PAM_ROOTOK(8)

  .SH "NAME" pam_rootok - Gain only root access
  .SH "SYNOPSIS"
    .HP u
      pam_rootok.so
       [debug]

  .SH "DESCRIPTION"

    .PP pam_rootok is a PAM module that authenticates the user if their UID is 0. Applications that are created setuid-root generally retain the UID of the user but run with the authority of an enhanced effective-UID. It is the real UID that is checked.

  .SH "OPTIONS"

      .PP debug

              Print debug information.

          .RE

      .SH "MODULE TYPES PROVIDED"

        .PP The auth, account and password module types are provided.

      .SH "RETURN VALUES"

          .PP PAM_SUCCESS

                  The UID is 0.

              .RE
              .PP PAM_AUTH_ERR

                      The UID is not 0.

                  .RE

              .SH "EXAMPLES"

                .PP In the case of the su(1) application the historical usage is to permit the superuser to adopt the identity of a lesser user without the use of a password. To obtain this behavior with PAM the following pair of lines are needed for the corresponding entry in the /etc/pam.d/su configuration file:

                # su authentication. Root is granted access by default.
                auth  sufficient   pam_rootok.so
                auth  required     pam_unix.so

              .SH "SEE ALSO"

                .PP su(1), pam.conf(5), pam.d(5), pam(8)

              .SH "AUTHOR"

                  .PP pam_rootok was written by Andrew G. Morgan, <morgan@kernel.org>.