I disagree that "it's all pretty simple and readable". The PAM configuration syntax is horrific, IMNSHO. It's a ruleset specification without explicit rule synt

I disagree that "it's all pretty simple and readable". The PAM configuration syntax is horrific, IMNSHO. It's a ruleset specification without explicit rule syntax, it has zero syntax checking and there are no validation/testing tools. The configuration files are line-based rather than having a separate scope for each rule; even ini-style headers would have been an improvement. The config syntax allows conditional rule evaluation by specifying how many of the following rules to skip (hello GOTO!). It even allows rule inheritance by using @include, but the including rule cannot modify/evaluate the results: if the rules you're inheriting have hard fails or hard accepts (such as root_ok), the rest of your own rules might not even get evaluated. What does PAM actually do? It allows you to specify different authentication flows depending on the agent (authorizing application) and the intended action/flow. The resulting ruleset is effectively a determination tree, but there is no way to either input your ruleset as a tree structure, nor is there a way to get PAM to dump its abstract syntax tree for debugging.