---
name: "pam_groupnet"
section: "8"
platform: "linux"
package: "libpam-net"
version: "0.4-1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/pam_groupnet"
---

# pam\_groupnet(8)

join/create a specific network namespace at login

## NAME

pam\_groupnet - join/create a specific network namespace at login

## SYNOPSIS

**pam\_groupnet.so**

## DESCRIPTION

The pam\_groupnet PAM module allow each user in *groupnet* group to join a specific network namespace.

If the specified network namespace exists, pam runs the user shell in that namespace. If such a namespace does does not exist, it is created during the login process.

The system administrator can specify the network namespace to join by creating groups starting with *groupnet-*. The text written after the dash will be used as the network namespace name to join or create. Users will join the network namespace at login.

If a user is part of multiple groups starting with *groupnet-*, the first one that matches is used. Group testing order is as returned by *[getgrouplist(3)](/getgrouplist/3.md)*.

## OPTIONS

**group=***groupname*

the module operates on users in the group *groupname-* instead of *groupnet-*.

**lodown**

leave the localhost *lo* interface in the state DOWN.

**rootshared**

Leave the root filesystem */* as shared so mounts can propagate out to the parent namespace. Warning: this feature can create security vulnerabilities if not properly used.

## RETURN VALUES

PAM\_IGNORE

User does not belong to any *groupnet-\** group.

PAM\_ABORT

Error in retrieving the user id or in the namespace creation/joining.

PAM\_SUCCESS

Success.

## EXAMPLES

Add the following line to /etc/pam.d/sshd or /etc/pam.d/login

session   required  pam\_groupnet.so

## SEE ALSO

[**pam.conf**(5)](/pam.conf/5.md), [**pam.d**(5)](/pam.d/5.md), [**pam**(7)](/pam/7.md)

## AUTHOR

pam\_groupnet was written by Renzo Davoli and Eduard Caizer, University of Bologna