gdm.pam

#%PAM-1.0
auth      requisite  pam_nologin.so
auth      requisite  pam_succeed_if.so user != root quiet
auth      requisite  pam_succeed_if.so user notingroup root quiet
auth      substack   system-login
auth      optional   pam_gnome_keyring.so
account   include    system-login
password  include    system-login
session   substack   system-local-login
session   optional   pam_keyinit.so force revoke
session   optional   pam_gnome_keyring.so auto_start