homed: don't block logins into accounts with future change time

This might happen if the system clock is wrong, and we should allow
access in this case (though certainly log about it).

1 files changed, 6 insertions, 5 deletions

diff --git a/src/shared/user-record.c b/src/shared/user-record.c
index e04df4d78b..a80c4932d1 100644
--- a/src/shared/user-record.c
+++ b/src/shared/user-record.c
@@ -2025,19 +2025,20 @@ int user_record_test_blocked(UserRecord *h) {
 
         assert(h);
 
-        n = now(CLOCK_REALTIME);
-        if (h->last_change_usec != UINT64_MAX &&
-            h->last_change_usec > n) /* Don't allow log ins when the record is from the future */
-                return -ESTALE;
-
         if (h->locked > 0)
                 return -ENOLCK;
 
+        n = now(CLOCK_REALTIME);
+
         if (h->not_before_usec != UINT64_MAX && n < h->not_before_usec)
                 return -EL2HLT;
         if (h->not_after_usec != UINT64_MAX && n > h->not_after_usec)
                 return -EL3HLT;
 
+        if (h->last_change_usec != UINT64_MAX &&
+            h->last_change_usec > n) /* Complain during log-ins when the record is from the future */
+                return -ESTALE;
+
         return 0;
 }