---
name: "pam_exec"
section: "8"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["linux", "freebsd"]
url: "https://new.carta.tech/pam_exec"
---

# pam\_exec(8)

Exec PAM module

## NAME

**pam\_exec** – Exec PAM module

## SYNOPSIS

\[*service-name*\] *module-type* *control-flag* *pam\_exec* \[*arguments*\]

## DESCRIPTION

The exec service module for PAM executes the program designated by its first argument if no options are specified, with its remaining arguments as command-line arguments. If options are specified, the program and its arguments follow the last option or **--** if the program name conflicts with an option name.

The following options may be passed before the program and its arguments:

- **capture\_stderr**

  Capture text printed by the program to its standard error stream and pass it to the conversation function as error messages. No attempt is made at buffering the text, so results may vary.

- **capture\_stdout**

  Capture text printed by the program to its standard output stream and pass it to the conversation function as informational messages. No attempt is made at buffering the text, so results may vary.

- **debug**

  Ignored for compatibility reasons.

- **no\_warn**

  Ignored for compatibility reasons.

- **return\_prog\_exit\_status**

  Use the program exit status as the return code of the pam\_sm\_\* function. It must be a valid return value for this function.

- **expose\_authtok**

  Write the authentication token to the program's standard input stream, followed by a NUL character. Ignored for **pam\_sm\_setcred**().

- **use\_first\_pass**

  If **expose\_authtok** was specified, do not prompt for an authentication token if one is not already available.

- **--**

  Stop options parsing; program and its arguments follow.

The child's environment is set to the current PAM environment list, as returned by [pam\_getenvlist(3)](/pam_getenvlist/3.md). In addition, the following PAM items are exported as environment variables: PAM\_RHOST, PAM\_RUSER, PAM\_SERVICE, PAM\_SM\_FUNC, PAM\_TTY and PAM\_USER.

The PAM\_SM\_FUNC variable contains the name of the PAM service module function being called. It may be:

- pam\_sm\_acct\_mgmt

- pam\_sm\_authenticate

- pam\_sm\_chauthtok

- pam\_sm\_close\_session

- pam\_sm\_open\_session

- pam\_sm\_setcred

If **return\_prog\_exit\_status** is not set (default), the PAM\_SM\_FUNC function returns PAM\_SUCCESS if the program exit status is 0, PAM\_PERM\_DENIED otherwise.

If **return\_prog\_exit\_status** is set, the program exit status is used. It should be PAM\_SUCCESS or one of the error codes allowed by the calling PAM\_SM\_FUNC function. The valid codes are documented in each function man page. If the exit status is not a valid return code, PAM\_SERVICE\_ERR is returned. Each valid codes numerical value is available as an environment variable (eg. PAM\_SUCESS, PAM\_USER\_UNKNOWN, etc). This is useful in shell scripts for instance.

## SEE ALSO

[pam(3)](/pam/3.md), [pam\_get\_item(3)](/pam_get_item/3.md), [pam\_sm\_acct\_mgmt(3)](/pam_sm_acct_mgmt/3.md), [pam\_sm\_authenticate(3)](/pam_sm_authenticate/3.md), [pam\_sm\_chauthtok(3)](/pam_sm_chauthtok/3.md), [pam\_sm\_close\_session(3)](/pam_sm_close_session/3.md), [pam\_sm\_open\_session(3)](/pam_sm_open_session/3.md), [pam\_sm\_setcred(3)](/pam_sm_setcred/3.md), [pam.conf(5)](/pam.conf/5.md)

## AUTHORS

The **pam\_exec** module and this manual page were developed for the FreeBSD Project by ThinkSec AS and NAI Labs, the Security Research Division of Network Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 (“CBOSS”), as part of the DARPA CHATS research program.