PAM_SETCRED(3)

✨ PAM_SETCRED(3) ✨

okay bestie, we're in the Linux-PAM Manual today and this one's about credentials — literally the stuff that makes you you on a system 💅

---

🎀 NAME 🎀

pam_setcred — establish / delete user credentials

---

🌸 SYNOPSIS 🌸

#include <security/pam_appl.h>

int pam_setcred(pam_handle_t *pamh, int flags);

---

🦋 DESCRIPTION 🦋

So the pam_setcred function is the one you call to establish, maintain and delete the credentials of a user, fr fr. Like, here's the timeline bestie: the user gets authenticated, then you set their credentials, and then a session is opened for them (with pam_open_session(3)). And when the session is closed (with pam_close_session(3)), the credentials get deleted after that. Order matters, no cap 🫶

And what even is a credential? Great question. A credential is something the user possesses — like some property of theirs, e.g. a Kerberos ticket, or a supplementary group membership, that makes up the uniqueness of a given user. Iconic user-specific vibes ✨

On a Linux system the user's UID and GID's are credentials too. BUT (and this is the plot twist 💀) it's been decided that these properties — along with the default supplementary groups the user is a member of — are credentials that should be set directly by the application and not by PAM. So those ones should be established by the application prior to a call to this function. Like, initgroups(2) (or equivalent) should already have been performed by then. Do not skip this step bestie 🙈

Now the valid flags — any one of which may be logically OR'd with PAM_SILENT — are:

• PAM_ESTABLISH_CRED — Initialize the credentials for the user.
• PAM_DELETE_CRED — Delete the user's credentials.
• PAM_REINITIALIZE_CRED — Fully reinitialize the user's credentials.
• PAM_REFRESH_CRED — Extend the lifetime of the existing credentials.

---

💜 RETURN VALUES 💜

• PAM_BUF_ERR — Memory buffer error 😭
• PAM_CRED_ERR — Failed to set user credentials.
• PAM_CRED_EXPIRED — User credentials are expired (the tragedy).
• PAM_CRED_UNAVAIL — Failed to retrieve user credentials.
• PAM_SUCCESS — Data was successful stored. slay ✨
• PAM_SYSTEM_ERR — A NULL pointer was submitted as PAM handle, the function was called by a module, or another system error occurred. messy 💀
• PAM_USER_UNKNOWN — User is not known to an authentication module.

---

🌈 SEE ALSO 🌈

pam_authenticate(3), pam_open_session(3), pam_close_session(3), pam_strerror(3)

---

heads up bestie: credentials get set after auth and before the session opens, deleted after the session closes, and the UID/GID/group stuff is the application's job, not PAM's. iykyk 💅

okay that's the whole page and honestly? ate. this was Linux-PAM, dated 07/08/2026 — go forth and set those creds, main character 🎀🦋💖