I have a setup using pam_time to limit the times when my children can login to GNOME. It works in the sense that if they are not logged in, then when they try to login and the time is not an allowed time, they are refused, but if the time is an allowed time they can log in.

However, the same is not true for the lockscreen. I know that since gnome 3.8 or so the lock screen is just part of gnome shell, and there's no gnome-screensaver. But it seems like the authentication/authorization features of PAM are not being used by the lockscreen. If the kids are logged in, lock the screen, and then come back outside the time window, they can still unlock the screen, whereas if they are logged out, then they can't log in.

This makes me think that the gnome-shell is not using PAM at all for lock screen. Is that true? How can I time-limit the unlock of the lockscreen?

  • It looks like pam's "account" facility isn't going to be used, but that pam "auth" facility is used. This makes sense, because obviously the user is already logged in. However pam_time only provides "account" facility. I'm thinking maybe using libpam_script and just check what user is being authenticated, and what time it is.
    – dlakelan
    Commented Apr 7, 2018 at 13:42

2 Answers 2


The answer seems to be that in fact only the pam "auth" service is used by the gnome screen unlock process not "account". And so, my solution is to use pam-script to authenticate them only when the script returns exit 0; which lets me do a variety of things, including checking the time, and also checking to see if a USB stick with the right /dev/disk/by-uuid/* value is plugged in, thereby allowing me to determine when they can login by handing out or revoking a physical object.


Work-around: Write a cron job to close all program and logout from the session at pre-defined interval or time. See step 3 in this link for details.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .