FM / html

/usr/share/doc/pam/html

Name	Size	Mode	Actions
Linux-PAM_SAG.html	9196	0644	edit dl rm
sag-author.html	3111	0644	edit dl rm
sag-configuration-directory.html	2966	0644	edit dl rm
sag-configuration-example.html	5522	0644	edit dl rm
sag-configuration-file.html	17519	0644	edit dl rm
sag-configuration.html	3065	0644	edit dl rm
sag-copyright.html	3617	0644	edit dl rm
sag-introduction.html	4446	0644	edit dl rm
sag-module-reference.html	38152	0644	edit dl rm
sag-overview.html	7995	0644	edit dl rm
sag-pam_access.html	18120	0644	edit dl rm
sag-pam_cracklib.html	20271	0644	edit dl rm
sag-pam_debug.html	8087	0644	edit dl rm
sag-pam_deny.html	4704	0644	edit dl rm
sag-pam_echo.html	5752	0644	edit dl rm
sag-pam_env.html	12796	0644	edit dl rm
sag-pam_exec.html	8371	0644	edit dl rm
sag-pam_faildelay.html	4590	0644	edit dl rm
sag-pam_filter.html	9342	0644	edit dl rm
sag-pam_ftp.html	6203	0644	edit dl rm
sag-pam_group.html	10136	0644	edit dl rm
sag-pam_issue.html	6378	0644	edit dl rm
sag-pam_keyinit.html	7015	0644	edit dl rm
sag-pam_lastlog.html	8524	0644	edit dl rm
sag-pam_limits.html	18114	0644	edit dl rm
sag-pam_listfile.html	10534	0644	edit dl rm
sag-pam_localuser.html	5446	0644	edit dl rm
sag-pam_loginuid.html	5209	0644	edit dl rm
sag-pam_mail.html	7762	0644	edit dl rm
sag-pam_mkhomedir.html	6196	0644	edit dl rm
sag-pam_motd.html	7753	0644	edit dl rm
sag-pam_namespace.html	20640	0644	edit dl rm
sag-pam_nologin.html	5332	0644	edit dl rm
sag-pam_permit.html	4304	0644	edit dl rm
sag-pam_pwhistory.html	8476	0644	edit dl rm
sag-pam_rhosts.html	6404	0644	edit dl rm
sag-pam_rootok.html	5109	0644	edit dl rm
sag-pam_securetty.html	6480	0644	edit dl rm
sag-pam_selinux.html	8313	0644	edit dl rm
sag-pam_shells.html	4261	0644	edit dl rm
sag-pam_succeed_if.html	9154	0644	edit dl rm
sag-pam_time.html	9725	0644	edit dl rm
sag-pam_timestamp.html	6889	0644	edit dl rm
sag-pam_umask.html	6318	0644	edit dl rm
sag-pam_unix.html	15056	0644	edit dl rm
sag-pam_userdb.html	8585	0644	edit dl rm
sag-pam_warn.html	4569	0644	edit dl rm
sag-pam_wheel.html	7181	0644	edit dl rm
sag-pam_xauth.html	8420	0644	edit dl rm
sag-security-issues-other.html	2993	0644	edit dl rm
sag-security-issues-wrong.html	2963	0644	edit dl rm
sag-security-issues.html	2161	0644	edit dl rm
sag-see-also.html	2283	0644	edit dl rm
sag-text-conventions.html	3187	0644	edit dl rm

Edit: /usr/share/doc/pam/html/sag-pam_loginuid.html (5209B)

<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>6.18. pam_loginuid - record user's login uid to the process attribute</title><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot"><link rel="home" href="Linux-PAM_SAG.html" title="The Linux-PAM System Administrators' Guide"><link rel="up" href="sag-module-reference.html" title="Chapter 6. A reference guide for available modules"><link rel="prev" href="sag-pam_localuser.html" title="6.17. pam_localuser - require users to be listed in /etc/passwd"><link rel="next" href="sag-pam_mail.html" title="6.19. pam_mail - inform about available mail"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">6.18. pam_loginuid - record user's login uid to the process attribute</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="sag-pam_localuser.html">Prev</a> </td><th width="60%" align="center">Chapter 6. A reference guide for available modules</th><td width="20%" align="right"> <a accesskey="n" href="sag-pam_mail.html">Next</a></td></tr></table><hr></div><div class="section"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="sag-pam_loginuid"></a>6.18. pam_loginuid - record user's login uid to the process attribute</h2></div></div></div><div class="cmdsynopsis"><p><code class="command">pam_loginuid.so</code>  [
        require_auditd
      ]</p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sag-pam_loginuid-description"></a>6.18.1. DESCRIPTION</h3></div></div></div><p>
      The pam_loginuid module sets the loginuid process attribute for the
      process that was authenticated. This is necessary for applications
      to be correctly audited. This PAM module should only be used for entry
      point applications like: login, sshd, gdm, vsftpd, crond and atd.
      There are probably other entry point applications besides these.
      You should not use it for applications like sudo or su as that
      defeats the purpose by changing the loginuid to the account they just
      switched to.
    </p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sag-pam_loginuid-options"></a>6.18.2. OPTIONS</h3></div></div></div><div class="variablelist"><dl class="variablelist"><dt><span class="term">
          <code class="option">require_auditd</code>
        </span></dt><dd><p>
            This option, when given, will cause this module to query
            the audit daemon status and deny logins if it is not running.
          </p></dd></dl></div></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sag-pam_loginuid-types"></a>6.18.3. MODULE TYPES PROVIDED</h3></div></div></div><p>
      Only the <code class="option">session</code> module type is provided.
    </p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sag-pam_loginuid-return_values"></a>6.18.4. RETURN VALUES</h3></div></div></div><p>
      </p><div class="variablelist"><dl class="variablelist"><dt><span class="term">PAM_SUCCESS</span></dt><dd><p>
              The loginuid value is set and auditd is running if check requested.
            </p></dd><dt><span class="term">PAM_IGNORE</span></dt><dd><p>
              The /proc/self/loginuid file is not present on the system or the
              login process runs inside uid namespace and kernel does not support
              overwriting loginuid.
            </p></dd><dt><span class="term">PAM_SESSION_ERR</span></dt><dd><p>
              Any other error prevented setting loginuid or auditd is not running.
            </p></dd></dl></div><p>
    </p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sag-pam_loginuid-examples"></a>6.18.5. EXAMPLES</h3></div></div></div><pre class="programlisting">
#%PAM-1.0
auth       required     pam_unix.so
auth       required     pam_nologin.so
account    required     pam_unix.so
password   required     pam_unix.so
session    required     pam_unix.so
session    required     pam_loginuid.so
    </pre></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sag-pam_loginuid-author"></a>6.18.6. AUTHOR</h3></div></div></div><p>
        pam_loginuid was written by Steve Grubb &lt;sgrubb@redhat.com&gt;
      </p></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="sag-pam_localuser.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="sag-module-reference.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="sag-pam_mail.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">6.17. pam_localuser - require users to be listed in /etc/passwd </td><td width="20%" align="center"><a accesskey="h" href="Linux-PAM_SAG.html">Home</a></td><td width="40%" align="right" valign="top"> 6.19. pam_mail - inform about available mail</td></tr></table></div></body></html>

6.18. pam_loginuid - record user's login uid to the process attribute

6.18. pam_loginuid - record user's login uid to the process attribute
Prev	Chapter 6. A reference guide for available modules	Next

6.18. pam_loginuid - record user's login uid to the process attribute

pam_loginuid.so [ require_auditd ]

6.18.1. DESCRIPTION

The pam_loginuid module sets the loginuid process attribute for the process that was authenticated. This is necessary for applications to be correctly audited. This PAM module should only be used for entry point applications like: login, sshd, gdm, vsftpd, crond and atd. There are probably other entry point applications besides these. You should not use it for applications like sudo or su as that defeats the purpose by changing the loginuid to the account they just switched to.

6.18.2. OPTIONS

require_auditd: This option, when given, will cause this module to query the audit daemon status and deny logins if it is not running.

6.18.3. MODULE TYPES PROVIDED

Only the session module type is provided.

6.18.4. RETURN VALUES

PAM_SUCCESS: The loginuid value is set and auditd is running if check requested.
PAM_IGNORE: The /proc/self/loginuid file is not present on the system or the login process runs inside uid namespace and kernel does not support overwriting loginuid.
PAM_SESSION_ERR: Any other error prevented setting loginuid or auditd is not running.

6.18.5. EXAMPLES

#%PAM-1.0
auth       required     pam_unix.so
auth       required     pam_nologin.so
account    required     pam_unix.so
password   required     pam_unix.so
session    required     pam_unix.so
session    required     pam_loginuid.so

6.18.6. AUTHOR

pam_loginuid was written by Steve Grubb <sgrubb@redhat.com>

Prev	Up	Next
6.17. pam_localuser - require users to be listed in /etc/passwd	Home	6.19. pam_mail - inform about available mail