chiark / gitweb /
service: optionally call into PAM when dropping priviliges