use getpwduid() instead of getenv(USER); create pam simple pam service named slock, instead of assuming that login exists; use pam_acct_mgmt to confirm that the account is still valid and also do PAM_REFRESH_CRED after everything else is success