console.handlers(5)

✨ NAME ✨

console.handlers(5) — the file that tells everyone which programs get run when console lock and unlock events happen 💅

🎀 DESCRIPTION 🎀

Okay so bestie, /etc/security/console.handlers is the file that decides which programs will be run when a user obtains the console lock at login time, and when the user loses it on log out. It is read by the pam_console module. No cap. 👑

The format is:

handler-filename lock|unlock [flag ...]

Where handler-filename is a name of the executable to be run, lock or unlock specifies on which event it should be run, and flags specify how should pam_console call it.

Additionally there should be a line which specifies glob patterns of console devices. The format of this line is:

console-name consoledevs regex [regex ...]

Where console-name is a name of the console class — currently ignored — and regexes are regular expression patterns which specify the name of the tty device. Only the first such line is consulted. Periodt. 🦋

---

🌸 FLAGS 🌸

• logfail — the pam_console module should log error to the system log if the return value of the handler is not zero or if the handler can not be executed.
• wait — pam_console should wait for the handler to exit before continuing.
• setuid — the handler should be executed with uid/gid of the user which obtained the console lock.
• tty — the handler will get a tty name as obtained from PAM as a parameter.
• user — the handler will get an user name as obtained from PAM as a parameter.

Anything else will be added directly as a parameter to the handler executable. Literally anything else, bestie — it just gets passed straight through. 🫶

---

🔥 SEE ALSO 🔥

pam_console(8)

👑 AUTHOR 👑

Tomas Mraz <tmraz@redhat.com>

---

Red Hat made this one, dated 2005/3/18, and the page is console.handlers(5) — mwah, iconic little manual page, bye bestie 💖✨🎀