#%PAM-1.0

# The login screen runs without authentication, as its own system user.
auth    required        pam_permit.so

@include common-account

session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
session optional        pam_keyinit.so force revoke
session required        pam_limits.so
session required        pam_loginuid.so
@include common-session
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open

password        required pam_deny.so

session required        pam_env.so
session required        pam_env.so envfile=/etc/default/locale