security/unix-selfauth-helper ready for use (screenlockers etc)

From: Felix Palmen <>
Date: Sat, 20 Aug 2022 09:57:24 UTC
Hello everyone,

just a quick notice if you're maintaining a port of some screen locker,
you now *might* want to add security/unix-selfauth-helper as a

Short background is a "special" feature of LinuxPAM that *some* screen
lockers now take for granted: Their uses a suid-root helper
for the case that you're trying to authenticate as yourself. As a
consequence, a screen locker doesn't need to be suid-root itself (or use
a 3rd-party suid-root helper) in order to use PAM when might
be used.

I tried to reimplement this feature into our, which was
rejected, but des@ recommended to use instead. That's how
unix-selfauth-helper came to be. It must be specifically configured in
the PAM policy used, but it's less intrusive than modifying pam_unix.

To learn how to use it, just have a look at unix-selfauth-helper(8).
You can also look at a review I opened to update xscreensaver to 6.04
(which will need this functionality) as an example here:

Best regards, Felix

 Felix Palmen <>     {private}
 -- ports committer (mentee) --            {web}
 {pgp public key}
 {pgp fingerprint} 6936 13D5 5BBF 4837 B212  3ACC 54AD E006 9879 F231