I would really like to use the PAM module `pam_exec` to do some account setup and teardown activities during a session. I have written a simple test script that runs and logs some runtime data so that i can see what is happening.

It seems to me that the exec'd script has to be executable by the effective UID of whoever is running the command that triggers PAM. This makes sense. However, I want a bit more security in this process. For example, it seems to me that if I have a script that pokes a record into a database on account login/logout then that script has to be executable by ALL users all the time.

I would much prefer to have the script be visible and executable ONLY by root or some other special-purpose account and have `pam_exec` `suid` the script for the unprivileged user.

Why? In the case of the database script I would not want the user to login then execute the script by hand to seemingly "logout".

I've thought about trying to put the script in the "sudoers" file but that still enables anyone to run it whenever they like.

It seems like the only option is to hack pam\_exec to allow a "run as" option.

It is late on a Friday afternoon and I may be missing something trivial. Is there a better way?