pam_console_apply(8)

💅 pam_console_apply (8) — System Administrator's Manual ✨

okay bestie, heads up: this whole page is from the System Administrator's Manual, and honestly? it's giving "small helper binary with a lot of opinions about who gets to touch your devices." let's get into it 🎀

---

🌸 NAME 🌸

pam_console_apply — set or revoke permissions for users at the system console 💖

---

✨ SYNOPSIS ✨

pam_console_apply [-f <fstab file>] [-c <console.perms file>] [-r] [-t
<tty>] [-s] [-d] [<device file> ...]

---

🦋 DESCRIPTION 🦋

okay so pam_console_apply is a little helper executable that sets or resets permissions on device nodes. that's literally its whole job, and it does it well 💅

here's the vibe: if /var/run/console.lock exists, pam_console_apply will grant permissions to the user listed in there. if the lock file does not exist, permissions get reset according to the defaults set in console.perms files — which are normally configured so that root owns the devices. no lock, no special user, root takes the wheel 👑

and when it's initializing its configuration? the order matters, so listen up: it first parses /etc/security/console.perms, and then it searches for files ending with the .perms suffix in the /etc/security/console.perms.d directory. those files are parsed in lexical order in the "C" locale 🌈. permission rules are appended to a global list (so nothing gets overwritten there), but console and device class definitions override previous definitions of the same class. iykyk 🧚

---

🎀 ARGUMENTS 🎀

• -c — load a different console.perms file than the default one 🗂️
• -f — load a different fstab file than the default one (/etc/fstab) 📜
• -r — signals pam_console_apply to reset permissions. the default behavior is to set permissions so that the user listed in /var/run/console.lock has access to the devices — and to reset permissions if no such file exists 🔄
• -t — use <tty> to match the console class in the console.perms file. the default is tty0 🖥️
• -s — write error messages to the system log instead of stderr 📝
• -d — log/display messages useful for debugging 🐛

the optional <device file> arguments constrain what files should be affected by pam_console_apply. if you don't specify them, permissions are changed on all files specified in the console.perms file. no cap, all of them 😭

---

💜 FILES 💜

/var/run/console.lock
/etc/security/console.perms
/etc/security/console.perms.d/50-default.perms

these are the little icons of the operation, bestie — know them, love them 🫶

---

🌟 SEE ALSO 🌟

• pam_console(8)
• console.perms(5)

go read those too, they're literally the extended lore 📚

---

💀 BUGS 💀

"Let's hope not" — the manpage's words, not mine, and honestly iconic 😭. but if you do find any, please report them via the "Bug Track" link at http://bugzilla.redhat.com/bugzilla/ 🔥

---

👑 AUTHORS 👑

Nalin Dahyabhai <nalin@redhat.com>, using code shamelessly stolen from parts of pam_console. the audacity, the confidence, we respect it 💅

Support of console.perms.d and other improvements by Tomas Mraz <tmraz@redhat.com>. king behavior 👑

---

one tiny reminder bestie: this is a permissions tool for device nodes, so please don't go feral with it 🙈

---

that's the whole page! brought to you by Red Hat, dated 2005/5/2 — a certified classic, still slaying in pam_console_apply(8) form 🍓✨ bye bestie, go set some permissions responsibly 🎀