PAM_SYSTEMD_LOADKEY(8)

💖 PAM_SYSTEMD_LOADKEY — the manual page, but make it make sense 💖

okay bestie, this is pam_systemd_loadkey from the pam_systemd_loadkey manual section 8. it's a PAM module. it's giving "let me grab your password so you don't have to type it twice". sit down, hydrate, let's go 🫶

---

✨ NAME ✨

pam_systemd_loadkey — reads a password out of the kernel keyring and sets it as the PAM authtok. no cap, that's literally the whole job. 💅

---

✨ SYNOPSIS ✨

pam_systemd_loadkey.so

that's it. that's the synopsis. iconic. no arguments in the synopsis, the vibes are configured elsewhere.

---

🌸 DESCRIPTION 🌸

so here's the tea 🍓: pam_systemd_loadkey reads a NUL-separated password list from the kernel keyring, and then it sets the last password in that list as the PAM authtok. which is super useful, because other things can then pick it up, like pam_get_authtok(3).

the password list is supposed to be chilling in the "user" keyring of the root user, placed there by an earlier call to systemd-ask-password(1) with --keyname=. you tell pam_systemd_loadkey which keyname to look at using the keyname= option. 💖

---

✨ OPTIONS ✨

here's everything this module understands, one by one:

• keyname= — takes a string argument that sets the keyname to read. the default is "cryptsetup". during boot, systemd-cryptsetup@.service(8) stores a passphrase or a PIN in the keyring. and btw, the LUKS2 volume key can also be used, via the link-volume-key option in crypttab(5). 🔥

and here are the possible values for keyname (yes it was a table in the original, we're doing bullets because tables are not the moment):

• cryptsetup — Passphrase or recovery key
• fido2-pin — Security token PIN
• luks2-pin — LUKS2 token PIN
• tpm2-pin — TPM2 PIN

Added in version 255. ⭐

• debug — the module will log debugging information as it operates. perfect if you're the type of person who needs to see everything happening in real time. same energy as reading the group chat receipts. 👑

Added in version 255. ⭐

---

🌈 EXAMPLE 🌈

okay so the intended use case is VERY specific and honestly it's kind of genius: you use LUKS with a passphrase, you enable autologin in your display manager, and you want Gnome Keyring / KDE KWallet to unlock automatically. so in total, you only enter one password during boot. one. single. password. main character energy. 😭💖

step one: you need to set the password of your Gnome Keyring/KWallet to the same as your LUKS passphrase. they have to match, bestie, don't try to be clever.

then add the following lines to your display manager's PAM config under /etc/pam.d/ (e.g. sddm-autologin):

-auth       optional    pam_systemd_loadkey.so
-auth       optional    pam_gnome_keyring.so
-session    optional    pam_gnome_keyring.so auto_start
-session    optional    pam_kwallet5.so auto_start

and add the following lines to your display manager's systemd service file, so it can access root's keyring:

[Service]
KeyringMode=inherit

and then here's the beautiful part 🌸: in this setup, early during the boot process, systemd-cryptsetup@.service(8) will ask for the passphrase and store it in the kernel keyring with the keyname "cryptsetup". then when the display manager does the autologin, pam_systemd_loadkey will read the passphrase from the kernel keyring, set it as the PAM authtok, and then pam_gnome_keyring and pam_kwallet5 will unlock with the same passphrase.

it's a whole relay race and every leg slays. 🏃♀️✨

---

🦋 SEE ALSO 🦋

hmm, this one's a little empty in the original — no SEE ALSO section, no author line, no license text. so we're not inventing any, because the one rule is that the facts stay facts. 🙈

---

💀 warning-ish energy: this module is reading a password out of a keyring and handing it to PAM. that's the design, that's the point, but like... it's a password. treat it with respect. no screenshots, no pasting it in the group chat. 💅

---

that's the whole page, bestie! it's from systemd 262.1 and the page is dated PAM_SYSTEMD_LOADKEY(8). go forth and only type your password once like the queen you are. 👑✨🫶