PAM_GROUP(8)

📦
version 1.7.3 · 19 versions
, in arch rolling

✨ pam_group — bestie edition ✨

okay so you're here for pam_group, a Linux-PAM manual page (section 8, admin-level stuff, we love that for us). Let me spill the tea on what this module does 💅

🌸 NAME 🌸

pam_group — a PAM module for group access, aka the module that hands out group memberships like friendship bracelets 🎀

🦋 SYNOPSIS 🦋

pam_group.so

that's it. that's the whole synopsis. iconic, lowkey 🫶

💖 DESCRIPTION 💖

So pam_group does not authenticate the user — no cap, that's not its job, it's not the main character of the login flow. What it does do is grant group memberships to the user, and it does this during the credential setting phase of the authentication module. Which groups you get is based on the service you're applying for. it's giving ✨tailored✨

By default, the rules for those group memberships are pulled from the config file /etc/security/group.conf. that's the vibe check location, fr fr 📁

Now here's the part where you gotta pay attention, bestie, because it's important 👀

This module's usefulness relies entirely on the file-systems that the user can access. The point is: once the user gets granted membership of a group, they may attempt to create a setgid binary with a restricted group ownership. And then later, when the user is not given membership to that group anymore, they can recover the group membership with that precompiled binary. 😭 sneaky!

The reason the file-systems the user has access to matter SO much is that when a system is mounted nosuid, the user is unable to create or execute such a binary file. So:

For this module to provide any level of security, all file-systems that the user has write access to should be mounted nosuid. periodt. no exceptions. don't skip this.

And one more thing: pam_group functions in parallel with the /etc/group file. So if the user gets granted any groups based on this module's behavior, they're granted in addition to those entries in /etc/group (or the equivalent). both. at the same time. slay 💅

✨ OPTIONS ✨

This module does not recognise any options. zero. none. nothing to configure. she's self-sufficient, she's independent, she doesn't need your flags 💜

🌈 MODULE TYPES PROVIDED 🌈

Only the auth module type is provided. just the one. quality over quantity, bestie 👑

🎀 RETURN VALUES 🎀

  • PAM_SUCCESS — group membership was granted. we love a happy ending 🥳
  • PAM_ABORT — Not all relevant data could be gotten. something got lost in the group chat 😭
  • PAM_BUF_ERR — Memory buffer error. the memory said "not today" 💀
  • PAM_CRED_ERR — Group membership was not granted. the vibe check failed, unfortunately 🙈
  • PAM_IGNORE — pam_sm_authenticate was called which does nothing. not me showing up to a function that has nothing to do with me 😌
  • PAM_USER_UNKNOWN — The user is not known to the system. who is she? never heard of her 🧚

🍓 FILES 🍓

  • /etc/security/group.conf — Default configuration file. the home base, the main character's house 🏠

👑 SEE ALSO 👑

group.conf(5), pam.d(5), pam(8).

go read those too, bestie, iykyk 📚

💜 AUTHORS 💜

pam_group was written by Andrew G. Morgan <morgan@kernel.org>. absolute legend, we stan 🔥

okay that's the whole page!! and for the cute sign-off — this lil masterpiece comes to you from Linux-PAM, dated 09/27/2026, and yes the manual page is literally named PAM_GROUP(8) in case you were wondering, mwah 💖✨🦋

📦 where this page comes from