---
name: "pam_cap"
section: "8"
platform: "linux"
package: "libcap"
version: "2.78-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/pam_cap"
---

# pam\_cap(8)

Capabilities PAM module

## NAME

**pam\_cap** - Capabilities PAM module

## SYNOPSIS

\[service-name\] **auth** control-flag **pam\_cap** \[options\]

## DESCRIPTION

The **pam\_so** module can be used to specify *Inheritable* capabilities to process trees rooted in the PAM application. The module also supports blocking *Bounding* vector capabilities and adding *Ambient* vector capabilities.

For general PAM apps to work correctly, the application must be run with at least **CAP\_SETPCAP** raised in its *Permitted* capability flag. Many PAM applications run as *root*, which has all of the bits in the *Bounding* set raised, so this requirement is typically met. To grant an *Ambient* vector capability, the corresponding Permitted bit must be available to the application too.

The **pam\_so** module is a Linux-PAM *auth* module. It provides functionality to back **pam\_sm\_authenticate()** and **pam\_sm\_setcred()**. It is the latter that actually modifies the inheritable 3-tuple of capability vectors: the configured *IAB*. In a typical application configuration you might have a line like this:

-

  ```
  auth    optional    pam_cap.so
  ```

-

  The module arguments are:

- ○

  **debug**: While supported, this is a no-op at present.

- ○

  **config=***/path/to/file*: Override the default config for the module. The unspecified default value for this file is **/etc/security/capability.conf**. Note, **config=/dev/null** is a valid value. See **default=** below for situations in which this might be appropriate.

- ○

  **keepcaps**: This is as much as the **pam\_cap.so** module can do to help an application support use of the *Ambient* capability vector. The application support for the *Ambient* set is poor at the present time.

- ○

  **autoauth**: This argument causes the **pam\_cap.so** module to return **PAM\_SUCCESS** if the **PAM\_USER** being authenticated exists. The absence of this argument will cause **pam\_cap.so** to only return **PAM\_SUCCESS** if the **PAM\_USER** is covered by a specific rule in the prevailing config file.

- ○

  **default=***IAB*: This argument is ignored if the prevailing configuration file contains a "**\***" rule. If there is no such rule, the *IAB* 3-tuple is inserted at the end of the config file and applies to all **PAM\_USER**s not covered by an earlier rule. Note, if you want all **PAM\_USER**s to be covered by this default rule, you can supply the module argument **config=/dev/null**.

- ○

  **defer**: This argument arranges for the *IAB* capabilities granted to a user to be added sufficiently late in the Linux-PAM authentication stack that they stick. That is, *after* the application does its **setuid(UID)** call. As such, in conjunction with the **keepcaps** module argument, such compliant applications can support granting *Ambient* vector capabilities with **pam\_cap.so**.

-

  ## SEE ALSO

[**pam.conf**(5)](/pam.conf/5.md), [**capability.conf**(5)](/capability.conf/5.md), [**cap\_text\_formats**(7)](/cap_text_formats/7.md), [**pam**(8)](/pam/8.md).