I make Debian-based live images.
Because editing /etc/pam directly is pain and scary,
I edit /usr/share/pam-configs/libpam-mount and then run pam-auth-update.


You might want to say "that's abuse, you're doing it wrong, WONTFIX";
which I guess is reasonable. :-)


Anyway, I have a file like this:

    # Emacs, this is a -*-conf-*- file.
    Name: Mount volumes for user
    Default: yes
    # By default, this is 128 -- the same as ldap.
    # This results in PAM getting an order of "unix, mount, ldap".
    # I think it's better to have "unix, ldap, mount". (#30143)
    # Therefore, decrease the priority to 64.
    # FIXME: seek expert advice: is this good, or bad?
    Priority: 64
    Auth-Type: Additional
    # Because libpam_mount is so badly coded,
    # it thinks NFS mounts require a password.
    # This doesn't matter for the actual xdm GUI login,
    # but it is annoying when doing "su p123" when testing.
    # Disable all password prompting by arguments to pam_mount.so.
    Auth:
            optional        pam_mount.so  disable_pam_password disable_interactive disable_propagate_password
    Session-Interactive-Only: yes
    Session-Type: Additional
    Session:
            optional        pam_mount.so  disable_pam_password disable_interactive disable_propagate_password

When pam-auth-update runs, the comments confuse it:

    (bootstrap)root@zygon:/# DEBIAN_FRONTEND=noninteractive pam-auth-update
    Use of uninitialized value $fieldname in hash element at /usr/sbin/pam-auth-update line 689, <PROFILE> line 1.
    Use of uninitialized value $fieldname in hash element at /usr/sbin/pam-auth-update line 690, <PROFILE> line 1.

I think this can be trivially fixed in parse_pam_profile() by doing
something like this:

        while (<PROFILE>) {
    +     if (/^\s*#/) {
    +       continue;               # ignore comment lines
    +     }
          if (/^(\S+):\s+(.*)$/) {

PS: perlcritic also recommends File::Slurp,
but I guess you want to avoid gratuitous dependencies. :-)