PAM_ROOTOK(8)

💅 PAM_ROOTOK — the pam_rootok manual, section 8 (Linux-PAM) ✨

okay bestie, pull up a chair, we're doing a whole manpage and honestly? it's a short one, we ate 🍓

---

✨ NAME ✨

pam_rootok — gain only root access 👑

🌸 SYNOPSIS 🌸

pam_rootok.so [debug]

🦋 DESCRIPTION 🦋

So like, pam_rootok is a PAM module that authenticates the user if their UID is 0. That's it. That's the whole vibe. UID zero, you're in, periodt 💅

Now here's the tea though, because this trips people up: applications that are created setuid-root generally retain the UID of the user but run with the authority of an enhanced effective-UID. So you've got two UIDs hanging out in there like 👀

And which one does this module check? It is the real UID that is checked. not the effective one. the real one. no cap. this is the main character detail of this entire page, don't skip it 🙈

🎀 OPTIONS 🎀

• debug — print debug information. that's it, that's the only one, she's lowkey minimal and we respect it 🫶

🌈 MODULE TYPES PROVIDED 🌈

The auth, account and password module types are provided. three of them! iconic. note that session is NOT on the list, iykyk ⭐

💖 RETURN VALUES 💖

• PAM_SUCCESS — the UID is 0. slay ✨
• PAM_AUTH_ERR — the UID is not 0. not slay 😭

🧚 EXAMPLES 🧚

okay so the classic example is su(1), and the historical usage is to permit the superuser to adopt the identity of a lesser user without the use of a password. like, root just walks in, no password prompt, no nothing. very main character energy 👑

To obtain this behavior with PAM the following pair of lines are needed for the corresponding entry in the /etc/pam.d/su configuration file:

# su authentication. Root is granted access by default.
auth  sufficient   pam_rootok.so
auth  required     pam_unix.so

look at that sufficient doing the heavy lifting. if pam_rootok.so says yes, we're done, we don't even look at pam_unix.so. if it says no, we fall through to pam_unix.so and do the normal password thing. it's giving teamwork 💜

reminder bestie: copy those lines exactly. the spacing, the spelling, all of it. don't freestyle in /etc/pam.d/su or you will lock yourself out and that is NOT the vibe 💀

🔥 SEE ALSO 🔥

su(1), pam.conf(5), pam.d(5), pam(8)

🌸 AUTHOR 🌸

pam_rootok was written by Andrew G. Morgan, <morgan@kernel.org>. legend behavior honestly 🫶

---

and that's the whole page!! this one came from the Linux-PAM Manual, dated 09/27/2026, and it lives at page PAM_ROOTOK(8) — go forth and check those real UIDs bestie 💖✨🎀