16.7. PAM and Device Ownership

When a user logs into a Red Hat Enterprise Linux system, the pam_console.so module is called by login or the graphical login programs, gdm and kdm. If this user is the first user to log in at the physical console — called the console user — the module grants the user ownership of a variety of devices normally owned by root. The console user owns these devices until the last local session for that user ends. Once the user has logged out, ownership of the devices reverts back to the root user.

The devices affected include, but are not limited to, sound cards, diskette drives, and CD-ROM drives.

This allows a local user to manipulate these devices without attaining root access, thus simplifying common tasks for the console user.

By modifying the file /etc/security/console.perms, the administrator can edit the list of devices controlled by pam_console.so.

<console>=tty[0-9][0-9]* vc/[0-9][0-9]* :0\.[0-9] :0
<xconsole>=:0\.[0-9] :0

<console>=tty[0-9][0-9]* vc/[0-9][0-9]* :0\.[0-9] :0
<xconsole>=:0\.[0-9] :0

<console>=tty[0-9][0-9]* vc/[0-9][0-9]*

<console>=tty[0-9][0-9]* vc/[0-9][0-9]*