Index: shadow-4.0.18.1/man/passwd.1.xml
===================================================================
--- shadow-4.0.18.1.orig/man/passwd.1.xml	2007-06-21 02:04:59.531851133 +0200
+++ shadow-4.0.18.1/man/passwd.1.xml	2007-06-21 02:28:19.460572933 +0200
@@ -188,7 +188,8 @@
 	<listitem>
 	  <para>
 	    Lock the named account. This option disables an account by changing
-	    the password to a value which matches no possible encrypted value.
+	    the password to a value which matches no possible encrypted value,
+	    and by setting the account expiry field to 1.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -249,7 +250,8 @@
 	  <para>
 	    Unlock the named account. This option re-enables an account by
 	    changing the password back to its previous value (to value before
-	    using <option>-l</option> option).
+	    using <option>-l</option> option), and by resetting the account
+	    expiry field.
 	  </para>
 	</listitem>
       </varlistentry>
Index: shadow-4.0.18.1/src/passwd.c
===================================================================
--- shadow-4.0.18.1.orig/src/passwd.c	2007-06-21 02:05:36.029992809 +0200
+++ shadow-4.0.18.1/src/passwd.c	2007-06-21 02:28:19.460572933 +0200
@@ -531,6 +531,16 @@
 		nsp->sp_inact = (inact * DAY) / SCALE;
 	if (do_update_age)
 		nsp->sp_lstchg = time ((time_t *) 0) / SCALE;
+	if (lflg)
+	{
+		/* Set the account expiry field to 1.
+		 * Some PAM implementation consider zero as a non expired
+		 * account.
+		 */
+		nsp->sp_expire = 1;
+	}
+	if (uflg)
+		nsp->sp_expire = -1;
 
 	/*
 	 * Force change on next login, like SunOS 4.x passwd -e or Solaris
