core: minor PAM fixes (#43576)

Fixes: #39617

src/core/exec-invoke.c

@@ -1163,7 +1163,7 @@ static int pam_close_session_and_delete_credentials(pam_handle_t *pamh, int flag
 
         s = sym_pam_setcred(pamh, PAM_DELETE_CRED | flags);
         if (s != PAM_SUCCESS)
-                pam_syslog_pam_error(pamh, LOG_DEBUG, r, "pam_setcred(PAM_DELETE_CRED) failed: @PAMERR@");
+                pam_syslog_pam_error(pamh, LOG_DEBUG, s, "pam_setcred(PAM_DELETE_CRED) failed: @PAMERR@");
 
         return r != PAM_SUCCESS ? r : s;
 }

src/login/systemd-user.in

@@ -8,7 +8,12 @@
 {% endif %}
 account  required   pam_unix.so no_pass_expiry
 
-auth     required   pam_deny.so
+# systemd never invokes pam_authenticate() on this stack, but it does invoke pam_setcred(), which runs the
+# "auth" stack too. Hence an "auth" entry is needed that lets pam_setcred() succeed, without falling back to
+# the "other" service (which typically consists of pam_warn/pam_deny, and thus generates log noise).
+# pam_rootok's pam_sm_setcred() unconditionally succeeds, while its pam_sm_authenticate() only succeeds for
+# callers running as root (which the service manager does).
+auth     required   pam_rootok.so
 
 {% if HAVE_SELINUX %}
 session  required   pam_selinux.so close

src/run/systemd-run0.in

@@ -8,7 +8,12 @@
 {% endif %}
 account  required   pam_unix.so
 
-auth     required   pam_deny.so
+# systemd never invokes pam_authenticate() on this stack (authorization for run0 is done via polkit), but it
+# does invoke pam_setcred(), which runs the "auth" stack too. Hence an "auth" entry is needed that lets
+# pam_setcred() succeed, without falling back to the "other" service (which typically consists of
+# pam_warn/pam_deny, and thus generates log noise). pam_rootok's pam_sm_setcred() unconditionally succeeds,
+# while its pam_sm_authenticate() only succeeds for callers running as root (which the service manager does).
+auth     required   pam_rootok.so
 
 {% if HAVE_SELINUX %}
 session  required   pam_selinux.so close