From d6aed1dca8ff3d5a4b7da996fef89b0c6c6440ec Mon Sep 17 00:00:00 2001 From: Ronan Pigott Date: Mon, 15 Jun 2026 16:58:42 -0700 Subject: [PATCH] pam: use default auth pam_deny.so run0 doesn't actually use the auth pam stack, since polkit does the requisite authorization. However, if the service type is left undefined pam falls back to the definitions of the "other" service, which, at least in Arch Linux but possibly more, includes pam_warn.so to notify the user about this apparent error. This creates a bit of logspam, as systemd does actually call pam_setcred in its generic pam code, which depends on the auth pam stack, creating a warning message in the journal on every invocation of run0. pam_deny.so is a no-op, which avoids falling back to the other pam service. --- src/login/systemd-user.in | 2 ++ src/run/systemd-run0.in | 2 ++ 2 files changed, 4 insertions(+) diff --git a/src/login/systemd-user.in b/src/login/systemd-user.in index ce22744501..70ca709f51 100644 --- a/src/login/systemd-user.in +++ b/src/login/systemd-user.in @@ -8,6 +8,8 @@ {% endif %} account required pam_unix.so no_pass_expiry +auth required pam_deny.so + {% if HAVE_SELINUX %} session required pam_selinux.so close session required pam_selinux.so nottys open diff --git a/src/run/systemd-run0.in b/src/run/systemd-run0.in index c628ef237d..6ad114f0de 100644 --- a/src/run/systemd-run0.in +++ b/src/run/systemd-run0.in @@ -8,6 +8,8 @@ {% endif %} account required pam_unix.so +auth required pam_deny.so + {% if HAVE_SELINUX %} session required pam_selinux.so close session required pam_selinux.so open