From 405873c68ad94151c2374d796fb07d30abe25e95 Mon Sep 17 00:00:00 2001 From: Ashlen Date: Wed, 15 Jul 2026 13:23:54 -0600 Subject: [PATCH] fix(pam-info): restore deny default when faillock.conf lacks it When /etc/security/faillock.conf has no uncommented "deny =" line (commented out, or written without spaces), the parse overwrites the deny=3 default with an empty string. The empty value slips past the [[ "$deny" == *[!0-9]* ]] numeric guard, then evaluates to 0 in the remaining-attempts arithmetic, producing a false "Login blocked, boot into recovery mode" message for users still well below the threshold. Fall back to the documented default of 3 when the parse yields empty. --- usr/libexec/security-misc/pam-info#security-misc-shared | 3 +++ 1 file changed, 3 insertions(+) diff --git a/usr/libexec/security-misc/pam-info#security-misc-shared b/usr/libexec/security-misc/pam-info#security-misc-shared index d55c6a93..6fd5d5f9 100755 --- a/usr/libexec/security-misc/pam-info#security-misc-shared +++ b/usr/libexec/security-misc/pam-info#security-misc-shared @@ -248,6 +248,9 @@ deny=3 if test -f /etc/security/faillock.conf ; then deny_line=$(grep --invert-match "#" -- /etc/security/faillock.conf | grep -- "deny =") || true deny="$(printf '%s\n' "$deny_line" | str_replace "=" "" | str_replace "deny" "" | str_replace " " "")" + ## Restore the default if no uncommented 'deny =' line was found; an empty + ## value would slip past the numeric guard below and cause a false lockout. + [ -n "$deny" ] || deny=3 ## Example: #deny=50 fi