diff -up Linux-PAM-0.99.8.1/modules/pam_unix/unix_chkpwd.c.blankpass Linux-PAM-0.99.8.1/modules/pam_unix/unix_chkpwd.c
--- Linux-PAM-0.99.8.1/modules/pam_unix/unix_chkpwd.c.blankpass	2007-09-18 13:50:40.000000000 +0200
+++ Linux-PAM-0.99.8.1/modules/pam_unix/unix_chkpwd.c	2007-09-18 13:50:40.000000000 +0200
@@ -50,7 +50,7 @@ int main(int argc, char *argv[])
 	char pass[MAXPASS + 1];
 	char *option;
 	int npass, nullok;
-	int force_failure = 0;
+	int blankpass = 0;
 	int retval = PAM_AUTH_ERR;
 	char *user;
 	char *passwords[] = { pass };
@@ -115,6 +115,10 @@ int main(int argc, char *argv[])
 	if (npass != 1) {	/* is it a valid password? */
 		_log_err(LOG_DEBUG, "no valid password supplied");
 	}
+	
+	if (*pass == '\0') {
+		blankpass = 1;
+	}
 
 	retval = _unix_verify_password(user, pass, nullok);
 
@@ -122,8 +126,11 @@ int main(int argc, char *argv[])
 
 	/* return pass or fail */
 
-	if ((retval != PAM_SUCCESS) || force_failure) {
-	    _log_err(LOG_NOTICE, "password check failed for user (%s)", user);
+	if (retval != PAM_SUCCESS) {
+	    /* don't log if it is a test for blank password */
+	    if (!blankpass) {
+		_log_err(LOG_NOTICE, "password check failed for user (%s)", user);
+	    }
 	    return PAM_AUTH_ERR;
 	} else {
 	    return PAM_SUCCESS;
diff -up Linux-PAM-0.99.8.1/modules/pam_unix/support.c.blankpass Linux-PAM-0.99.8.1/modules/pam_unix/support.c
--- Linux-PAM-0.99.8.1/modules/pam_unix/support.c.blankpass	2007-09-18 13:50:40.000000000 +0200
+++ Linux-PAM-0.99.8.1/modules/pam_unix/support.c	2007-09-18 17:56:57.000000000 +0200
@@ -38,6 +38,9 @@
 
 const char app_name[]="pam_unix";
 
+static int _unix_run_helper_binary(pam_handle_t *pamh, const char *passwd,
+				   unsigned int ctrl, const char *user);
+
 /* this is a front-end for module-application conversations */
 
 int _make_remark(pam_handle_t * pamh, unsigned int ctrl,
@@ -442,6 +445,13 @@ _unix_blankpasswd (pam_handle_t *pamh, u
 			 * ...and shadow password file entry for this user,
 			 * if shadowing is enabled
 			 */
+			if (geteuid() || SELINUX_ENABLED) {
+				/* We do not have direct access to shadow. Run helper. */
+				D(("running helper binary"));
+				if (_unix_run_helper_binary(pamh, "", ctrl, name) == PAM_SUCCESS)
+					return 1;
+				return 0;
+			}
 			spwdent = pam_modutil_getspnam(pamh, name);
 		}
 		if (spwdent)