I have a custom PAM module that needs to access some sensitive information on the hard disk to perform its job. These files would ideally be stored with root access permissions only.
I've been having some issue getting this to work as it seems that all PAM authentication is run as the user attempting to authenticate - these users should not access these protected files and so the process fails.
Is there a way to give the PAM module these permissions regardless of who is trying to authenticate? Ideally I'd like the authentication to be run as root or under a daemon user I can give specific group access to.
I figure "yes" as
/etc/shadow is read for all password attempts. I've written both the PAM module and the shared .so library.
On Ubuntu 16.04 if that is relevant