table of contents
- bookworm 252.30-1~deb12u2
- bookworm-backports 254.16-1~bpo12+1
- testing 256.7-2
- unstable 256.7-3
PAM_SYSTEMD(8) | pam_systemd | PAM_SYSTEMD(8) |
NAME¶
pam_systemd - Register user sessions in the systemd login manager
SYNOPSIS¶
pam_systemd.so
DESCRIPTION¶
pam_systemd registers user sessions with the systemd login manager systemd-logind.service(8), and hence the systemd control group hierarchy.
The module also applies various resource management and runtime parameters to the new session, as configured in the JSON User Records[1] of the user, when one is defined.
On login, this module — in conjunction with systemd-logind.service — ensures the following:
On logout, this module ensures the following:
If the system was not booted up with systemd as init system, this module does nothing and immediately returns PAM_SUCCESS.
OPTIONS¶
The following options are understood:
class=
Table 1. Session Classes
Name | Explanation |
user | A regular interactive user session. This is the default class for sessions for which a TTY or X display is known at session registration time. |
user-early | Similar to "user" but sessions of this class are not ordered after systemd-user-sessions.service, i.e. may be started before regular sessions are allowed to be established. This session class is the default for sessions of the root user that would otherwise qualify for the user class, see above. (Added in v256.) |
user-incomplete | Similar to "user" but for sessions which are not fully set up yet, i.e. have no home directory mounted or similar. This is used by systemd-homed.service(8) to allow users to log in via ssh before their home directory is mounted, delaying the mount until the user provided the unlock password. Sessions of this class are upgraded to the regular user class once the home directory is activated. |
greeter | Similar to "user" but for sessions that are spawned by a display manager ephemerally and which prompt the user for login credentials. |
lock-screen | Similar to "user" but for sessions that are spawned by a display manager ephemerally and which show a lock screen that can be used to unlock locked user accounts or sessions. |
background | Used for background sessions, such as those invoked by cron and similar tools. This is the default class for sessions for which no TTY or X display is known at session registration time. |
background-light | Similar to background, but sessions of this class will not pull in the user@.service of the user, and thus possibly have no services of the user running. (Added in v256.) |
manager | The user@.service service of the user is registered under this session class. (Added in v256.) |
manager-early | Similar to manager, but for the root user. Compare with the user vs. user-early situation. (Added in v256.) |
Added in version 197.
type=
Added in version 209.
desktop=
Added in version 240.
default-capability-bounding-set=, default-capability-ambient-set=
Added in version 254.
debug[=]
MODULE TYPES PROVIDED¶
Only session is provided.
ENVIRONMENT¶
The following environment variables are initialized by the module and available to the processes of the user's session:
$XDG_SESSION_ID
$XDG_RUNTIME_DIR
$TZ, $EMAIL, $LANG
Added in version 245.
The following environment variables are read by the module and may be used by the PAM service to pass metadata to the module. If these variables are not set when the PAM module is invoked but can be determined otherwise they are set by the module, so that these variables are initialized for the session and applications if known at all.
$XDG_SESSION_TYPE
Added in version 209.
$XDG_SESSION_CLASS
Added in version 209.
$XDG_SESSION_DESKTOP
Added in version 209.
$XDG_SEAT
Added in version 209.
$XDG_VTNR
Added in version 209.
If not set, pam_systemd will initialize $XDG_SEAT and $XDG_VTNR based on the $DISPLAY variable (if the latter is set).
SESSION LIMITS¶
PAM modules earlier in the stack, that is those that come before pam_systemd.so, can set session scope limits using the PAM context objects. The data for these objects is provided as NUL-terminated C strings and maps directly to the respective unit resource control directives. Note that these limits apply to individual sessions of the user, they do not apply to all user processes as a combined whole. In particular, the per-user user@.service unit instance, which runs the systemd --user manager process and its children, and is tracked outside of any session, being shared by all the user's sessions, is not covered by these limits.
See systemd.resource-control(5) for more information about the resources. Also, see pam_set_data(3) for additional information about how to set the context objects.
systemd.memory_max=
Added in version 239.
systemd.tasks_max=
Added in version 239.
systemd.cpu_weight=
Added in version 239.
systemd.io_weight=
Added in version 239.
systemd.runtime_max_sec=
Added in version 244.
Example data as can be provided from an another PAM module:
pam_set_data(handle, "systemd.memory_max", (void *)"200M", cleanup); pam_set_data(handle, "systemd.tasks_max", (void *)"50", cleanup); pam_set_data(handle, "systemd.cpu_weight", (void *)"100", cleanup); pam_set_data(handle, "systemd.io_weight", (void *)"340", cleanup); pam_set_data(handle, "systemd.runtime_max_sec", (void *)"3600", cleanup);
EXAMPLE¶
Here's an example PAM configuration fragment that allows users sessions to be managed by systemd-logind.service:
#%PAM-1.0 auth sufficient pam_unix.so -auth sufficient pam_systemd_home.so auth required pam_deny.so account required pam_nologin.so -account sufficient pam_systemd_home.so account sufficient pam_unix.so account required pam_permit.so -password sufficient pam_systemd_home.so password sufficient pam_unix.so sha512 shadow try_first_pass password required pam_deny.so -session optional pam_keyinit.so revoke -session optional pam_loginuid.so -session optional pam_systemd_home.so -session optional pam_systemd.so session required pam_unix.so
SEE ALSO¶
systemd(1), systemd-logind.service(8), logind.conf(5), loginctl(1), pam_systemd_home(8), pam.conf(5), pam.d(5), pam(8), pam_loginuid(8), systemd.scope(5), systemd.slice(5), systemd.service(5)
NOTES¶
- 1.
- JSON User Records
- 2.
- Desktop Entry Specification
- 3.
- XDG Base Directory Specification
systemd 256.7 |