I have a custom PAM module that needs to access some sensitive information on the hard disk to perform its job. These files would ideally be stored with root access permissions only.

I've been having some issue getting this to work as it seems that all PAM authentication is run as the user attempting to authenticate - these users should not access these protected files and so the process fails.

Is there a way to give the PAM module these permissions regardless of who is trying to authenticate? Ideally I'd like the authentication to be run as root or under a daemon user I can give specific group access to.

I figure "yes" as /etc/shadow is read for all password attempts. I've written both the PAM module and the shared .so library.

On Ubuntu 16.04 if that is relevant


I figured this one out - the key points here were:

  1. root is the user that owns the file
  2. A group containing root and the users you expect to need access is the group owner of the file. These users were (in my case) users installed with the applications attempting to auth.
  3. Set read write for user, read for group, and nothing for everyone else

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.