The PAM module that sets and unsets environment variables is pam_env. This module allows the (un)setting of environment variables based on the rules specified in the configuration file /etc/security/pam_env.conf or an alternative file. The module can also read a file with simple KEY=VAL pairs on separate lines (/etc/environment by default) or a user-specific file ($HOME/.pam_environment by default). The pam_env module supports the use of previously set environment variables as well as PAM_ITEMs such as PAM_RHOST. The pam_env module should be the last one on the stack, as setting PAM environment variables can have side effects on other modules. The pam_env module provides the auth and session module types. References:

pam_env - PAM module to set/unset environment variables

pam_env(8) - Linux manual page