PAM Interaction With Device Groups

The Solaris Resource Manager PAM module looks up the terminal and service names in the device hierarchy, and returns a 'permission denied' message to its invoker if limits are exceeded or if a device flag evaluates to set.

The device categories examined are terminal for the terminal name, and services for the kind of service requested. For example, an rlogin attempt may try to use a file in the network device group, so the flags tested for the user (assuming all flags are set to group) are as shown below. These flags are checked in order:

• terminal.flag.network

• terminal.flag.all

• services.flag.rlogin

• services.flag.netservices

Access is permitted only if they all evaluate to set. In addition, limits will be checked for the corresponding categories (terminal and services).