PAM_SM_SETCRED(3)

💅 PAM_SM_SETCRED(3) — like, the whole Linux-PAM Manual page for pam_sm_setcred, bestie 🎀

okay so real talk, this is a page from the Linux-PAM Manual, section 3, and it's all about one tiny little function that does a lot of emotional labor. buckle up 🦋

---

✨ NAME ✨

pam_sm_setcred — the PAM service function that alters credentials, bestie. that's it, that's the whole vibe. 🔥

---

🌸 SYNOPSIS 🌸

#include <security/pam_modules.h>

int pam_sm_setcred(pam_handle_t *pamh, int flags, int argc,
                   const char **argv);

literally just copy that exactly, don't be creative with it, i'm begging 🙈

---

🦋 DESCRIPTION 🦋

okay so pam_sm_setcred is the service module's implementation of the pam_setcred(3) interface. like, pam_setcred(3) is the main character, and this function is the one actually doing the work behind the scenes. main character energy by proxy, honestly. 👑

what does it do? it performs the task of altering the credentials of the user with respect to the corresponding authorization scheme. and the way that matters is: generally, an authentication module may have access to more information about a user than just their authentication token. this function is literally how that extra info gets made available to the application. it's giving "i know things about you (affectionate)". 💖

⚠️ important vibe check: it should only be called after the user has been authenticated but before a session has been established. not before, not after, between. periodt.

the valid flags, which may be logically OR'd with PAM_SILENT, are:

• PAM_SILENT — do not emit any messages. shush. 💀
• PAM_ESTABLISH_CRED — initialize the credentials for the user. fresh start, slay.
• PAM_DELETE_CRED — delete the credentials associated with the authentication service. we're cleaning up, it's over, go home 🧚
• PAM_REINITIALIZE_CRED — reinitialize the user credentials. glow-up arc ✨
• PAM_REFRESH_CRED — extend the lifetime of the user credentials. we're keeping it alive, we're not letting go 🫶

---

🌈 how the auth stack gets navigated (iykyk) 🌈

so the way the auth stack is navigated in order to evaluate the pam_setcred() function call — independent of the pam_sm_setcred() return codes, like, the return codes do not change the navigation, okay — is exactly the same way that it was navigated when evaluating the pam_authenticate() library call. same route, same map, same energy. 🗺️

typically, if a stack entry was ignored in evaluating pam_authenticate(), it will be ignored when libpam evaluates the pam_setcred() function call. ghosted, basically. 👻

otherwise, the return codes from each module specific pam_sm_setcred() call are treated as required. no skipping, no "close enough", they all count. 😭

---

💜 RETURN VALUES 💜

• PAM_CRED_UNAVAIL — this module cannot retrieve the user's credentials. it tried, it can't, moving on 😔
• PAM_CRED_EXPIRED — the user's credentials have expired. old. expired. past the vibe check date. 🕰️
• PAM_CRED_ERR — this module was unable to set the credentials of the user. something went wrong, no cap.
• PAM_SUCCESS — the user credential was successfully set. ATE. 💅
• PAM_USER_UNKNOWN — the user is not known to this authentication module. who is she? 🤷‍♀️

and here's the part you gotta know: these, non-PAM_SUCCESS, return values will typically lead to the credential stack failing. and the first such error will dominate in the return value of pam_setcred(). first one to flop sets the tone for the whole function call, honestly iconic of it. 💀

---

🍓 SEE ALSO 🍓

pam(3), pam_authenticate(3), pam_setcred(3), pam_sm_authenticate(3), pam_strerror(3), PAM(8)

go read those too, i'm not asking 🔥

---

okay that's the whole page, every single flag and error and caveat accounted for, nothing skipped, we ate and left no crumbs 💖

🎀 cute lil sign-off: this masterpiece of a manpage comes to you from Linux-PAM, dated 07/08/2026. screenshot it, frame it, memorize it. mwah 💋