I'm thinking about adding a small programm to the shadow group and setting its setgid bit:
chown :shadow myprogram chmod g+s myprogram
The program uses the Linux PAM library to authenticate users for another service if they can provide their login password.
What is the worst that could happen in this scenario, in the case
myprogram has some vulnerability? I can only think of easier access to the hashed passwords, how critical is this in practice?