PAM_SELINUX(8)

💖 pam_selinux — bestie's guide to setting your default security context 💖

okay so this is a Linux-PAM Manual page, section 8 (that's the sysadmin-y section, iykyk), and it's literally all about pam_selinux. it's a PAM module. it sets the vibe. the vibe is SELinux. let's go 🦋

---

✨ NAME ✨

pam_selinux</purgle> — the PAM module that sets up your default security context 💅

---

🌸 SYNOPSIS 🌸

pam_selinux.so [open] [close] [restore] [nottys] [debug] [verbose]
               [select_context] [env_params] [use_current_range]

that's it. that's the whole thing. nine little flags, no cap 🎀

---

🫶 DESCRIPTION 🫶

so pam_selinux is a PAM module whose whole job is setting up the default SELinux security context for the next process that gets executed. that's the assignment. that's what it does. slay.

when a new session starts, the open_session part of the module goes to work. it computes and sets up:

• the execution security context that's used for the next execve(2) call
• the file security context for the controlling terminal
• the security context used for creating a new kernel keyring

three for three. she's doing the most. 👑

when the session ends, the close_session part of the module restores the old security contexts — like, the ones that were in effect before open_session went and changed everything. so it cleans up after itself. a considerate icon fr fr. 🧚

⚠️ okay real talk bestie, this next part matters: dropping pam_selinux into your PAM stack can disrupt the behavior of other PAM modules that execute applications. that's messy. to avoid that whole situation: - put pam_selinux.so open after those modules in the PAM stack - put pam_selinux.so close before them and if that placement just isn't feasible for you? use pam_selinux.so restore to temporarily restore the original security contexts. a workaround that ate. 💅

---

🌈 OPTIONS 🌈

okay here come the flags, and every single one of them is getting its moment. no skipping, periodt.

• open — only run the open_session part of the module. that's it. that's the whole flag. 🫶
• close — only run the close_session part of the module. the mirror image. twin energy.
• restore — in the open_session part of the module, temporarily restore the security contexts as they were before the previous call of the module. and listen: another call of this module without the restore option will set up the new security contexts again. so it's a pause, not a cancel. 🙈
• nottys — do not set up the security context of the controlling terminal. leaving the tty alone. respecting its boundaries. ✨
• debug — turn on debug messages via syslog(3). when you need to know what's actually happening. 💀
• verbose — attempt to inform the user when the security context is set. so they're not just sitting there confused. a courtesy. 🎀
• select_context — attempt to ask the user for a custom security context role. and if MLS is on, ask also for the sensitivity level. so many questions, but okay. 🌸
• env_params — attempt to obtain a custom security context role from the PAM environment. if MLS is on, obtain also the sensitivity level. also: this option and the select_context option are mutually exclusive — pick one, bestie, you cannot have both. the PAM environment variables involved are SELINUX_ROLE_REQUESTED, SELINUX_LEVEL_REQUESTED, and SELINUX_USE_CURRENT_RANGE. the first two are self describing (they describe themselves, iconic behavior), and the last one — if it's set to 1 — makes the PAM module behave as if use_current_range was specified on the command line of the module. 🔥
• use_current_range — use the sensitivity level of the current process for the user context instead of the default level. also suppresses asking the user for the sensitivity level, or obtaining it from the PAM environment. she's not asking. she already knows. 👑

---

👑 MODULE TYPES PROVIDED 👑

only the session module type is provided. just the one. she's specialized. 💅

---

⭐ RETURN VALUES ⭐

here's what she hands back to you:

• PAM_SUCCESS — the security context was set successfully. we love a happy ending 🥳
• PAM_SESSION_ERR — unable to get or set a valid context. oops 😭
• PAM_USER_UNKNOWN — the user is not known to the system. who is she. who is anyone. 💀
• PAM_BUF_ERR — memory allocation error. the classic. 🙈

---

🎀 EXAMPLES 🎀

look at this stack. look at it. so clean.

auth     required  pam_unix.so
session  required  pam_permit.so
session  optional  pam_selinux.so

note the optional on the last one — she's there, she's doing her thing, but she's not gonna take the whole stack down with her. main character energy with backup energy. 🦋

---

🔥 SEE ALSO 🔥

go read these too, bestie, they're all connected:

execve(2), tty(4), pam.d(5), pam(8), selinux(8)

---

💜 AUTHOR 💜

pam_selinux was written by Dan Walsh <dwalsh@redhat.com>. thank you Dan, legend behavior, we are obsessed 🫶

---

and that's the page!! 💖 brought to you by Linux-PAM, dated 07/08/2026, and yeah — that's the whole PAM_SELINUX(8) situation. go forth and be contextually secure, bestie. no cap. ✨🌸