1

Starting with my original pam.d/login file :

auth include system-local-login account include system-local-login password include system-local-login session optional pam_lastlog.so session include system-local-login

I need, as an option, the service of additional MODULE (let's say pam_kwallet5.so as an example)

auth include system-local-login auth optional MODULE account include system-local-login password include system-local-login session optional pam_lastlog.so session include system-local-login session optional MODULE PARAMs

This achieves the goal as expected.

However, I now would lik to restrict this option to non-root users.

(let's say for example that, as root will never ever start kde, launching the kwalletd5 daemon at login serves no purpose)

I tried to find my way via the pam_listfile.so module but in vain.

EDIT 1 : Wondering wether creating a pseudo-conditionnal entry thanks to pam_exec.so in the way described here could be an acceptable solution.

EDIT 2 : Before discovering muru's better solution, I had managed to find a way thanks to pam_succeed_if.so used as follows :

auth include system-local-login auth [default=1 success=ignore] pam_succeed_if.so uid > 0 auth optional MODULE account include system-local-login password include system-local-login session optional pam_lastlog.so session include system-local-login session [default=1 success=ignore] pam_succeed_if.so uid > 0 session optional MODULE PARAMs

muru's solution, based on the same principle of ignoring a given number of following rules is however nicer in that it uses a more dedicated module : pam_rootok.so

Improve this question

1 Answer 1

Reset to default
2

A combination of success=1 and pam_rootok.so should work:

auth [success=1,default=ignore] pam_rootok.so auth optional MODULE

From man 5 pam.conf:

For the more complicated syntax valid control values have the following form: [value1=action1 value2=action2 ...] Where valueN corresponds to the return code from the function invoked in the module for which the line is defined. ... The actionN can take one of the following forms: ... N (an unsigned integer) equivalent to ok with the side effect of jumping over the next N modules in the stack. Note that N equal to 0 is not allowed (and it would be identical to ok in such case).

So success=1 should make PAM skip over MODULE if pam_rootok.so succeeds (which would be when the user is root).

Improve this answer
1
  • Thanks @muru a lot for your attention and time. As edited in my question, I had found a way thanks to pam_succeed_if.so But your suggestion appears indeed nicer because more dedicated. => my vote. Commented Jun 8, 2021 at 19:45

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.