# SPDX-License-Identifier: LGPL-2.1-or-later
# This file is part of systemd.
#
# Used by run0 sessions

-account [success=done authtok_expired=bad new_authtok_reqd=bad maxtries=bad acct_expired=bad default=ignore] pam_systemd_home.so
account  required   pam_unix.so

# systemd never invokes pam_authenticate() on this stack (authorization for run0 is done via polkit), but it
# does invoke pam_setcred(), which runs the "auth" stack too. Hence an "auth" entry is needed that lets
# pam_setcred() succeed, without falling back to the "other" service (which typically consists of
# pam_warn/pam_deny, and thus generates log noise). pam_rootok's pam_sm_setcred() unconditionally succeeds,
# while its pam_sm_authenticate() only succeeds for callers running as root (which the service manager does).
auth     required   pam_rootok.so

session  required   pam_selinux.so close
session  required   pam_selinux.so open
session  required   pam_loginuid.so
session  optional   pam_keyinit.so force revoke
session  required   pam_namespace.so
-session optional   pam_systemd_home.so
session  optional   pam_umask.so silent
session  optional   pam_systemd.so
session  required   pam_unix.so
