# pam_cap

## NAME



           **pam_cap** - Capabilities PAM module
    


## SYNOPSIS



           [service-name] **auth** control-flag **pam_cap**[options]
    


## DESCRIPTION



           The **pam_so** module can be used to specify _Inheritable_ capabilities
           to process trees rooted in the PAM application. The module also
           supports blocking _Bounding_ vector capabilities and adding _Ambient_
           vector capabilities.
    
           For general PAM apps to work correctly, the application must be
           run with at least **CAP_SETPCAP** raised in its _Permitted_ capability
           flag. Many PAM applications run as _root_ , which has all of the bits
           in the _Bounding_ set raised, so this requirement is typically met.
           To grant an _Ambient_ vector capability, the corresponding Permitted
           bit must be available to the application too.
    
           The **pam_so** module is a Linux-PAM _auth_ module. It provides
           functionality to back **pam_sm_authenticate()** and **pam_sm_setcred()**.
           It is the latter that actually modifies the inheritable 3-tuple of
           capability vectors: the configured _IAB_. In a typical application
           configuration you might have a line like this:
    
               auth    optional    pam_cap.so
    
           The module arguments are:
    
           ○   **debug** : While supported, this is a no-op at present.
    
           ○   **config=**_/path/to/file_ : Override the default config for the
               module. The unspecified default value for this file is
               **/etc/security/capability.conf**. Note, **config=/dev/null** is a
               valid value. See **default=** below for situations in which this
               might be appropriate.
    
           ○   **keepcaps** : This is as much as the **pam_cap.so** module can do to
               help an application support use of the _Ambient_ capability
               vector. The application support for the _Ambient_ set is poor at
               the present time.
    
           ○   **autoauth** : This argument causes the **pam_cap.so** module to return
               **PAM_SUCCESS** if the **PAM_USER** being authenticated exists. The
               absence of this argument will cause **pam_cap.so** to only return
               **PAM_SUCCESS** if the **PAM_USER** is covered by a specific rule in
               the prevailing config file.
    
           ○   **default=**_IAB_ : This argument is ignored if the prevailing
               configuration file contains a "***** " rule. If there is no such
               rule, the _IAB_ 3-tuple is inserted at the end of the config
               file and applies to all **PAM_USER** s not covered by an earlier
               rule. Note, if you want all **PAM_USER** s to be covered by this
               default rule, you can supply the module argument
               **config=/dev/null**.
    
           ○   **defer** : This argument arranges for the _IAB_ capabilities granted
               to a user to be added sufficiently late in the Linux-PAM
               authentication stack that they stick. That is, _after_ the
               application does its **setuid(UID)** call. As such, in conjunction
               with the **keepcaps** module argument, such compliant applications
               can support granting _Ambient_ vector capabilities with
               **pam_cap.so**.
    


* * *