Your company here, and a link to your site. Click to find out more.

pam_cap - Man Page

Capabilities PAM module


[service-name] auth control-flag pam_cap [options]


The pam_so module can be used to specify Inheritable capabilities to process trees rooted in the PAM application. The module also supports blocking Bounding vector capabilities and adding Ambient vector capabilities.

For general PAM apps to work correctly, the application must be run with at least CAP_SETPCAP raised in its Permitted capability flag. Many PAM applications run as root, which has all of the bits in the Bounding set raised, so this requirement is typically met. To grant an Ambient vector capability, the corresponding Permitted bit must be available to the application too.

The pam_so module is a Linux-PAM auth module. It provides functionality to back pam_sm_authenticate() and pam_sm_setcred(). It is the latter that actually modifies the inheritable 3-tuple of capability vectors: the configured IAB. In a typical application configuration you might have a line like this:

auth    optional    pam_cap.so

The module arguments are:

See Also

pam.conf(5), capability.conf(5), pam(8)

Referenced By


April 2024