PAM manages to check the user password, when called from unprivileged screen-lockers. E.g.:
I can't find any SUID-root binary in the
screen package on Fedora 26, but the
lockscreen command (Ctrla Ctrlx) still works. I can't see any the Makefile in
xsecurelock setting SUID root anywhere either.
I'm confused. How does this work? My user does not have read access to
/etc/shadow. I am not using the OpenWall pam_tcb for per-user shadow files.