# SPDX-License-Identifier: LGPL-2.1-or-later
# This file is part of systemd.
#
# Used by systemd --user instances.

account  required   pam_unix.so no_pass_expiry

# systemd never invokes pam_authenticate() on this stack, but it does invoke pam_setcred(), which runs the
# "auth" stack too. Hence an "auth" entry is needed that lets pam_setcred() succeed, without falling back to
# the "other" service (which typically consists of pam_warn/pam_deny, and thus generates log noise).
# pam_rootok's pam_sm_setcred() unconditionally succeeds, while its pam_sm_authenticate() only succeeds for
# callers running as root (which the service manager does).
auth     required   pam_rootok.so

session  required   pam_selinux.so close
session  required   pam_selinux.so nottys open
session  required   pam_loginuid.so
session  optional   pam_keyinit.so force revoke
session  required   pam_namespace.so
session  optional   pam_umask.so silent
session  optional   pam_systemd.so
