I settled on pam_env and ~/.pam_environment for handling these. Required a small change to pam config to load it by default, but it felt like a sane solution at

I settled on pam_env and ~/.pam_environment for handling these. Required a small change to pam config to load it by default, but it felt like a sane solution at the time.