---
name: "pam_rootok"
section: "8"
platform: "linux"
package: "pam"
version: "1.7.3-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux", "freebsd", "macos"]
url: "https://new.carta.tech/pam_rootok"
---

# pam\_rootok(8)

Gain only root access

## NAME

pam\_rootok - Gain only root access

## SYNOPSIS

**pam\_rootok.so** \[debug\]

## DESCRIPTION

pam\_rootok is a PAM module that authenticates the user if their *UID* is *0*. Applications that are created setuid-root generally retain the *UID* of the user but run with the authority of an enhanced effective-UID. It is the real *UID* that is checked.

## OPTIONS

debug

Print debug information.

## MODULE TYPES PROVIDED

The **auth**, **account** and **password** module types are provided.

## RETURN VALUES

PAM\_SUCCESS

The *UID* is *0*.

PAM\_AUTH\_ERR

The *UID* is **not** *0*.

## EXAMPLES

In the case of the [**su**(1)](/su/1.md) application the historical usage is to permit the superuser to adopt the identity of a lesser user without the use of a password. To obtain this behavior with PAM the following pair of lines are needed for the corresponding entry in the /etc/pam.d/su configuration file:

```
# su authentication. Root is granted access by default.
auth  sufficient   pam_rootok.so
auth  required     pam_unix.so
```

## SEE ALSO

[**su**(1)](/su/1.md), [**pam.conf**(5)](/pam.conf/5.md), [**pam.d**(5)](/pam.d/5.md), [**pam**(8)](/pam/8.md)

## AUTHOR

pam\_rootok was written by Andrew G. Morgan, \<morgan@kernel.org\>.