pam_xauth - forward xauth keys between users


SYNOPSIS

       session optional /lib/security/pam_xauth.so arguments


DESCRIPTION

       pam_xauth.so  is designed to forward xauth keys (sometimes
       referred to as "cookies") between users.

       Without pam_xauth, when xauth is enabled and a  user  uses
       the  su command to assume another user's priviledges, that
       user is no longer able to access  the  original  user's  X
       display  because the new user does not have the key needed
       to access the display.  pam_xauth solves  the  problem  by
       forwarding  the  key  from the user running su (the source
       user) to the user whose identity the source user is assum­
       ing  (the  target  user)  when the session is created, and
       destroying the key when the session is torn down.

       This means, for example, that when  you  run  su  from  an
       xterm sesssion, you will be able to run X programs without
       explicitly dealing with the xauth command or ~/.Xauthority
       files.

       pam_xauth  will  only forward keys if xauth can list a key
       connected to the $DISPLAY environment variable.


ARGUMENTS

       debug  Turns on debugging messages sent to syslog.

       xauthpath=/usr/X11R6/bin/xauth
              Specify the path the xauth program (the default  is
              /usr/X11R6/bin/xauth).


IMPLEMENTATION DETAILS

       pam_xauth  will  work  only  if  it  is used from a setuid
       application in which the getuid() call returns the  id  of
       the  user  running  the application, and for which PAM can
       supply the name of the account that the user is attempting
       to  assume.   The  typical application of this type is su.
       The application  must  call  both  pam_open_session()  and
       pam_close_session()  with  the  ruid set to the uid of the
       calling user and the euid set to root, and must have  pro­
       vided as the PAM_USER item the name of the target user.

       pam_xauth  calls  xauth  as the source user to extract the
       key for $DISPLAY, then calls xauth as the target  user  to
       merge  the  key  into  the  a temporary database and later
       remove the database.

       pam_xauth cannot be told not to remove the keys  when  the
       session is closed.

       /usr/share/doc/pam*/html/index.html


BUGS

       Let's  hope  not,  but if you find any, please report them
       via  the  "Bug   Track"   link   at   http://bugzilla.red­
       hat.com/bugzilla/


AUTHOR

       Nalin Dahyabhai <nalin@redhat.com>, based on original ver­
       sion by Michael K. Johnson <johnsonm@redhat.com>


Man(1) output converted with man2html