---
name: "sepermit.conf"
section: "5"
platform: "linux"
package: "libpam-runtime"
version: "1.7.0-5"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/sepermit.conf"
---

# sepermit.conf(5)

configuration file for the pam\_sepermit module

## NAME

sepermit.conf - configuration file for the pam\_sepermit module

## DESCRIPTION

The lines of the configuration file have the following syntax:

*\<user\>*\[:*\<option\>*:*\<option\>*...\]

The **user** can be specified in the following manner:

• a username

• a groupname, with **@group** syntax. This should not be confused with netgroups.

• a SELinux user name with **%seuser** syntax.

The recognized options are:

exclusive

Only single login session will be allowed for the user and the user's processes will be killed on logout.

ignore

The module will never return PAM\_SUCCESS status for the user. It will return PAM\_IGNORE if SELinux is in the enforcing mode, and PAM\_AUTH\_ERR otherwise. It is useful if you want to support passwordless guest users and other confined users with passwords simultaneously.

The lines which start with # character are comments and are ignored.

## EXAMPLES

These are some example lines which might be specified in /etc/security/sepermit.conf.

```
%guest_u:exclusive
%staff_u:ignore
%user_u:ignore
```

## SEE ALSO

[**pam\_sepermit**(8)](/pam_sepermit/8.md), [**pam.d**(5)](/pam.d/5.md), [**pam**(7)](/pam/7.md), [**selinux**(8)](/selinux/8.md),

## AUTHOR

pam\_sepermit and this manual page were written by Tomas Mraz \<tmraz@redhat.com\>