su and PAM

[Chris Jaeger]

Hi all,

        I'm working on a PAM module, and having looked
at several GNU utilities, a question came to mind. There
are several applications that allow you to perform 
privileged actions without authentication if you are
root. For the applications that are PAM-aware, is there
a particular reason that tests for uid == 0 are performed
instead of placing the pam_rootok module in that service's
PAM stack and then calling pam_authenticate? su is just
one example, there are plenty of others. People on the
PAM list seem to think the pam_rootok module should be
used, and I'm simply wondering why it hasn't.

Thanks,
Chris