PAM_LOGINUID(8)

📦
version 1.7.3 · 17 versions
, in arch rolling

🎀 NAME 🎀

okay bestie, meet pam_loginuid — she's the one who records your login uid into the process attribute. like, she literally stamps your vibe onto the process so the audit trail knows who walked in the door. 💅

ngl she's part of the Linux-PAM family and this is her manual page (section 8, system admin girlies).

✨ SYNOPSIS ✨

pam_loginuid.so [require_auditd]

that's it. that's the whole entrance. 🌸

💖 DESCRIPTION 💖

so here's the tea, bestie 🫖 — the pam_loginuid module sets the loginuid process attribute for the process that was authenticated. it's giving "hi yes this human is now logged in, write it down."

why do we care? because it's necessary for applications to be correctly audited. no cap. if you skip this, your audit logs are out here looking confused and unmoored. 😭

⚠️ big important rule, do not skip: this PAM module should only be used for entry point applications. the classic lineup is: login, sshd, gdm, vsftpd, crond and atd. and fr fr, there are probably other entry point applications besides these ones — the list is not the whole world, it's just the usual suspects. 👑

and here's the part where people mess up: you should NOT use it for applications like sudo or su. why? because that defeats the purpose — it would change the loginuid to the account they just switched to. 💀 the whole point is knowing who originally logged in, not who they cosplayed as afterwards. main character stays the main character.

🦋 OPTIONS 🦋

  • require_auditd — when you hand her this option, she goes and queries the audit daemon status, and if it's not running? she denies logins. periodt. no auditd, no entry. 🚫

👑 MODULE TYPES PROVIDED 👑

only the session module type is provided. that's the one and only slot she fills. iconic, honestly. ✨

🌈 RETURN VALUES 🌈

  • PAM_SUCCESS — slay! the loginuid value is set, and auditd is running if that check was requested. 🎉
  • PAM_IGNORE — either the /proc/self/loginuid file is not present on the system, or the login process is running inside a uid namespace and the kernel does not support overwriting loginuid. not her fault, she's just vibing. 🙈
  • PAM_SESSION_ERR — any other error prevented setting the loginuid, or auditd is not running. yeah… that's a no from her. 😭

🍓 EXAMPLES 🍓

here's a whole stack config, copy it exactly bestie, character for character:

#%PAM-1.0
auth       required     pam_unix.so
auth       required     pam_nologin.so
account    required     pam_unix.so
password   required     pam_unix.so
session    required     pam_unix.so
session    required     pam_loginuid.so

see that last line? that's her. session required pam_loginuid.so. the final boss of the session stack. 🫶

💜 SEE ALSO 💜

go read these next, they're the friend group:

⭐ AUTHOR ⭐

pam_loginuid was written by Steve Grubb <sgrubb@redhat.com> — thank you king, we appreciate you. 🙌

okay that's the whole page, bestie 💖 this was the Linux-PAM manual for pam_loginuid(8), dated 09/27/2026. go forth and audit correctly, mwah 😘✨

📦 where this page comes from