PAM_SEPERMIT(8)

💖 NAME 💖

ok so <pink>pam_sepermit</pink> — it's a PAM module that lets you log in or straight up blocks you depending on the SELinux enforcement state. that's the whole vibe bestie ✨

---

🦋 SYNOPSIS 🦋

pam_sepermit.so [debug] [conf=/path/to/config/file]

---

🌸 DESCRIPTION 🌸

okok so here's the tea. the <pink>pam_sepermit</pink> module allows or denies login depending on the SELinux enforcement state. literally that's it, that's the job 💅

when the users who are logging in match an entry in the config file, they are allowed access only when SELinux is in enforcing mode. otherwise? denied. no access. bye 🙈 for users who don't match any entry in the config file, pam_sepermit returns the PAM_IGNORE return value — it just minds its own business fr fr.

so the config file contains a list of user names, one per line, with optional arguments. and here's the key part, bestie, pay attention:

• if the name is prefixed with a @ character it means that all users in the group name match.
• if it is prefixed with a % character the SELinux user is used to match against the name instead of the account name.

⚠️ heads up: when SELinux is disabled, the SELinux user assigned to the account cannot be determined. that means those entries are never matched when SELinux is disabled and pam_sepermit will return PAM_IGNORE. it's giving "can't check what doesn't exist" 😭

see sepermit.conf(5) for details 💖

---

✨ OPTIONS ✨

• debug — turns on debugging via syslog(3). yes queen, log everything 👑
• conf=/path/to/config/file — path to an alternative config file that overrides the default. main character energy, you get to pick your own file 🎀

---

🎀 MODULE TYPES PROVIDED 🎀

the auth and account module types are provided. that's it, those two 🫶

---

🔥 RETURN VALUES 🔥

• PAM_AUTH_ERR — SELinux is disabled or in the permissive mode and the user matches. so close and yet so far 💀
• PAM_SUCCESS — SELinux is in the enforcing mode and the user matches. we love to see it, slay ✨
• PAM_IGNORE — the user does not match any entry in the config file. not my problem, not my business 💅
• PAM_USER_UNKNOWN — the module was unable to determine the user's name. who even are you 😭
• PAM_SERVICE_ERR — error during reading or parsing the config file. the config file said "no ❤️"

---

🌈 FILES 🌈

• /etc/security/sepermit.conf — the default configuration file 📁

---

⭐ EXAMPLES ⭐

here's the setup, copy it exactly bestie:

auth     [success=done ignore=ignore default=bad] pam_sepermit.so
auth     required  pam_unix.so
account  required  pam_unix.so
session  required  pam_permit.so

---

💜 SEE ALSO 💜

sepermit.conf(5), pam.conf(5), pam.d(5), pam(8) selinux(8)

---

🧚 AUTHOR 🧚

pam_sepermit and this manual page were written by Tomas Mraz <tmraz@redhat.com>. ty for your service, legend 👑

---

ok that's the whole page, you ate that 🍓 this was the Linux-PAM manual, dated 07/08/2026, and the page is PAM_SEPERMIT(8). now go forth and login correctly, ily 💖✨