From e52f4f13416c1059e88f197104176c6f36fb89b4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pawe=C5=82=20Marczewski?= <pawel@invisiblethingslab.com>
Date: Wed, 6 May 2020 18:03:19 +0200
Subject: [PATCH] Lock root password in passwordless-root package

See QubesOS/qubes-issues#5799.

Undo the change to empty password previously performed by that
package.
---
 archlinux/PKGBUILD.install                        | 2 +-
 debian/qubes-core-agent-passwordless-root.preinst | 4 ++--
 rpm_spec/core-agent.spec.in                       | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/archlinux/PKGBUILD.install b/archlinux/PKGBUILD.install
index c3e9cdf..404c2d6 100644
--- a/archlinux/PKGBUILD.install
+++ b/archlinux/PKGBUILD.install
@@ -35,7 +35,7 @@ pre_install() {
     # Add qubes core related fstab entries
     echo "xen	/proc/xen	xenfs	defaults	0 0" >> /etc/fstab
 
-    usermod -p '' root
+    usermod -L root
     usermod -L user
 }
 
diff --git a/debian/qubes-core-agent-passwordless-root.preinst b/debian/qubes-core-agent-passwordless-root.preinst
index b72057e..ba7a6e9 100755
--- a/debian/qubes-core-agent-passwordless-root.preinst
+++ b/debian/qubes-core-agent-passwordless-root.preinst
@@ -33,8 +33,8 @@ set -e
 # https://www.debian.org/doc/debian-policy/ch-maintainerscripts.html or
 # the debian-policy package
 
-if [ "$1" = "install" ] ; then
-    usermod -p '' root
+if [ "$1" = "install" ] || [ "$1" = "upgrade" ]; then
+    usermod -L root
 fi
 
 # dh_installdeb will replace this with shell code automatically
diff --git a/rpm_spec/core-agent.spec.in b/rpm_spec/core-agent.spec.in
index 5b642c4..2fe4ad1 100644
--- a/rpm_spec/core-agent.spec.in
+++ b/rpm_spec/core-agent.spec.in
@@ -288,7 +288,7 @@ usermod -L user
 
 %pre passwordless-root
 
-usermod -p '' root
+usermod -L root
 
 %install