I need to run a script, when the session is opened, as the user who's opening the session.

I have added in /etc/pam.d/common-session :

session optional        pam_exec.so      log=/tmp/test_pam_foo.log /usr/local/bin/test_pam_foo.sh

I also tried to activate pam_exec's option seteuid

The basic script /usr/local/bin/test_pam_foo.sh :

id -u >> /tmp/test_pam_foo
id -ru >> /tmp/test_pam_foo

Unfortunately, I get all the time 0 as the effective id and real id.

Am I missing something?

As alternative, I know the existence of pam_script, not to be confused with pam-script.

That pam_script runs by default as the current user and has the option runas to force to be run as root. But I'd like to privilege the use of pam libs that are already packaged in my distribution (Ubuntu 12.04).

  • What service is this for? Why isn't /etc/profile good enough? (I know there are cases where /etc/profile isn't good enough, for example services that don't run a shell; it would help to know what the reason is in your case.) Oct 6 '12 at 21:32
  • The goal of this service is to export some applications preferences at logout, and repatriate them back at login. Applications preferences could be : - files or folders (like ~/.mozilla/) - GConf keys (like /apps/metacity/general/focus_mode /apps/gnome-terminal/) - DConf keys (like /org/gnome/desktop/background/ ). We do this because users can log on different stations and we do want to select what preferences to be saved. For files and folders, this could be done by root, but for GConf and DConf, it has to be done by the current user and the corresponding service has to be running.
    – samb
    Oct 8 '12 at 7:32

Well, you can have /usr/local/bin/test_pam_foo.sh

change the user since it's in the PAM_USER environment variable.

Beware of the note in pam_exec man page about the user having potentially control on the environment (depending on what service uses it (like su)). So using a script is probably not a good idea there (even if you fix $PATH and other problematic variables, there will be some that you can't do anything about, like SHELLOPTS or BASH_ENV for bash scripts).

Best would be to use a wrapper changes the user before calling your script.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.