Zbigniew Jędrzejewski-Szmek
39f457fe60
logind: make ReleaseSession "unprivileged" and allow closing of own session
...
Fixes https://github.com/systemd/systemd/issues/28514 .
Quoting https://github.com/systemd/systemd/issues/28514#issuecomment-1831781486 :
> Whenever PAM is enabled for a service, we set up the PAM session and then
> fork off a process whose only job is to eventually close the PAM session when
> the service dies. That services we run with service privileges, both to
> minimize attack surface and because we want to use PR_SET_DEATHSIG to be get
> a notification via signal whenever the main process dies. But that only works
> if we have the same credentials as that main process.
>
> Now, if pam_systemd runs inside the PAM stack (which it normally does) it's
> session close hook will ask logind to synchronously end the session via a bus
> call. Currently that call is not accessible to unprivileged clients. And
> that's the part we need to relax: allow users to end their own sessions.
The check is implemented in a way that allows the kill if the sender is in
the target session.
I found 'sudo systemctl --user -M "zbyszek@" is-system-running' to
be a convenient reproducer.
Before:
May 16 16:25:26 x1c systemd[1]: run-u24754.service: Deactivated successfully.
May 16 16:25:26 x1c dbus-broker[1489]: A security policy denied :1.24757 to send method call /org/freedesktop/login1:org.freedesktop.login1.Manager.ReleaseSession to org.freedesktop.login1.
May 16 16:25:26 x1c (sd-pam)[3036470]: pam_systemd(login:session): Failed to release session: Access denied
May 16 16:25:26 x1c systemd[1]: Stopping session-114.scope...
May 16 16:25:26 x1c systemd[1]: session-114.scope: Deactivated successfully.
May 16 16:25:26 x1c systemd[1]: Stopped session-114.scope.
May 16 16:25:26 x1c systemd[1]: session-c151.scope: Deactivated successfully.
May 16 16:25:26 x1c systemd-logind[1513]: Session c151 logged out. Waiting for processes to exit.
May 16 16:25:26 x1c systemd-logind[1513]: Removed session c151.
After:
May 16 17:02:15 x1c systemd[1]: run-u24770.service: Deactivated successfully.
May 16 17:02:15 x1c systemd[1]: Stopping session-115.scope...
May 16 17:02:15 x1c systemd[1]: session-c153.scope: Deactivated successfully.
May 16 17:02:15 x1c systemd[1]: session-115.scope: Deactivated successfully.
May 16 17:02:15 x1c systemd[1]: Stopped session-115.scope.
May 16 17:02:15 x1c systemd-logind[1513]: Session c153 logged out. Waiting for processes to exit.
May 16 17:02:15 x1c systemd-logind[1513]: Removed session c153.
Edit: this seems to also fix https://github.com/systemd/systemd/issues/8598 .
It seems that with the call to ReleaseSession, we wait for the pam session
close hooks to finish. I inserted a 'sleep(10)' after the call to ReleaseSession
in pam_systemd, and things block on that, nothing is killed prematurely.
(cherry picked from commit fc0bb7ccc763ec79efe7a8a58220e9bc80f34f81)
Resolves https://bugzilla.redhat.com/show_bug.cgi?id=2221337 .
(cherry picked from commit 97ad9a336a7f121770e6b74e8411da7278847d4f)
2024-11-30 10:58:42 +00:00
..
2023-09-06 16:06:41 +02:00
2021-10-01 17:27:34 +01:00
2022-10-26 08:39:34 +02:00
2022-10-26 08:39:34 +02:00
2022-07-04 19:56:53 +02:00
2023-09-06 14:01:13 +02:00
2024-10-09 23:05:19 +01:00
2022-06-28 13:10:05 +02:00
2023-01-18 17:59:43 +00:00
2022-10-26 08:39:34 +02:00
2022-10-26 08:39:34 +02:00
2022-10-26 08:39:34 +02:00
2024-04-25 20:06:35 +02:00
2023-09-06 14:45:17 +02:00
2023-04-05 20:55:15 +02:00
2024-04-25 20:06:35 +02:00
2024-04-25 20:06:35 +02:00
2024-04-25 20:06:35 +02:00
2020-11-09 13:23:58 +09:00
2024-11-30 10:58:42 +00:00
2023-07-04 22:56:59 +02:00
2021-07-12 12:09:20 +01:00
2023-11-09 14:45:42 +00:00
2024-04-25 20:06:35 +02:00
2023-02-06 09:19:04 +01:00
2024-10-09 23:05:19 +01:00
2022-10-26 08:39:34 +02:00
2023-11-09 14:45:42 +00:00
2020-11-09 13:23:58 +09:00
2020-12-16 10:54:57 +01:00
2022-11-16 00:12:16 +01:00
2023-03-29 02:08:18 +01:00
2024-04-25 20:06:35 +02:00
2020-11-09 13:23:58 +09:00
2022-10-26 08:39:34 +02:00
2022-10-26 08:39:34 +02:00
2023-06-08 20:21:59 +01:00
2023-04-20 16:45:57 +02:00
2022-10-26 08:39:34 +02:00
2022-10-26 08:39:34 +02:00
2022-10-26 08:39:34 +02:00
2022-10-26 08:39:34 +02:00
2022-10-26 08:39:34 +02:00
2022-12-17 13:54:16 +00:00
2022-10-26 08:39:34 +02:00
2021-06-14 11:16:38 +02:00
2023-08-09 13:51:00 +02:00
2023-11-29 13:45:35 +01:00
2024-11-30 10:58:42 +00:00
2023-11-09 14:45:42 +00:00
2023-03-08 15:32:59 +01:00
2023-05-15 22:53:22 +02:00
2023-03-08 15:32:59 +01:00
2023-05-17 12:25:01 +02:00
2022-01-07 17:37:37 +01:00
2022-09-23 15:10:53 +02:00
2020-12-21 12:39:18 +00:00
2023-05-22 18:05:29 +01:00
2022-08-26 11:15:44 +09:00
2022-08-24 14:50:48 +02:00
2024-07-06 18:17:45 +02:00
2022-06-28 13:10:05 +02:00
2024-11-15 19:06:31 +00:00
2021-10-01 17:27:34 +01:00
2023-05-30 13:05:33 +02:00
2020-11-09 13:23:58 +09:00
2023-06-15 13:32:10 +09:00
2023-07-15 02:56:25 +09:00
2024-04-25 20:06:35 +02:00
2023-01-11 17:12:54 +01:00
2021-05-26 12:45:20 +01:00
2023-05-17 12:25:01 +02:00
2021-07-27 09:43:29 +02:00
2022-10-17 15:10:53 +02:00
2021-06-30 03:51:05 -07:00
2023-11-09 14:45:42 +00:00
2023-06-23 23:38:05 +08:00
2023-07-06 11:59:41 +01:00
2023-06-23 13:46:56 +01:00
2023-04-22 17:41:17 +01:00
2024-11-30 10:58:42 +00:00
2022-07-27 08:41:03 -07:00
2022-05-05 11:48:22 +02:00
2022-08-11 09:53:55 +02:00
2024-02-28 00:15:39 +00:00
2024-04-25 20:06:35 +02:00
2024-10-09 23:05:19 +01:00
2022-05-05 11:48:22 +02:00
2024-10-09 23:05:19 +01:00
2024-01-24 22:45:52 +00:00
2024-01-24 22:45:52 +00:00
2024-04-25 20:06:35 +02:00
2024-04-25 20:06:35 +02:00
2022-12-07 10:26:31 +01:00
2023-03-30 18:55:55 +01:00
2023-03-30 18:29:49 +01:00
2022-07-04 19:56:53 +02:00
2024-08-19 16:52:18 +02:00
2023-06-16 10:20:15 +01:00
2023-07-19 15:13:01 +02:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2023-03-08 15:32:59 +01:00
2023-04-25 12:24:25 +01:00
2023-04-25 12:24:25 +01:00
2023-04-25 12:24:25 +01:00
2023-04-25 12:24:25 +01:00
2023-03-30 18:55:55 +01:00
2020-11-17 11:13:10 +01:00
2020-11-12 17:10:32 +09:00
2023-04-25 12:24:25 +01:00
2022-08-23 09:24:44 +02:00
2020-11-09 13:23:58 +09:00
2023-04-22 17:41:17 +01:00
2023-04-25 12:24:25 +01:00
2023-04-25 12:24:25 +01:00
2023-09-27 11:22:14 +02:00
2024-04-25 20:06:35 +02:00
2022-10-11 16:59:00 +02:00
2020-11-09 13:23:58 +09:00
2023-06-14 10:23:56 +02:00
2023-07-02 11:10:12 +01:00
2023-04-25 12:24:25 +01:00
2023-04-25 12:24:25 +01:00
2020-11-12 17:10:36 +09:00
2023-04-25 12:24:25 +01:00
2023-04-25 12:24:25 +01:00
2024-10-09 23:05:19 +01:00
2022-06-28 13:10:05 +02:00
2022-06-28 13:10:05 +02:00
2022-06-28 13:10:05 +02:00
2022-06-28 13:10:05 +02:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2022-06-30 10:55:39 +02:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2020-11-12 17:10:32 +09:00
2023-02-09 14:30:43 +01:00
2022-04-12 15:33:05 +02:00
2023-04-04 15:18:00 +02:00
2020-11-09 13:23:58 +09:00
2023-07-02 11:10:12 +01:00
2022-06-30 10:35:27 +02:00
2022-01-11 10:47:31 +00:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2023-04-25 12:24:25 +01:00
2022-10-11 16:59:00 +02:00
2020-11-12 17:10:36 +09:00
2021-01-04 11:01:17 +00:00
2023-04-25 12:24:25 +01:00
2020-11-12 17:10:32 +09:00
2021-02-20 13:44:02 +09:00
2021-03-07 02:54:33 +09:00
2021-02-21 20:26:51 +01:00
2020-11-12 17:10:32 +09:00
2023-04-25 12:24:25 +01:00
2023-04-25 12:24:25 +01:00
2023-04-25 12:24:25 +01:00
2023-04-25 12:24:25 +01:00
2021-06-30 23:33:00 +09:00
2020-11-09 13:23:58 +09:00
2021-07-10 13:19:50 +01:00
2023-04-25 12:24:25 +01:00
2023-04-25 12:24:25 +01:00
2023-04-25 12:24:25 +01:00
2020-11-09 13:23:58 +09:00
2022-04-12 15:33:05 +02:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2023-04-25 12:24:25 +01:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2020-11-12 17:10:36 +09:00
2023-06-14 10:23:56 +02:00
2022-04-04 18:25:18 +02:00
2022-10-11 16:59:00 +02:00
2023-04-25 12:24:25 +01:00
2023-04-25 12:24:25 +01:00
2023-04-25 12:24:25 +01:00
2024-04-25 20:06:35 +02:00
2023-04-25 12:24:25 +01:00
2023-04-25 12:24:25 +01:00
2023-06-14 10:23:56 +02:00
2023-04-25 12:24:25 +01:00
2023-04-25 12:24:25 +01:00
2022-10-11 16:59:00 +02:00
2023-06-14 10:23:56 +02:00
2023-04-25 12:24:25 +01:00
2023-04-25 12:24:25 +01:00
2023-04-25 12:24:25 +01:00
2020-11-12 17:10:36 +09:00
2023-04-25 12:24:25 +01:00
2023-04-25 12:24:25 +01:00
2020-11-09 13:23:58 +09:00
2023-04-25 12:24:25 +01:00
2020-11-09 13:23:58 +09:00
2023-04-25 12:24:25 +01:00
2023-04-25 12:24:25 +01:00
2023-07-02 11:10:12 +01:00
2023-05-24 10:52:08 +02:00
2020-11-12 17:10:36 +09:00
2022-04-12 15:33:05 +02:00
2023-07-02 11:10:12 +01:00
2020-11-12 17:10:36 +09:00
2020-11-12 17:10:32 +09:00
2022-05-27 09:40:54 -04:00
2023-06-22 12:34:00 +01:00
2021-08-20 11:09:48 +02:00
2023-07-02 11:10:12 +01:00
2023-03-08 15:32:59 +01:00
2020-11-09 13:23:58 +09:00
2022-10-11 16:59:00 +02:00
2020-11-09 13:23:58 +09:00
2024-04-25 20:06:35 +02:00
2020-11-09 13:23:58 +09:00
2023-04-25 12:24:25 +01:00
2021-02-16 22:16:17 +01:00
2023-02-08 13:42:30 +01:00
2023-07-02 11:10:12 +01:00
2020-11-09 13:23:58 +09:00
2020-11-12 17:10:36 +09:00
2023-06-15 20:52:45 +02:00
2023-07-12 10:14:50 +09:00
2023-06-01 20:25:21 +01:00
2021-02-25 05:54:11 +09:00
2024-04-25 20:06:35 +02:00
2022-10-11 16:59:00 +02:00
2023-11-09 14:45:42 +00:00
2023-06-14 10:23:56 +02:00
2020-11-09 13:23:58 +09:00
2024-04-25 20:06:35 +02:00
2023-06-28 21:55:33 +02:00
2023-01-20 12:18:05 +00:00
2020-11-12 17:10:32 +09:00
2023-06-07 09:33:36 +01:00
2023-09-27 11:22:14 +02:00
2023-06-14 10:23:56 +02:00
2022-10-26 08:39:34 +02:00
2022-10-26 08:39:34 +02:00
2023-05-15 22:53:22 +02:00
2023-05-15 22:53:22 +02:00
2023-05-15 22:53:22 +02:00
2023-05-15 22:53:22 +02:00
2023-07-02 11:10:12 +01:00
2023-05-15 22:53:22 +02:00
2023-05-15 22:53:22 +02:00
2023-05-15 22:53:22 +02:00
2023-05-15 22:53:22 +02:00
2022-10-26 08:39:34 +02:00
2022-10-07 17:54:31 +02:00
2023-12-22 13:07:51 +01:00
2021-02-19 14:05:42 +09:00
2023-06-05 14:23:54 +09:00
2022-04-11 13:51:28 +02:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2023-04-13 21:33:48 +01:00
2024-10-09 23:05:19 +01:00
2023-06-05 12:21:28 +02:00
2024-01-24 22:45:52 +00:00
2020-11-09 13:23:58 +09:00
2023-06-08 14:09:18 +02:00
2020-11-09 13:23:58 +09:00
2023-07-14 15:56:29 +01:00
2020-11-09 13:23:58 +09:00
2023-03-10 11:41:03 +01:00
2024-04-25 20:06:35 +02:00
2020-11-09 13:23:58 +09:00
2023-05-17 12:25:01 +02:00
2023-05-17 12:25:01 +02:00
2022-08-23 12:14:58 +02:00
2023-03-14 18:03:32 +01:00
2023-11-09 14:45:42 +00:00
2023-11-09 14:45:42 +00:00
2023-11-29 13:30:12 +01:00
2023-11-09 14:45:42 +00:00
2023-07-06 11:59:41 +01:00
2021-05-07 21:36:27 +01:00
2022-08-23 12:14:58 +02:00
2020-11-09 13:23:58 +09:00
2024-08-19 16:52:18 +02:00
2023-09-27 11:22:34 +02:00
2021-05-19 10:25:26 +09:00
2020-11-09 13:23:58 +09:00
2024-01-24 22:45:52 +00:00
2023-08-09 13:51:00 +02:00
2023-11-09 14:45:42 +00:00
2023-07-04 23:11:03 +02:00
2023-11-09 14:45:42 +00:00
2024-04-25 20:06:35 +02:00
2024-04-25 20:06:35 +02:00
2020-11-09 13:23:58 +09:00
2020-12-16 10:54:57 +01:00
2020-11-09 13:23:58 +09:00
2023-07-06 11:59:41 +01:00
2021-04-30 16:55:50 +09:00
2023-11-09 14:45:42 +00:00
2020-11-09 13:23:58 +09:00
2023-01-11 17:12:54 +01:00
2022-07-04 19:56:53 +02:00
2022-01-12 16:05:59 +01:00
2023-04-04 19:52:04 +01:00
2023-07-04 18:47:54 +01:00
2024-04-25 20:06:35 +02:00
2020-11-09 13:23:58 +09:00
2023-09-06 16:06:41 +02:00
2020-11-09 13:23:58 +09:00
2023-04-05 20:55:15 +02:00
2022-05-21 14:28:03 +02:00
2023-03-06 07:15:29 +09:00
2023-06-30 17:17:56 +01:00
2022-09-20 16:48:50 +02:00
2023-04-07 16:33:46 +02:00
2023-03-21 19:00:00 +09:00
2022-01-28 12:52:52 +00:00
2022-09-23 15:10:53 +02:00
2023-05-17 12:25:01 +02:00
2024-11-15 19:06:31 +00:00
2023-01-11 17:12:54 +01:00
2024-08-19 16:52:18 +02:00
2023-05-17 12:25:01 +02:00
2023-01-11 17:12:54 +01:00
2023-06-02 18:43:10 +02:00
2021-01-29 08:42:39 +01:00
2020-11-09 13:23:58 +09:00
2023-04-25 17:05:28 +02:00
2021-03-12 11:22:58 +01:00
2022-09-20 16:48:50 +02:00
2023-06-05 19:11:41 +01:00
2024-01-24 22:45:52 +00:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2024-05-27 23:48:35 +02:00
2023-05-17 11:18:26 +02:00
2020-11-09 13:23:58 +09:00
2024-04-25 20:06:35 +02:00
2023-09-06 14:45:17 +02:00
2022-02-04 17:43:44 +00:00
2023-11-09 14:45:42 +00:00
2021-07-07 11:08:21 +02:00
2024-01-24 22:45:52 +00:00
2023-05-16 18:43:21 +01:00
2023-04-25 17:40:41 +02:00
2024-08-19 16:52:18 +02:00
2023-04-05 20:55:15 +02:00
2023-07-04 22:56:59 +02:00
2023-06-28 10:39:06 +01:00
2020-12-28 10:52:33 +01:00
2024-04-25 20:06:35 +02:00
2023-06-12 14:29:25 +01:00
2024-06-25 14:55:16 +02:00
2021-05-31 19:22:51 +02:00
2020-11-09 13:23:58 +09:00
2021-12-16 09:56:13 +01:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2023-03-24 15:43:04 +01:00
2024-01-24 22:45:52 +00:00
2023-07-02 11:10:12 +01:00
2022-07-04 19:56:53 +02:00
2023-01-11 17:12:54 +01:00
2022-01-14 16:20:45 +09:00
2022-05-26 14:29:50 +02:00
2021-09-29 22:18:38 +01:00
2021-06-29 10:44:18 +02:00
2021-05-19 10:25:26 +09:00
2024-07-06 18:17:45 +02:00
2023-07-06 12:20:04 +01:00
2023-04-20 21:54:59 +02:00
2024-05-09 16:39:34 +02:00
2022-10-01 16:58:48 +02:00
2024-01-24 22:45:52 +00:00
2023-06-02 18:43:10 +02:00
2023-11-09 14:45:42 +00:00
2023-07-06 11:59:41 +01:00
2024-05-09 16:39:34 +02:00
2023-07-27 09:54:43 +01:00
2023-04-25 17:40:41 +02:00
2024-11-15 19:06:31 +00:00
2023-04-14 20:27:59 +01:00
2024-07-24 20:11:48 +01:00
2022-12-13 15:34:46 +01:00
2024-11-15 19:06:31 +00:00
2022-05-21 14:28:03 +02:00
2024-04-25 20:06:35 +02:00
2024-10-09 23:05:19 +01:00
2021-09-27 09:19:02 +02:00
2022-12-21 13:31:09 +09:00
2023-07-04 23:11:03 +02:00
2023-05-30 13:41:24 +02:00
2023-06-14 10:23:56 +02:00
2023-06-15 20:52:45 +02:00
2024-07-24 20:11:48 +01:00
2024-10-09 23:05:19 +01:00
2023-06-14 10:23:56 +02:00
2021-03-31 10:46:22 +02:00
2023-02-15 16:03:28 +01:00
2020-11-09 13:23:58 +09:00
2023-03-08 15:32:59 +01:00
2021-09-24 18:35:42 +01:00
2021-08-09 21:06:28 +02:00
2024-07-06 18:17:45 +02:00
2023-02-06 09:19:04 +01:00
2020-11-09 13:23:58 +09:00
2020-11-12 17:10:32 +09:00
2020-11-12 17:10:32 +09:00
2020-11-12 17:10:32 +09:00
2023-01-16 18:27:15 +09:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2020-11-09 13:23:58 +09:00
2021-04-12 13:03:26 +02:00
2024-02-28 00:15:39 +00:00
2023-06-05 11:37:26 +09:00
2023-06-14 13:18:00 +02:00
2024-07-24 20:11:48 +01:00
2024-10-09 23:05:19 +01:00
2020-12-16 17:21:48 +01:00
2020-11-09 13:23:58 +09:00
2022-02-23 08:56:03 +01:00
2023-09-06 14:45:17 +02:00
2023-04-13 05:39:49 +02:00
2022-10-26 08:39:34 +02:00
2022-06-28 13:10:05 +02:00
2023-02-06 09:19:04 +01:00