The problem is in apparmor configuration:
``` audit: type=1400 audit(1524780087.048:210): apparmor="DENIED" operation="file_mmap" profile="/usr/sbin/ejabberdctl//su" name="/usr/lib/erlang/p1_pam/bin/epam" pid=25519 comm="epam" requested_mask="m" denied_mask="m" fsuid=0 ouid=0 ```
`mmap` permission needs to be specified for the epam suid binary helper. Attached patch fixes the problem, pam authentication starts to work.
The problem is in apparmor configuration:
``` 7.048:210) : apparmor="DENIED" operation= "file_mmap" profile= "/usr/sbin/ ejabberdctl/ /su" name="/ usr/lib/ erlang/ p1_pam/ bin/epam" pid=25519 comm="epam" requested_mask="m" denied_mask="m" fsuid=0 ouid=0
audit: type=1400 audit(152478008
```
`mmap` permission needs to be specified for the epam suid binary helper.
Attached patch fixes the problem, pam authentication starts to work.