Update README file

README

@@ -108,8 +108,15 @@ recommended that you start a separate shell with root privileges while
 configuring PAM to be able to revert changes if something goes wrong.
 Test your configuration thoroughly before closing the root shell.
 
+[[moduleArguments]]
 === Module Arguments
 
+The following table documents the set of arguments recognized by the module.
+Defaults values are hard-wired, but they can be overridden by a
+<<confFile,configuration file>>, if any is found.
+The definitions from the configuration file can be in turn overridden by
+individual files under `/etc/pam.d/`.
+
 [horizontal]
 debug::
 Enables debug output
@@ -240,6 +247,13 @@ FIDO devices. It is not possible to mix native credentials and SSH
 credentials. Once this option is enabled all credentials will be parsed
 as SSH.
 
+conf_file=file::
+Set an alternative location for the <<confFile,configuration file>>.
+The supplied path must be absolute.
+This argument is special, in that it can only appear in a file under
+`/etc/pam.d/`, and not in a configuration file.
+
+
 IMPORTANT: On dynamic networks (e.g. where hostnames are set by DHCP),
 users should not rely on the default origin and appid
 ("pam://$HOSTNAME") but set those parameters explicitly to the same
@@ -404,6 +418,24 @@ defined in the authorization mapping file. If during an authentication attempt
 a connected device is removed or a new device is plugged in, the authentication
 restarts from the top of the list.
 
+[[confFile]]
+== Configuration file
+
+A global configuration file can be supplied in order to override
+the hard-wired defaults for the module arguments.
+
+The file can contain, one per line, the same arguments as
+<<moduleArguments,defined above>>.
+Brackets around arguments are *not* needed in order to get spaces
+correctly recognized.
+Lines starting with `#` and empty lines are interpreted as comments.
+
+The default position of the configuration file is
+`/etc/security/pam_u2f.conf`.
+Individual files under `/etc/pam.d/` can override such path
+file by means of the `conf_file=` argument.
+The override will not affect other `/etc/pam.d/` files.
+
 == SELinux Note
 
 Due to an issue with Fedora Linux, and possibly with other