PAM\_CAP(8) System Manager's Manual PAM\_CAP(8)

# [NAME](#NAME)

**pam\_cap** - Capabilities PAM module

# [SYNOPSIS](#SYNOPSIS)

\[service-name] **auth** control-flag **pam\_cap** \[options]

# [DESCRIPTION](#DESCRIPTION)

The **pam\_so** module can be used to specify *Inheritable* capabilities to process trees rooted in the PAM application. The module also supports blocking *Bounding* vector capabilities and adding *Ambient* vector capabilities.

For general PAM apps to work correctly, the application must be run with at least **CAP\_SETPCAP** raised in its *Permitted* capability flag. Many PAM applications run as *root*, which has all of the bits in the *Bounding* set raised, so this requirement is typically met. To grant an *Ambient* vector capability, the corresponding Permitted bit must be available to the application too.

The **pam\_so** module is a Linux-PAM *auth* module. It provides functionality to back **pam\_sm\_authenticate()** and **pam\_sm\_setcred()**. It is the latter that actually modifies the inheritable 3-tuple of capability vectors: the configured *IAB*. In a typical application configuration you might have a line like this:

```
auth    optional    pam_cap.so
```

The module arguments are:

○

**debug**: While supported, this is a no-op at present.

○

**config=/path/to/file**: Override the default config for the module. The unspecified default value for this file is **/etc/security/capability.conf**. Note, **config=/dev/null** is a valid value. See **default=** below for situations in which this might be appropriate.

○

**keepcaps**: This is as much as the **pam\_cap.so** module can do to help an application support use of the *Ambient* capability vector. The application support for the *Ambient* set is poor at the present time.

○

**autoauth**: This argument causes the **pam\_cap.so** module to return **PAM\_SUCCESS** if the **PAM\_USER** being authenticated exists. The absence of this argument will cause **pam\_cap.so** to only return **PAM\_SUCCESS** if the **PAM\_USER** is covered by a specific rule in the prevailing config file.

○

**default=IAB**: This argument is ignored if the prevailing configuration file contains a "**\***" rule. If there is no such rule, the *IAB* 3-tuple is inserted at the end of the config file and applies to all **PAM\_USER**s not covered by an earlier rule. Note, if you want all **PAM\_USER**s to be covered by this default rule, you can supply the module argument **config=/dev/null**.

○

**defer**: This argument arranges for the *IAB* capabilities granted to a user to be added sufficiently late in the Linux-PAM authentication stack that they stick. That is, *after* the application does its **setuid(UID)** call. As such, in conjunction with the **keepcaps** module argument, such compliant applications can support granting *Ambient* vector capabilities with **pam\_cap.so**.

# [SEE ALSO](#SEE_ALSO)

[**pam.conf**(5)](/man/os/libcap/pam.conf.5), [**capability.conf**(5)](/man/os/libcap/capability.conf.5), [**cap\_text\_formats**(7)](/man/os/libcap/cap_text_formats.7), [**pam**(8)](/man/os/libcap/pam.8).

2025-03-19

---

Document: pam_cap(8) from libcap 2.78-r3 (Chainguard OS)
Source: https://kernel.googlesource.com/pub/scm/libs/libcap/libcap.git