Am 16.01.19 um 15:32 schrieb Stephen Gallagher:
OK, so while pam_open_session() runs with UID == the user logging
in,
it *also* runs with EUID (effective UID) of the application that
called it. This is so that pam_open_session() can do things like
creating or mounting the user's home directory.
So, we cannot rely on basic permissions to restrict the display of the
MOTD (without modifying pam_motd sources). I guess that would have
been too easy...
when it is properly packaged as "confignoreplace" just empty that file
and you are done