Sudo authentication for expired local passwords on Linux Mint

Goal: allow a standard local user with an expired /etc/shadow password to authenticate with sudo while keeping that user out of the sudo group and blocking graphical login until the password is reset.

Uncertainty: Linux Mint authenticates sudo through PAM, and pam_unix can return PAM_NEW_AUTHTOK_REQD when the password age exceeds the limit in /etc/login.defs. Whether sudo then fails, permits authentication, or triggers a password reset depends on the PAM service stack, which varies between Mint releases and their Ubuntu bases. Password expiration is separate from account locking, so an expired password does not by itself prevent all authentication.

Assumption: default Linux Mint installation with Ubuntu-derived PAM configuration and no custom /etc/sudoers.d entries.

Questions:

• Should the sudo PAM stack treat password expiration as a hard failure for non-administrative users, or allow authentication when the user holds an individual sudoers entry?
• Can LightDM be configured to force a password change at graphical login without granting the user sudo group membership?
• What is the least-privilege boundary between pam_unix account management and sudo authentication for expired credentials?