NAME¶

pam_systemd - Register user sessions in the systemd login manager

SYNOPSIS¶

pam_systemd.so

DESCRIPTION¶

pam_systemd registers user sessions with the systemd login manager systemd-logind.service(8), and hence the systemd control group hierarchy.

The module also applies various resource management and runtime parameters to the new session, as configured in the JSON User Records[1] of the user, when one is defined.

On login, this module — in conjunction with systemd-logind.service — ensures the following:

On logout, this module ensures the following:

If the system was not booted up with systemd as init system, this module does nothing and immediately returns PAM_SUCCESS.

OPTIONS¶

The following options are understood:

class=

type=

desktop=

default-capability-bounding-set=, default-capability-ambient-set=

debug[=]

MODULE TYPES PROVIDED¶

Only session is provided.

ENVIRONMENT¶

The following environment variables are initialized by the module and available to the processes of the user's session:

$XDG_SESSION_ID

$XDG_RUNTIME_DIR

$TZ, $EMAIL, $LANG

$SHELL_PROMPT_PREFIX, $SHELL_PROMPT_SUFFIX, $SHELL_WELCOME

The following environment variables are read by the module and may be used by the PAM service to pass metadata to the module. If these variables are not set when the PAM module is invoked but can be determined otherwise they are set by the module, so that these variables are initialized for the session and applications if known at all.

$XDG_SESSION_TYPE

$XDG_SESSION_CLASS

$XDG_SESSION_DESKTOP

$XDG_SEAT

$XDG_VTNR

If not set, pam_systemd will initialize $XDG_SEAT and $XDG_VTNR based on the $DISPLAY variable (if the latter is set).

SESSION LIMITS¶

PAM modules earlier in the stack, that is those that come before pam_systemd.so, can set session scope limits using the PAM context objects. The data for these objects is provided as NUL-terminated C strings and maps directly to the respective unit resource control directives. Note that these limits apply to individual sessions of the user, they do not apply to all user processes as a combined whole. In particular, the per-user user@.service unit instance, which runs the systemd --user manager process and its children, and is tracked outside of any session, being shared by all the user's sessions, is not covered by these limits.

See systemd.resource-control(5) for more information about the resources. Also, see pam_set_data(3) for additional information about how to set the context objects.

systemd.memory_max=

systemd.tasks_max=

systemd.cpu_weight=

systemd.io_weight=

systemd.runtime_max_sec=

Example data as can be provided from an another PAM module:

pam_set_data(handle, "systemd.memory_max", (void *)"200M", cleanup);
pam_set_data(handle, "systemd.tasks_max",  (void *)"50",   cleanup);
pam_set_data(handle, "systemd.cpu_weight", (void *)"100",  cleanup);
pam_set_data(handle, "systemd.io_weight",  (void *)"340",  cleanup);
pam_set_data(handle, "systemd.runtime_max_sec", (void *)"3600", cleanup);

EXAMPLE¶

Here's an example PAM configuration fragment that allows users sessions to be managed by systemd-logind.service:

#%PAM-1.0
auth      sufficient pam_unix.so
-auth     sufficient pam_systemd_home.so
auth      required   pam_deny.so
account   required   pam_nologin.so
-account  sufficient pam_systemd_home.so
account   sufficient pam_unix.so
account   required   pam_permit.so
-password sufficient pam_systemd_home.so
password  sufficient pam_unix.so sha512 shadow try_first_pass
password  required   pam_deny.so
-session  optional   pam_keyinit.so revoke
-session  optional   pam_loginuid.so
-session  optional   pam_systemd_home.so
-session  optional   pam_systemd.so
session   required   pam_unix.so

SEE ALSO¶

systemd(1), systemd-logind.service(8), logind.conf(5), loginctl(1), pam_systemd_home(8), pam.conf(5), pam.d(5), pam(8), pam_loginuid(8), systemd.scope(5), systemd.slice(5), systemd.service(5)

NOTES¶

1.

JSON User Records

2.

Desktop Entry Specification

3.

XDG Base Directory Specification