console.handlers(5) System Administrator's Manual console.handlers(5)NAME
console.handlers - file specifying handlers of console lock and unlock events
DESCRIPTION
/etc/security/console.handlers determines which programs will be run when an user obtains the console lock at login time, and when the user
loses it on log out. It is read by the pam_console module.
The format is:
handler-filename lock|unlock [flag ...]
Where handler-filename is a name of the executable to be run, lock or unlock specifies on which event it should be run, and flags specify
how should pam_console call it.
Additionally there should be a line which specifies glob patterns of console devices.
The format of this line is: console-name consoledevs regex [regex ...]
Where console-name is a name of the console class - currently ignored - and regexes are regular expression patterns which specify the name
of the tty device. Only the first such line is consulted.
FLAGS
logfail
The pam_console module should log error to the system log if the return value of the handler is not zero or if the handler can not
be executed.
wait The pam_console should wait for the handler to exit before continuing.
setuid The handler should be executed with uid/gid of the user which obtained the console lock.
tty The handler will get a tty name as obtained from PAM as a parameter.
user The handler will get an user name as obtained from PAM as a parameter.
Anything else will be added directly as a parameter to the handler executable.
SEE ALSO pam_console(8)AUTHOR
Tomas Mraz <tmraz@redhat.com>
Red Hat 2005/3/18 console.handlers(5)
Check Out this Related Man Page
pam_console(8) System Administrator's Manual pam_console(8)NAME
pam_console - control permissions for users at the system console
SYNOPSIS
session optional /lib/security/pam_console.so
auth required /lib/security/pam_console.so
DESCRIPTION
pam_console.so is designed to give users at the physical console (virtual terminals and local xdm-managed X sessions by default, but that
is configurable) capabilities that they would not otherwise have, and to take those capabilities away when the are no longer logged in at
the console. It provides two main kinds of capabilities: file permissions and authentication.
When a user logs in at the console and no other user is currently logged in at the console, pam_console.so will change permissions and own-
ership of files as described in the file /etc/security/console.perms. That user may then log in on other terminals that are considered
part of the console, and as long as the user is still logged in at any one of those terminals, that user will own those devices. When the
user logs out of the last terminal, the console may be taken by the next user to log in. Other users who have logged in at the console
during the time that the first user was logged in will not be given ownership of the devices unless they log in on one of the terminals;
having done so on any one terminal, the next user will own those devices until he or she has logged out of every terminal that is part of
the physical console. Then the race can start for the next user. In practice, this is not a problem; the physical console is not gener-
ally in use by many people at the same time, and pam_console.so just tries to do the right thing in weird cases.
ARGUMENTS
debug turns on debugging
allow_nonroot_tty
gain console locks and change permissions even if the TTY's owner is not root.
permsfile=filename
tells pam_console.so to get its permissions database from a different file than /etc/security/console.perms
fstab=filename
tells pam_console.so to read the table of configured filesystems from a file other than /etc/fstab when scanning permsfile. This
file is used to map directories to device names.
FILES
/var/run/console.lock
/var/run/console/
/etc/security/console.apps
/etc/security/console.perms
SEE ALSO console.perms(5)console.apps(5)
/usr/doc/pam*/html/index.html pam_console_apply(8)
/usr/doc/pam*/html/index.html
BUGS
Let's hope not, but if you find any, please report them via the "Bug Track" link at http://bugzilla.redhat.com/bugzilla/
AUTHOR
Michael K. Johnson <johnsonm@redhat.com>
Red Hat 2000/7/11 pam_console(8)