PAM_FILTER(8)

📦
version 1.7.3 · 17 versions
, in arch rolling

💖 PAM_FILTER 💖

okay so bestie, this is the manual page for pam_filter, one of the Linux-PAM crew — specifically the module page (that's what the (8) is giving), living in section 8 with the rest of the system admin girlies. sit down, hydrate, let's get into it 🫶

✨ NAME ✨

pam_filter — the PAM filter module 💅

🌸 SYNOPSIS 🌸

pam_filter.so [debug] [new_term] [non_term] run1|run2 filter [...]

🦋 DESCRIPTION 🦋

so basically this module is designed to be a whole platform for giving you access to literally all the input and output that travels between the user and the application. that's its whole thing. its entire main character arc.

but heads up bestie — it's only suitable for tty-based applications and (stdin/stdout) applications. no cap. don't try to make it do something it wasn't built for.

for this module to actually function, you need filters installed on the system. that's non-negotiable, it's giving "bring your own filter" energy. the single filter that ships with the module just transposes upper and lower case letters in the input and output streams. cute in theory!! but also — and I'm being so serious — this can be very annoying and it is not kind to termcap based editors. like, at all. 💀

every single component of the module has the potential to invoke the filter you want. and here's the tea: the filter is always execv(2) with the privilege of the calling application — not the privilege of the user. which means, lowkey, it usually cannot be killed by the user without them closing their session entirely. so that's a thing. 🙈

🎀 OPTIONS 🎀

  • debug — print debug information. simple, iconic, exactly what it says on the tin ✨
  • new_term — okay so the default action of the filter is to set the PAM_TTY item, so it can point at the terminal the user is using to connect to the application. this argument says actually, no — the filter should set PAM_TTY to the filtered pseudo-terminal instead. glow up 💅
  • non_term — don't even try to set the PAM_TTY item. we're not doing that today 🚫
  • runX — so that the module can invoke a filter, it needs to know when to invoke it. this argument is required, it's the one telling the filter when to do the thing. no skipping it fr fr.

permitted values for X are 1 and 2. these indicate the precise time that the filter is to be run. to really understand this concept it will be useful to have read the pam(3) manual page — yes bestie, homework, I'm sorry, but it's worth it.

basically: for each management group there are up to two ways of calling the module's functions. in the case of the authentication and session components there are actually two separate functions.

for the account component: either run1 or run2 may be used. dealer's choice 🎲

for the password component: run1 is used to indicate the filter runs on the first occasion of pam_chauthtok(3) (that's the PAM_PRELIM_CHECK phase), and run2 is used to indicate the filter runs on the second occasion (the PAM_UPDATE_AUTHTOK phase). two phases, two vibes 🌈

  • filter — the full pathname of the filter to be run, plus any command line arguments that the filter might expect. full path only, bestie, we're not doing guesswork 💖

👑 MODULE TYPES PROVIDED 👑

all of them. literally all of them. auth, account, password and session — every module type is provided. she does it all, she contains multitudes ✨

🔥 RETURN VALUES 🔥

  • PAM_SUCCESS — the new filter was set successfully. slay!! we ate 💅
  • PAM_ABORT — critical error, immediate abort. oh no. not the vibe. 🚨

🌈 EXAMPLES 🌈

add the following line to /etc/pam.d/login to see how to configure login to transpose upper and lower case letters once the user has logged in:

session required pam_filter.so run1 /lib/security/pam_filter/upperLOWER

💜 SEE ALSO 💜

pam.conf(5), pam.d(5), pam(8)

🧚 AUTHOR 🧚

pam_filter was written by Andrew G. Morgan <morgan@kernel.org>. thank you for your service, king 👑

okay that's the whole page, bestie!! 🎀 this was Linux-PAM, dated 09/27/2026, and it's the PAM_FILTER(8) page — now go forth and filter responsibly, mwah 💖✨

📦 where this page comes from