# This file is part of systemd.
#
# Used by systemd --user instances.

# systemd never invokes pam_authenticate() on this stack (authorization for run0
# is done via polkit), but it does invoke pam_setcred(), which runs the "auth"
# stack too. Hence an "auth" entry is needed that lets pam_setcred() succeed,
# without falling back to the "other" service (which typically consists of
# pam_warn/pam_deny, and thus generates log noise). pam_rootok's
# pam_sm_setcred() unconditionally succeeds, while its pam_sm_authenticate()
# only succeeds for callers running as root (which the service manager does).
# See bsc#1190515 for details.

auth required pam_rootok.so

account  required pam_unix.so no_pass_expiry

session  required pam_selinux.so close
session  required pam_selinux.so nottys open
session  required pam_loginuid.so
session  optional pam_keyinit.so force revoke
session  include  common-session
