"/usr/share/pam.d" exists but is not used?

There doesn’t seem to be a relevant change proposal either.

Personally, I think switching to “/usr/share” for distro level configurations is a good direction.

Months have passed — does no one know? Also, I missed one location: /usr/lib/pam.d/.

What would be the benefits, and which files would you move there? Personally, I don’t see any advantage to this. Most of the pam.d configuration needs to be editable by the user to configure authentication. Additionally, there is authselect, which manages PAM along with NSS and other configurations (the pam.d directory links to /etc/authselect on Fedora 40+ installations).

As an explanation: Like other configuration files, those located in /etc are used for local overrides, while those in /usr/share or /usr/lib are for distribution defaults. Files that need to be generated dynamically are still kept in /etc.

I also have a question: Then how do you explain the existence of /usr/share/pam.d?

It’s probably (I am not Fedora developer) there just for the convenience of other packages (pam reads from /etc/pam.d and then from /usr/share/pam.d). I think you’re reading too much into that.

In general, the files in /etc/pam.d should ideally be moved to /usr/share/pam.d, but we can’t really force the various developers to do so. You can file a bugzilla issue for each of the packages which installs files in /etc/pam.d, if you like.

Then it sounds like it would be better to do this through a change proposal.