In Debian bullseye (probably way back to around 2013) and ubuntu back to at least 14.04 (tested in a docker container), ~/.pam_environment is not read per user_endir defaults to off for pam_env (see man 7 pam_env
).
If you want to reenable it:
echo 'session optional pam_env.so user_readenv=1' >> /etc/pam.d/common-session
that is, set for an interactive session (CLI or graphical logins, like su) the pam_env with user_reader at 1.
I believe it was disabled upstream due to:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4708 "
The pam_env module in Linux-PAM (aka pam) 1.1.2 and earlier reads the .pam_environment file in a user's home directory, which might allow local users to run programs with an unintended environment by executing a program that relies on the pam_env PAM check.
"
Thought the above description is not clear to me. If it means that ~/.pam_environment allows to change the program environment without the user knowing then any option n the home folder is alike (ie ~/.profile, ~/.zprofile). Mind ~/.profile is told to be read by graphical login managers ... so why remove ~/.pam_environment and keep ~/.profile?
A proper way would be to have the capability to set environment variables per user in /etc/security/pam_env.conf. Not yet requested upstream though. Or any option editable only with admin rights.