Installation guide

Chapter 7. Pluggable Authentication Modules (PAM) 117

7.8.1. Device Ownership

When a user logs into a machine under Red Hat Linux, the pam_console.so module is called by

physical console — called the console user — the module grants ownership of a variety of devices

normally owned by root. The console user owns these devices until the last local session for that user

ends. Once the user has logged out, ownership of the devices reverts back to their default values.

The devices affected include, but are not limited to, sound cards, ﬂoppy drives, and CD-ROM drives.

This allows a local user to manipulate these devices without attaining root, thus simplifying common

tasks for the console user.

In the ﬁle /etc/security/console.perms, you can edit the list of devices controlled by

pam_console.so.

7.8.2. Application Access

The console user is also allowed access to any program with a ﬁle bearing the command name in the

/etc/security/console.apps/ directory. These ﬁles do not need to contain any data, but must

have the exact name of the command to which they correspond.

One notable group of applications the console user has access to are three programs which shut off or

reboot the system. These are:

• /sbin/halt

• /sbin/reboot

• /sbin/poweroff

Because these are PAM-aware applications, they call the pam_console.so as a requirement for use.

For more information see the man pages for pam_console, console.perms, and console.apps.

7.9. Additional Resources

Below is a list of information sources for using and conﬁguring PAM on your system. In addition to

these sources, you should read the PAM conﬁguration ﬁles on your system to better understand how

they are structured.

7.9.1. Installed Documentation

• pam man page — Good introductory information on PAM, including the structure and purpose of

the PAM conﬁguration ﬁles.

• /usr/share/doc/pam-version-number — Contains a System Administrators’ Guide, a Mod-

ule Writers’ Manual, and an Application Developers’ Manual. Also contains a copy of the PAM

standard, DCE-RFC 86.0.

7.9.2. Useful Websites

• http://www.kernel.org/pub/linux/libs/pam — The primary distribution website for the Linux-PAM

project, containing information on various PAM modules, a FAQ, and additional PAM documenta-

tion.