diff --color -ruN pam_u2f-1.0.8-ori/pam-u2f.c pam_u2f-1.0.8-patched/pam-u2f.c
--- pam_u2f-1.0.8-ori/pam-u2f.c	2019-06-04 11:28:00.000000000 +0200
+++ pam_u2f-1.0.8-patched/pam-u2f.c	2025-01-10 16:27:39.014787612 +0100
@@ -146,7 +146,7 @@
   char *authfile_dir;
   size_t authfile_dir_len;
   int pgu_ret, gpn_ret;
-  int retval = PAM_IGNORE;
+  int retval = PAM_ABORT;
   device_t *devices = NULL;
   unsigned n_devices = 0;
   int openasuser = 0;
@@ -164,12 +164,14 @@
     if (gethostname(buffer + strlen(DEFAULT_ORIGIN_PREFIX),
                     BUFSIZE - strlen(DEFAULT_ORIGIN_PREFIX)) == -1) {
       DBG("Unable to get host name");
+      retval = PAM_SYSTEM_ERR;  
       goto done;
     }
     DBG("Origin not specified, using \"%s\"", buffer);
     cfg->origin = strdup(buffer);
     if (!cfg->origin) {
       DBG("Unable to allocate memory");
+      retval = PAM_BUF_ERR;
       goto done;
     } else {
       should_free_origin = 1;
@@ -182,6 +184,7 @@
     cfg->appid = strdup(cfg->origin);
     if (!cfg->appid) {
       DBG("Unable to allocate memory")
+      retval = PAM_BUF_ERR;
       goto done;
     } else {
       should_free_appid = 1;
@@ -196,7 +199,7 @@
   devices = malloc(sizeof(device_t) * cfg->max_devs);
   if (!devices) {
     DBG("Unable to allocate memory");
-    retval = PAM_IGNORE;
+    retval = PAM_BUF_ERR;
     goto done;
   }
 
@@ -214,7 +217,7 @@
       pw->pw_dir[0] != '/') {
     DBG("Unable to retrieve credentials for user %s, (%s)", user,
          strerror(errno));
-    retval = PAM_USER_UNKNOWN;
+    retval = PAM_SYSTEM_ERR;
     goto done;
   }
 
@@ -233,7 +236,7 @@
 
       if (!buf) {
         DBG("Unable to allocate memory");
-        retval = PAM_IGNORE;
+        retval = PAM_BUF_ERR;
         goto done;
       }
 
@@ -249,7 +252,7 @@
 
       if (!buf) {
         DBG("Unable to allocate memory");
-        retval = PAM_IGNORE;
+        retval = PAM_BUF_ERR;
         goto done;
       }
 
@@ -278,7 +281,7 @@
     DBG("Dropping privileges");
     if (pam_modutil_drop_priv(pamh, &privs, pw)) {
       DBG("Unable to switch user to uid %i", pw->pw_uid);
-      retval = PAM_IGNORE;
+      retval = PAM_SYSTEM_ERR;
       goto done;
     }
     DBG("Switched to uid %i", pw->pw_uid);
@@ -289,32 +292,14 @@
   if (openasuser) {
     if (pam_modutil_regain_priv(pamh, &privs)) {
       DBG("could not restore privileges");
-      retval = PAM_IGNORE;
+      retval = PAM_SYSTEM_ERR;
       goto done;
     }
     DBG("Restored privileges");
   }
 
-  if (retval != 1) {
-    // for nouserok; make sure errors in get_devices_from_authfile don't
-    // result in valid devices
-    n_devices = 0;
-  }
-
-  if (n_devices == 0) {
-    if (cfg->nouserok) {
-      DBG("Found no devices but nouserok specified. Skipping authentication");
-      retval = PAM_SUCCESS;
-      goto done;
-    } else if (retval != 1) {
-      DBG("Unable to get devices from file %s", cfg->auth_file);
-      retval = PAM_AUTHINFO_UNAVAIL;
-      goto done;
-    } else {
-      DBG("Found no devices. Aborting.");
-      retval = PAM_AUTHINFO_UNAVAIL;
-      goto done;
-    }
+  if (retval != PAM_SUCCESS) {
+    goto done;
   }
 
   // Determine the full path for authpending_file in order to emit touch request notifications
@@ -367,14 +352,6 @@
     }
   }
 
-  if (retval != 1) {
-    DBG("do_authentication returned %d", retval);
-    retval = PAM_AUTH_ERR;
-    goto done;
-  }
-
-  retval = PAM_SUCCESS;
-
 done:
   free_devices(devices, n_devices);
 
diff --color -ruN pam_u2f-1.0.8-ori/util.c pam_u2f-1.0.8-patched/util.c
--- pam_u2f-1.0.8-ori/util.c	2019-06-04 11:28:00.000000000 +0200
+++ pam_u2f-1.0.8-patched/util.c	2025-01-10 16:57:57.485295941 +0100
@@ -24,12 +24,9 @@
 
   char *buf = NULL;
   char *s_user, *s_token;
-  int retval = 0;
+  int retval = PAM_AUTHINFO_UNAVAIL;
   int fd = -1;
   struct stat st;
-  struct passwd *pw = NULL, pw_s;
-  char buffer[BUFSIZE];
-  int gpu_ret;
   FILE *opwfile = NULL;
   unsigned i, j;
 
@@ -38,6 +35,10 @@
 
   fd = open(authfile, O_RDONLY | O_CLOEXEC | O_NOCTTY);
   if (fd < 0) {
+    if (errno == ENOENT) {
+      retval = PAM_IGNORE;
+    }
+
     if (verbose)
       D(debug_file, "Cannot open file: %s (%s)", authfile, strerror(errno));
     goto err;
@@ -55,26 +56,9 @@
     goto err;
   }
 
-  if (st.st_size == 0) {
+  if (st.st_uid != 0 && st.st_uid != geteuid()) {
     if (verbose)
-      D(debug_file, "File %s is empty", authfile);
-    goto err;
-  }
-
-  gpu_ret = getpwuid_r(st.st_uid, &pw_s, buffer, sizeof(buffer), &pw);
-  if (gpu_ret != 0 || pw == NULL) {
-    D(debug_file, "Unable to retrieve credentials for uid %u, (%s)", st.st_uid,
-       strerror(errno));
-    goto err;
-  }
-
-  if (strcmp(pw->pw_name, username) != 0 && strcmp(pw->pw_name, "root") != 0) {
-    if (strcmp(username, "root") != 0) {
-      D(debug_file, "The owner of the authentication file is neither %s nor root",
-         username);
-    } else {
-      D(debug_file, "The owner of the authentication file is not root");
-    }
+      D(debug_file, "Authentication file has insecure ownership");
     goto err;
   }
 
@@ -193,10 +177,11 @@
   if (verbose)
     D(debug_file, "Found %d device(s) for user %s", *n_devs, username);
 
-  retval = 1;
+  retval = PAM_SUCCESS;
   goto out;
 
 err:
+
   for (i = 0; i < *n_devs; i++) {
     free(devices[i].keyHandle);
     free(devices[i].publicKey);
@@ -248,7 +233,7 @@
   u2fh_devs *devs = NULL;
   char *response = NULL;
   char *buf;
-  int retval = -2;
+  int retval = PAM_AUTH_ERR;
   int cued = 0;
   unsigned i = 0;
   unsigned max_index = 0;
@@ -304,9 +289,6 @@
 
   i = 0;
   while (i < n_devs) {
-
-    retval = -2;
-
     if (cfg->debug)
       D(cfg->debug_file, "Attempting authentication with device number %d", i + 1);
 
@@ -353,7 +335,7 @@
         free(response);
         response = NULL;
         if (s_rc == U2FS_OK) {
-          retval = 1;
+          retval = PAM_SUCCESS;
 
           free(buf);
           buf = NULL;
@@ -406,7 +388,7 @@
   char *response = NULL;
   char prompt[MAX_PROMPT_LEN];
   char *buf;
-  int retval = -2;
+  int retval = PAM_AUTH_ERR;
   unsigned i = 0;
 
   if (u2fs_global_init(0) != U2FS_OK) {
@@ -477,8 +459,6 @@
   converse(pamh, PAM_TEXT_INFO,
            "Now, please enter the response(s) below, one per line.");
 
-  retval = -1;
-
   for (i = 0; i < n_devs; ++i) {
     snprintf(prompt, sizeof(prompt), "[%d]: ", i);
     response = converse(pamh, PAM_PROMPT_ECHO_ON, prompt);
@@ -487,10 +467,10 @@
     s_rc = u2fs_authentication_verify(ctx_arr[i], response, &auth_result);
     u2fs_free_auth_res(auth_result);
     if (s_rc == U2FS_OK) {
-      retval = 1;
+      retval = PAM_SUCCESS;
     }
     free(response);
-    if (retval == 1) {
+    if (retval == PAM_SUCCESS) {
         break;
     }
   }
