SEPERMIT.CONF(5)

💖 SEPERMIT.CONF 💖

okay bestie, this is the manual page for sepermit.conf from Linux-PAM, section 5 (that's the file formats girlies 💅). it's the config file for the pam_sepermit module and honestly? it's giving simple-but-powerful. let's get into it 🫶

---

✨ NAME ✨

sepermit.conf — the configuration file for the pam_sepermit module 💖

---

🌸 DESCRIPTION 🌸

so the lines in this config file follow this syntax, periodt:

<user>[:<option>:<option>...]

now, the user part? you can specify it in a few different ways and honestly the flexibility is iconic ✨

• just a plain username 👑
• a groupname, using the @group syntax. ⚠️ but lowkey important: do not get this confused with netgroups, bestie, they are not the same thing 💀
• a SELinux user name, using the %seuser syntax 🌈

---

🎀 OPTIONS 🎀

the options that get recognized are these two cuties:

• exclusive — only a single login session is allowed for the user, and on logout the user's processes get killed. one session only, no sneaking back in 🔥
• ignore — the module will never return PAM_SUCCESS status for the user. it returns PAM_IGNORE if SELinux is in enforcing mode, and PAM_AUTH_ERR otherwise. ngl this one is useful if you want to support passwordless guest users and other confined users with passwords at the same time 💅

also! any line that starts with the # character is a comment and gets ignored entirely. so go off, leave yourself little notes 🎀

---

🦋 EXAMPLES 🦋

here are some example lines you might throw into /etc/security/sepermit.conf:

%guest_u:exclusive
%staff_u:ignore
%user_u:ignore

see how it's done? cute, right? ✨

---

🌈 SEE ALSO 🌈

• pam_sepermit(8)
• pam.d(5)
• pam(8)
• selinux(8)

---

👑 AUTHOR 👑

pam_sepermit and this manual page were written by Tomas Mraz <tmraz@redhat.com> — ty for your service, king 🫶

---

and that's the whole vibe, bestie!! this page is from Linux-PAM and it was last dated 07/08/2026 💖 now go forth and configure responsibly, mwah 💅✨