From ad358ed9992620c352fb71e089c363aa933d2a4e Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Fri, 17 Jan 2025 10:11:11 +0100
Subject: [PATCH] system: more of the same for #8221

---
 src/etc/inc/auth.inc               | 4 ++--
 src/etc/inc/plugins.inc.d/core.inc | 3 ++-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/etc/inc/auth.inc b/src/etc/inc/auth.inc
index 012faf2ba..e9d9dca06 100644
--- a/src/etc/inc/auth.inc
+++ b/src/etc/inc/auth.inc
@@ -243,7 +243,7 @@ function local_sync_accounts()
         $config_map[$section] = [];
         if (is_array($config['system'][$section])) {
             foreach ($config['system'][$section] as $item) {
-                if ($section == 'user' && empty($item['shell'])) {
+                if ($section == 'user' && (empty($item['shell']) || $user['uid'] != 0)) {
                     /* no shell, no local user */
                     continue;
                 }
@@ -293,7 +293,7 @@ function local_user_set(&$user, $force_password = false, $userattrs = null)
     if (empty($user['password'])) {
         auth_log("Cannot set user {$user['name']}: password is missing");
         return;
-    } elseif (empty($user['shell'])) {
+    } elseif (empty($user['shell']) || $user['uid'] != 0) {
         /* no shell, no local user */
         return;
     }
diff --git a/src/etc/inc/plugins.inc.d/core.inc b/src/etc/inc/plugins.inc.d/core.inc
index d8d8a0d40..fd1a18cf2 100644
--- a/src/etc/inc/plugins.inc.d/core.inc
+++ b/src/etc/inc/plugins.inc.d/core.inc
@@ -489,9 +489,10 @@ function core_run()
 function core_user_changed_groups($unused, $username)
 {
     global $config;
+
     if (is_array($config['system']['user'])) {
         foreach ($config['system']['user'] as $user) {
-            if ($user['name'] == $username && !empty($user['shell'])) {
+            if ($user['name'] == $username && (!empty($user['shell']) || $user['uid'] == 0)) {
                 exec("/usr/bin/groups " . escapeshellarg($username) . ' 2>/dev/null', $out, $ret);
                 $current_groups = [];
                 if (!$ret) {