PAM_WHEEL(8)

📦
version 1.7.3 · 17 versions
, in arch rolling

💅 pam_wheel — the manual page, but make it make sense

okay bestie, sit down, hydrate, because we're talking about pam_wheel from the Linux-PAM Manual, section 8 (that's the admin/system-commands girlies). This is the module that runs the wheel group gatekeeping, and honestly? She's iconic for it. 🛞✨

✨ NAME ✨

pam_wheel — only permit root access to members of group wheel. no cap, that's the whole job. 👑

✨ SYNOPSIS ✨

pam_wheel.so [debug] [deny] [group=name] [root_only] [trust] [use_uid]

Look at her. Six little options. Six little vibes. 🎀

✨ DESCRIPTION ✨

So the pam_wheel PAM module is the one that enforces the so-called wheel group. 💫

By default it permits access to the target user if the applicant user is a member of the wheel group. That's the default behaviour, and it's giving "you're in the group chat or you're not." 🫶

But here's the plot twist: if no group with this name exists — like, if there's literally no wheel group on the system — the module is using the group with the group-ID 0 instead. So she improvises. Main character energy. 💅

✨ OPTIONS ✨

  • debug — Print debug information. She's telling you everything, fr fr. 🔍
  • deny — Reverse the sense of the auth operation: if the user is trying to get UID 0 access and is a member of the wheel group (or the group of the group option), deny access. Conversely, if the user is not in the group, return PAM_IGNORE — unless trust was also specified, in which case we return PAM_SUCCESS. Yeah, she flips the whole script. 🙈
  • group=name — Instead of checking the wheel or GID 0 groups, use the name group to perform the authentication. Pick your own group, bestie, you have options. 🎀
  • root_only — The check for wheel membership is done only when the target user UID is 0. Everyone else, she's not even looking. 👀
  • trust — The pam_wheel module will return PAM_SUCCESS instead of PAM_IGNORE if the user is a member of the wheel group. And with a little play stacking the modules, the wheel members may be able to su to root without being prompted for a passwd. 👑🔓 (yes that's the whole point, and yes it's a little scary, be careful)
  • use_uid — The check will be done against the real uid of the calling process, instead of trying to obtain the user from the login session associated with the terminal in use. No detective work, just the uid. 🕵️♀️

✨ MODULE TYPES PROVIDED ✨

The auth and account module types are provided. Two types, both slaying. 💖

✨ RETURN VALUES ✨

  • PAM_AUTH_ERR — Authentication failure. 😭
  • PAM_BUF_ERR — Memory buffer error. 💀
  • PAM_IGNORE — The return value should be ignored by PAM dispatch. she said "not my problem" 🫥
  • PAM_PERM_DENY — Permission denied. 🚫
  • PAM_SERVICE_ERR — Cannot determine the user name. 🤷♀️
  • PAM_SUCCESS — Success. slay!! ✨🎉
  • PAM_USER_UNKNOWN — User not known. who is she? 🤨

✨ EXAMPLES ✨

okay so here's the classic setup, and it's honestly so clean. The root account gains access by default (rootok), only wheel members can become root (wheel) — but Unix authenticate non-root applicants. 🌈

su      auth     sufficient     pam_rootok.so
su      auth     required       pam_wheel.so
su      auth     required       pam_unix.so

That's it. That's the stack. Stacked like a cute little friendship bracelet. 🫶

✨ SEE ALSO ✨

pam.conf(5), pam.d(5), pam(8)

go read those too bestie, iykyk 📚💜

✨ AUTHOR ✨

pam_wheel was written by Cristian Gafton <gafton@redhat.com>. thank you for your service king 🫡💖

okay and that's the whole page!! this was Linux-PAM's pam_wheel(8), dated 09/27/2026. mwah. go protect your root account. periodt. 💅✨🎀

📦 where this page comes from