pam: Add pam_permit to the auth section of chfn.
drwxr-xr-x - etc