PAM_ENV(8)

✨ PAM_ENV 💖

okay bestie, this is a page from the Linux-PAM Manual — it's the pam_env(8) situation and it's literally the module that handles your environment variables. sit with me, we're doing this together 🫶

---

🌸 NAME 🌸

pam_env — the PAM module that sets and unsets environment variables. that's the whole job. iconic, honestly.

---

🎀 SYNOPSIS 🎀

pam_env.so [debug] [conffile=conf-file] [envfile=env-file] [readenv=0|1]
           [user_envfile=env-file] [user_readenv=0|1]

---

💅 DESCRIPTION 💅

so the pam_env PAM module is the one that lets you (un)set environment variables. and yes, it supports using variables that were already set, plus PAM_ITEMs like PAM_RHOST. it's giving resourceful 💁♀️

By default, the rules for (un)setting variables come from the config file /etc/security/pam_env.conf. wanna use a different one? the conffile option has you covered, no cap.

Second thing it does: it reads a file (/etc/environment by default) full of simple KEY=VAL pairs, each one on its own separate line. the envfile option lets you point at a different file, and the readenv option lets you shut this whole thing off completely.

Third: it reads a user configuration file ($HOME/.pam_environment by default). you can swap that default out with the user_envfile option, and you can turn it on and off with user_readenv.

⚠️ okay so real talk — because setting PAM environment variables can have side effects on other modules, this module should be the last one on the stack. periodt.

also super important: this module only actually runs if the main application calls pam_setcred(3) or pam_open_session(3). if it gets called by pam_authenticate(3), it does nothing and just returns PAM_IGNORE. it's literally minding its own business 😌

---

✨ OPTIONS ✨

• conffile=/path/to/pam_env.conf — point at an alternate pam_env.conf-style configuration file to override the default. lowkey so useful when different services need different environments.
• debug — prints a lot of debug information via syslog(3). it's giving chatty 💬
• envfile=/path/to/environment — point at an alternate environment file to override the default. the syntax is simple KEY=VAL pairs on separate lines. the export instruction can be specified for bash compatibility, but heads up — it will be ignored. again, great for when different services need different environments.
• readenv=0|1 — turns the reading of the file specified by envfile on or off (0 is off, 1 is on). by default this option is on.
• user_envfile=filename — point at an alternate .pam_environment file to override the default. same syntax as /etc/security/pam_env.conf. the filename is relative to the user home directory. yes bestie, different services, different environments, you know the vibe.
• user_readenv=0|1 — turns the reading of the user specific environment file on or off. 0 is off, 1 is on. by default this option is off, because user supplied environment variables in the PAM environment could affect the behavior of subsequent modules in the stack without the consent of the system administrator. and like… yeah. 😭

🚨 okay serious moment: due to problematic security, user_readenv functionality is deprecated since the 1.5.0 version and will be removed completely at some point in the future. don't build your whole personality around it, bestie.

---

🌈 MODULE TYPES PROVIDED 🌈

The auth and session module types are provided. that's it, that's the list 🎀

---

🦋 RETURN VALUES 🦋

• PAM_ABORT — not all relevant data or options could be gotten. it's giving incomplete info 💀
• PAM_BUF_ERR — memory buffer error. oop.
• PAM_IGNORE — no pam_env.conf and environment file was found, or the module got called by pam_authenticate(3).
• PAM_SUCCESS — environment variables were set. slay! ✨

---

🍓 FILES 🍓

• /etc/security/pam_env.conf — default configuration file
• /etc/environment — default environment file
• $HOME/.pam_environment — user specific environment file

---

💜 SEE ALSO 💜

pam_env.conf(5), pam.d(5), pam(8), environ(7).

---

👑 AUTHOR 👑

pam_env was written by Dave Kinchlea <kinch@kinch.ark.com>. king behavior, we love to see it 💖

---

and that's the whole page bestie!! this was the pam_env(8) manual from Linux-PAM, dated 09/27/2026 — tysm for reading, go forth and configure responsibly 🧚 ✨ 🌸