---
name: "pam_sm_setcred"
section: "3"
platform: "linux"
package: "pam"
version: "1.7.3-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux", "freebsd", "macos"]
url: "https://new.carta.tech/pam_sm_setcred"
---

# pam\_sm\_setcred(3)

PAM service function to alter credentials

## NAME

pam\_sm\_setcred - PAM service function to alter credentials

## SYNOPSIS

```
#include <security/pam_modules.h>
```

**int pam\_sm\_setcred(pam\_handle\_t \****pamh***, int** *flags***, int** *argc***, const char \*\****argv***);**

## DESCRIPTION

The **pam\_sm\_setcred** function is the service module's implementation of the [**pam\_setcred**(3)](/pam_setcred/3.md) interface.

This function performs the task of altering the credentials of the user with respect to the corresponding authorization scheme. Generally, an authentication module may have access to more information about a user than their authentication token. This function is used to make such information available to the application. It should only be called *after* the user has been authenticated but before a session has been established.

Valid flags, which may be logically OR'd with *PAM\_SILENT*, are:

PAM\_SILENT

Do not emit any messages.

PAM\_ESTABLISH\_CRED

Initialize the credentials for the user.

PAM\_DELETE\_CRED

Delete the credentials associated with the authentication service.

PAM\_REINITIALIZE\_CRED

Reinitialize the user credentials.

PAM\_REFRESH\_CRED

Extend the lifetime of the user credentials.

The way the **auth** stack is navigated in order to evaluate the **pam\_setcred**() function call, independent of the **pam\_sm\_setcred**() return codes, is exactly the same way that it was navigated when evaluating the **pam\_authenticate**() library call. Typically, if a stack entry was ignored in evaluating **pam\_authenticate**(), it will be ignored when libpam evaluates the **pam\_setcred**() function call. Otherwise, the return codes from each module specific **pam\_sm\_setcred**() call are treated as **required**.

## RETURN VALUES

PAM\_CRED\_UNAVAIL

This module cannot retrieve the user's credentials.

PAM\_CRED\_EXPIRED

The user's credentials have expired.

PAM\_CRED\_ERR

This module was unable to set the credentials of the user.

PAM\_SUCCESS

The user credential was successfully set.

PAM\_USER\_UNKNOWN

The user is not known to this authentication module.

These, non-*PAM\_SUCCESS*, return values will typically lead to the credential stack *failing*. The first such error will dominate in the return value of **pam\_setcred**().

## SEE ALSO

[**pam**(3)](/pam/3.md), [**pam\_authenticate**(3)](/pam_authenticate/3.md), [**pam\_setcred**(3)](/pam_setcred/3.md), [**pam\_sm\_authenticate**(3)](/pam_sm_authenticate/3.md), [**pam\_strerror**(3)](/pam_strerror/3.md), [**PAM**(8)](/PAM/8.md)