# SPDX-License-Identifier: LGPL-2.1-or-later
# This file is part of systemd.
#
# Used by run0 session.

account  include     common-account

# systemd never invokes pam_authenticate() on this stack (authorization for run0
# is done via polkit), but it does invoke pam_setcred(), which runs the "auth"
# stack too. Hence an "auth" entry is needed that lets pam_setcred() succeed,
# without falling back to the "other" service (which typically consists of
# pam_warn/pam_deny, and thus generates log noise). pam_rootok's
# pam_sm_setcred() unconditionally succeeds, while its pam_sm_authenticate()
# only succeeds for callers running as root (which the service manager does).
# See bsc#1253133 for details.

auth required pam_rootok.so

session  required    pam_selinux.so close
session  required    pam_selinux.so open
session  required    pam_loginuid.so
session  optional    pam_keyinit.so force revoke
session  include     common-session
