A PAM module that grants access to devices tagged "uaccess" in udev for the duration of the users session.
Replaces (e)logind's uaccess feature. Requires udev rules that set the 'uaccess' tag.
meson build --prefix /usr ninja -C build sudo ninja -C build install
The module will be installed to
To use the PAM module, it must be added to a relevant PAM stack:
session optional pam_uaccess.so
getfacl can be used to inspect files to see the added ACL. If no ACL is
present, ensure that udev is installed and running and ensure that udev rules
that will set 'uaccess' tags are in place and that they match your devices.
pam_uaccess does not track the number of active logins of a user, and so the grants made to a user will be removed when any session logs out, even if others remain.
If this is a problem for your setup (it may not be - e.g., a single greetd instance would not exhibit any issues with such setup), the skip_ungrant argument can be specified to disable ungrant altogether:
session optional pam_uaccess.so skip_ungrant
In this case, pam_uaccess will grant access to devices to a user on their first login, and this access will persist until reboot or until the device is removed.
pam_uaccess only operates on login, and does not grant access to new devices as they are added.
This should not be a problem in most cases.
Go to #kennylevinsen @ irc.libera.chat to discuss, or use ~email@example.com.