#%PAM-1.0

# Block login if they are globally disabled
auth    requisite       pam_nologin.so
auth    required        pam_succeed_if.so user != root quiet_success
@include common-auth
-auth   optional        pam_gnome_keyring.so

@include common-account

# SELinux needs to be the first session rule, and to intervene last.
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
session optional        pam_keyinit.so force revoke
session required        pam_limits.so
session required        pam_loginuid.so
@include common-session
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
-session optional       pam_gnome_keyring.so auto_start

@include common-password

# pam_env goes last: what it sets can affect the modules above.
session required        pam_env.so
session required        pam_env.so envfile=/etc/default/locale user_readenv=1