 #include <sys/types.h>
 #include <pwd.h>
 #include <syslog.h>
+#include <sys/param.h>
+#ifndef BSD
 #include <shadow.h>
+#endif
 #include <time.h>		/* for time() */
 #include <fcntl.h>
 #include <ctype.h>
@@ -77,7 +80,7 @@
 #include "md5.h"
 #include "support.h"
 
-#if !((__GLIBC__ == 2) && (__GLIBC_MINOR__ >= 1))
+#if !defined(BSD) && !((__GLIBC__ == 2) && (__GLIBC_MINOR__ >= 1))
 extern int getrpcport(const char *host, unsigned long prognum,
 		      unsigned long versnum, unsigned int proto);
 #endif				/* GNU libc 2.1 */
@@ -330,6 +333,9 @@
 
 static int _update_passwd(const char *forwho, const char *towhat)
 {
+#ifdef BSD
+	return PAM_AUTHTOK_ERR;
+#else
 	struct passwd *tmpent = NULL;
 	FILE *pwfile, *opwfile;
 	int retval = 0;
@@ -372,10 +378,14 @@
 		unlink(PW_TMPFILE);
 
 	return retval;
+#endif
 }
 
 static int _update_shadow(const char *forwho, char *towhat)
 {
+#ifdef BSD
+	return PAM_AUTHTOK_ERR;
+#else
 	struct spwd *spwdent = NULL, *stmpent = NULL;
 	FILE *pwfile, *opwfile;
 	int retval = 0;
@@ -424,6 +434,7 @@
 		unlink(SH_TMPFILE);
 
 	return retval;
+#endif
 }
 
 static int _do_setpass(pam_handle_t* pamh, const char *forwho, char *fromwhat,
@@ -531,15 +542,18 @@
 		return PAM_AUTHINFO_UNAVAIL;	/* We don't need to do the rest... */
 
 	if (strcmp(pwd->pw_passwd, "x") == 0) {
+#ifndef BSD
 		/* ...and shadow password file entry for this user, if shadowing
 		   is enabled */
 		setspent();
 		spwdent = getspnam(user);
 		endspent();
+#endif
 
 		if (spwdent == NULL)
 			return PAM_AUTHINFO_UNAVAIL;
 	} else {
+#ifndef BSD
 		if (strcmp(pwd->pw_passwd,"*NP*") == 0) { /* NIS+ */                 
 			uid_t save_uid;
 
@@ -552,8 +566,15 @@
 				return PAM_AUTHINFO_UNAVAIL;
 		} else
 			spwdent = NULL;
+#endif
 	}
 
+#ifdef BSD
+	if (off(UNIX__IAMROOT, ctrl)) {
+		if (time(NULL) > pwd->pw_expire)
+			retval = PAM_ACCT_EXPIRED;
+	}
+#else
 	if (spwdent != NULL) {
 		/* We have the user's information, now let's check if their account
 		   has expired (60 * 60 * 24 = number of seconds in a day) */
@@ -579,6 +600,7 @@
 				retval = PAM_ACCT_EXPIRED;
 		}
 	}
+#endif
 	return retval;
 }
 
