SEPERMIT.CONF(5)

  .SH "NAME" sepermit.conf - configuration file for the pam_sepermit module
  .SH "DESCRIPTION"

    .PP The lines of the configuration file have the following syntax:
    .PP <user>[:<option>:<option>...]
    .PP The user can be specified in the following manner:

    •
                  a username
            .RE

        •
                      a groupname, with @group syntax. This should not be confused with netgroups.
                .RE

            •
                          a SELinux user name with %seuser syntax.
                    .RE
                .PP The recognized options are:

                    .PP exclusive

                                Only single login session will be allowed for the user and the user's processes will be killed on logout.

                        .RE
                        .PP ignore

                                    The module will never return PAM_SUCCESS status for the user. It will return PAM_IGNORE if SELinux is in the enforcing mode, and PAM_AUTH_ERR otherwise. It is useful if you want to support passwordless guest users and other confined users with passwords simultaneously.

                            .RE

                        .PP The lines which start with # character are comments and are ignored.

                      .SH "EXAMPLES"

                        .PP These are some example lines which might be specified in /etc/security/sepermit.conf.

                        %guest_u:exclusive
                        %staff_u:ignore
                        %user_u:ignore

                      .SH "SEE ALSO"

                        .PP pam_sepermit(8), pam.d(5), pam(8), selinux(8),

                      .SH "AUTHOR"

                        .PP pam_sepermit and this manual page were written by Tomas Mraz <tmraz@redhat.com>