From 5debfcf1aa775201c0b6cc589237648e17a1744f Mon Sep 17 00:00:00 2001
From: Marc Schoolderman <marc@tweedegolf.com>
Date: Mon, 13 Jul 2026 17:20:52 +0200
Subject: [PATCH 1/2] allow authenticationg by users with deleted passwords
 also in sudo

---
 src/sudo/pam.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/sudo/pam.rs b/src/sudo/pam.rs
index 0f94ae8d5..22270132e 100644
--- a/src/sudo/pam.rs
+++ b/src/sudo/pam.rs
@@ -54,7 +54,7 @@ pub(super) fn init_pam(
         Some(auth_user),
     )?;
     pam.mark_silent(matches!(launch, LaunchType::Direct));
-    pam.mark_allow_null_auth_token(false);
+    pam.mark_allow_null_auth_token(true);
     pam.set_requesting_user(requesting_user)?;
 
     match auth_prompt.as_deref() {

From eeddabdb16176255a44503af47c0421cbf4d44b3 Mon Sep 17 00:00:00 2001
From: Marc Schoolderman <marc@tweedegolf.com>
Date: Mon, 13 Jul 2026 17:38:35 +0200
Subject: [PATCH 2/2] add compliance test

---
 .../sudo-compliance-tests/src/sudo/pam.rs     | 25 +++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/test-framework/sudo-compliance-tests/src/sudo/pam.rs b/test-framework/sudo-compliance-tests/src/sudo/pam.rs
index 47b6b0bbd..3f06f4c7d 100644
--- a/test-framework/sudo-compliance-tests/src/sudo/pam.rs
+++ b/test-framework/sudo-compliance-tests/src/sudo/pam.rs
@@ -446,3 +446,28 @@ cat {PAM_ENV_VALUE} >&3"#
     let (expected, pam_env) = parse_expected_tty_and_pam_env(&stdout);
     assert_pam_tty_matches_expected(&expected, &pam_env);
 }
+
+#[test]
+fn empty_password_nullok() {
+    let env = Env(format!("{USERNAME} ALL=(ALL:ALL) ALL"))
+        .user(User(USERNAME).password(PASSWORD))
+        .file(
+            "/etc/pam.d/sudo",
+            "auth sufficient pam_unix.so nullok
+auth requisite pam_deny.so
+",
+        )
+        .build();
+
+    Command::new("passwd")
+        .args(["-d", USERNAME])
+        .output(&env)
+        .assert_success();
+
+    Command::new("sudo")
+        .args(["-S", "true"])
+        .as_user(USERNAME)
+        .stdin("")
+        .output(&env)
+        .assert_success();
+}