libpam: Add a patch to allow null passwords

[erickshepherdNI]

Summary of Changes

Add a patch to linux-pam that allows users to set a blank password when using the passwd command and when updating an expired password. This is done by not setting "\0" passwords to NULL and setting the password hash to be blank for "\0" passwords.

AB#3962858

Justification

This change will help our internal teams and customers adapt to the Set on First Use strategy of shipping with expired passwords by allowing them to set the new password to be blank.

Testing

• On a machine with ni-auth removed:
  • Ran "passwd root" and set the password to be non-blank
    • Confirmed that the usual password change workflow still works
    • Was able to log in with the new non-blank password
  • Ran "passwd root" and set the password to be blank
    • Confirmed that the root entry in /etc/shadow had an empty password
    • Was able to connect via SSH with a blank password
  • Ran "password -e root" to set the password to expired
    • Was able to set the password to blank when making a new password on the next SSH connection
    • Confirmed that the root entry in /etc/shadow had an empty password
    • Started a new SSH session using the blank password

• I have built the core package feed with this PR in place. (bitbake packagefeed-ni-core)

Procedure

• I certify that the contents of this pull request complies with the Developer Certificate of Origin.

[Copilot]

Pull request overview

This PR introduces an NI-specific linux-pam patch to allow setting an empty (blank) password via passwd/expired-password flows, and updates the Yocto recipe append to apply the patch and enable the necessary PAM option in the installed configuration.

Changes:

• Adds a linux-pam patch that keeps "\0" passwords as empty strings (instead of converting them to NULL) and writes an empty shadow-field when a blank password is chosen.
• Updates the libpam .bbappend to apply the patch and inject nullok into /etc/pam.d/common-password during install.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
recipes-extended/pam/libpam/0001-pam_unix_passwd-allow-blank-passwords.patch	Adds linux-pam source/docs changes to permit blank passwords (when configured).
recipes-extended/pam/libpam_1.%.bbappend	Applies the patch and modifies PAM config to add nullok during image build.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

Suppressed comments (1)

recipes-extended/pam/libpam/0001-pam_unix_passwd-allow-blank-passwords.patch:30

• The updated pam_unix documentation no longer mentions that the behavior is controlled by the nullok option, and the new wording reads like the default action both denies blank passwords and allows setting them during password changes. This is misleading given the patch description (“toggled by the nullok option”).

             The default action of this module is to not permit the
-            user access to a service if their official password is blank.
-            The <option>nullok</option> argument overrides this default.
+            user access to a service if their official password is blank
+            or allow blank passwords to be set during password changes.
           </para>

[bstreiff]

Does passwd -d not work for accomplishing the goal of setting a blank password, without needing a libpam patch?

(I just went down the same "passwd won't let me supply an empty string to New Password:" rabbithole with NILE.)

[erickshepherdNI]

Does passwd -d not work for accomplishing the goal of setting a blank password, without needing a libpam patch?

(I just went down the same "passwd won't let me supply an empty string to New Password:" rabbithole with NILE.)

This patch is intended to support the workflow of setting a blank password in the expired password prompt itself so that users can immediately set a blank password during set on first use. passwd -d does work for setting a blank password but they would first need to set a non-blank password to run the command.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.