To make other applications accessible to console users, a bit more work is required.
First of all, console access only works for applications which reside in
/usr/sbin/, so the application that you wish to run must be there. After verifying that, perform the following steps:
Create a link from the name of your application, such as our sample
foo program, to the
ln -s consolehelper foo
Create the file
Create a PAM configuration file for the
foo service in
/etc/pam.d/. An easy way to do this is to copy the PAM configuration file of the
halt service, and then modify the copy if you want to change the behavior:
cp /etc/pam.d/halt /etc/pam.d/foo
/usr/bin/foo is executed,
consolehelper is called, which authenticates the user with the help of
/usr/sbin/userhelper. To authenticate the user,
consolehelper asks for the user's password if
/etc/pam.d/foo is a copy of
/etc/pam.d/halt (otherwise, it does precisely what is specified in
/etc/pam.d/foo) and then runs
/usr/sbin/foo with root permissions.
In the PAM configuration file, an application can be configured to use the pam_timestamp module to remember (or cache) a successful authentication attempt. When an application is started and proper authentication is provided (the root password), a timestamp file is created. By default, a successful authentication is cached for five minutes. During this time, any other application that is configured to use
pam_timestamp and run from the same session is automatically authenticated for the user — the user does not have to enter the root password again.
This module is included in the
pam package. To enable this feature, add the following lines to your PAM configuration file in
auth include config-util
account include config-util
session include config-util
These lines can be copied from any of the
/etc/pam.d/system-config-* configuration files. Note that these lines must be added below any other
session optional lines in your PAM configuration file.
If an application configured to use
is successfully authenticated from the Applications (the main menu on the panel), the
icon is displayed in the notification area of the panel if you are running the GNOME
desktop environment. After the authentication expires (the default is five minutes), the icon disappears.
The user can select to forget the cached authentication by clicking on the icon and selecting the option to forget authentication.