it's possible to run as non-root user with pam_unix

[Kenny Gryp]

The documentation states that if you want to use pam_unix, you need to run mysql as root.

That's not really necessary.

You can just add the mysql user to the shadow group. This shadow group at least exists in ubuntu:

root@lucid64:/var/lib/mysql# getent group shadow
shadow:x:42:mysql

root@lucid64:/var/lib/mysql# ls -alhs /etc/shadow
4.0K -rw-r----- 1 root shadow 912 Dec 21 10:39 /etc/shadow

pam_unix Authentication just works then

[Kenny Gryp (gryp)]

Note: you need to restart mysql for the group changes to have effect

[Raghavendra D Prabhu (raghavendra-prabhu)]

Providing group access to shadow file to mysql's group is also
bad since a mysql vulnerability can lead to entire system being
compromised.

The right way is to use unix_chkpwd helper, however, it is
currently not working, hence I have raised https://bugs.launchpad.net/percona-pam-for-mysql/+bug/1086795 for the same.