firstboot: follow lock protocol when changing /etc/shadow