halt getspnam[_r] search on error accessing TCB shadow

fallback to /etc/shadow should happen only when the entry is not found
in the TCB shadow. otherwise transient errors or permission errors can
cause inconsistent results.

src/passwd/getspnam_r.c

@@ -94,6 +94,8 @@ int getspnam_r(const char *name, struct spwd *sp, char *buf, size_t size, struct
 			return errno;
 		}
 	} else {
+		if (errno != ENOENT && errno != ENOTDIR)
+			return errno;
 		f = fopen("/etc/shadow", "rbe");
 		if (!f) {
 			if (errno != ENOENT && errno != ENOTDIR)