[PATCH access-control] fix #5368: pam: say that a failed password change is about the host user

[PATCH access-control] fix #5368: pam: say that a failed password change is about the host user

[Michal Fox]

Users of the PAM realm are users of the host system, and setting their
password runs usermod on the node handling the request. If the user
only got added to the PAM realm, but does not exist on the host, this
failed with:

  change password failed: user 'jdoe' does not exist

which is confusing, as the user is shown in the user list of the web UI
and the message does not say that the user on the host is meant.

Mention the PAM user and the host system in the error message, so that
it reads:

  changing the password of the PAM user 'jdoe' on the host system
  failed: user 'jdoe' does not exist

The output of usermod is still added at the end, so this helps with its
other errors too.

Signed-off-by: Michal Fox <me@dualfroz.com>
---

Notes:
    tested by calling store_password() as root in a Debian trixie container,
    for a missing user, which gave the error above, and for an existing
    user, whose password got changed. 'make test' in src passes.
    
    the errors of the PAM authentication itself are left as they are, they
    already are PAM's own messages like 'Authentication failure'.

 src/PVE/Auth/PAM.pm | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/PVE/Auth/PAM.pm b/src/PVE/Auth/PAM.pm
index 8586da5..c2b767d 100755
--- a/src/PVE/Auth/PAM.pm
+++ b/src/PVE/Auth/PAM.pm
@@ -89,7 +89,10 @@ sub store_password {
 
     push @$cmd, '-p', $epw, $username;
 
-    run_command($cmd, errmsg => 'change password failed');
+    run_command(
+        $cmd,
+        errmsg => "changing the password of the PAM user '$username' on the host system failed",
+    );
 }
 
 1;
-- 
2.43.0