[PATCH] su: support denying accounts with blank password

[Natanael Copa]

Add a compile time option to disallow switching to an account with blank
password.

Signed-off-by: Natanael Copa <ncopa at alpinelinux.org>
---
A grep showed that all users of ask_and_check_password_extended
compared > 0 so this patch should not break anything.

 libbb/correct_password.c | 4 ++--
 loginutils/Config.src    | 5 +++++
 loginutils/su.c          | 3 +--
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/libbb/correct_password.c b/libbb/correct_password.c
index 513c930..afd307f 100644
--- a/libbb/correct_password.c
+++ b/libbb/correct_password.c
@@ -88,7 +88,7 @@ int FAST_FUNC check_password(const struct passwd *pw, const char *plaintext)
 
 
 /* Ask the user for a password.
- * Return 1 without asking if PW has an empty password.
+ * Return 2 without asking if PW has an empty password.
  * Return -1 on EOF, error while reading input, or timeout.
  * Return 1 if the user gives the correct password for entry PW,
  * 0 if not.
@@ -105,7 +105,7 @@ int FAST_FUNC ask_and_check_password_extended(const struct passwd *pw,
 
 	pw_pass = get_passwd(pw, buffer);
 	if (!pw_pass[0]) /* empty password field? */
-		return 1;
+		return 2;
 
 	plaintext = bb_ask(STDIN_FILENO, timeout, prompt);
 	if (!plaintext) {
diff --git a/loginutils/Config.src b/loginutils/Config.src
index fa2b4f8..42b86ac 100644
--- a/loginutils/Config.src
+++ b/loginutils/Config.src
@@ -311,6 +311,11 @@ config FEATURE_SU_CHECKS_SHELLS
 	depends on SU
 	default y
 
+config FEATURE_SU_DENY_EMPTY_PASSWD
+	bool "Enable su to deny empty passwords"
+	depends on SU
+	default n
+
 config SULOGIN
 	bool "sulogin"
 	default y
diff --git a/loginutils/su.c b/loginutils/su.c
index f812505..9cef3a6 100644
--- a/loginutils/su.c
+++ b/loginutils/su.c
@@ -92,8 +92,7 @@ int su_main(int argc UNUSED_PARAM, char **argv)
 	}
 
 	pw = xgetpwnam(opt_username);
-
-	if (cur_uid == 0 || ask_and_check_password(pw) > 0) {
+	if (cur_uid == 0 || ask_and_check_password(pw) > (ENABLE_FEATURE_SU_DENY_EMPTY_PASSWD ? 1 : 0)) {
 		if (ENABLE_FEATURE_SU_SYSLOG)
 			syslog(LOG_NOTICE, "%c %s %s:%s",
 				'+', tty, old_user, opt_username);
-- 
2.4.2