1
1
mirror of https://github.com/systemd/systemd-stable.git synced 2025-04-22 02:50:08 +03:00
Zbigniew Jędrzejewski-Szmek 39f457fe60 logind: make ReleaseSession "unprivileged" and allow closing of own session
Fixes https://github.com/systemd/systemd/issues/28514.

Quoting https://github.com/systemd/systemd/issues/28514#issuecomment-1831781486:
> Whenever PAM is enabled for a service, we set up the PAM session and then
> fork off a process whose only job is to eventually close the PAM session when
> the service dies. That services we run with service privileges, both to
> minimize attack surface and because we want to use PR_SET_DEATHSIG to be get
> a notification via signal whenever the main process dies. But that only works
> if we have the same credentials as that main process.
>
> Now, if pam_systemd runs inside the PAM stack (which it normally does) it's
> session close hook will ask logind to synchronously end the session via a bus
> call. Currently that call is not accessible to unprivileged clients. And
> that's the part we need to relax: allow users to end their own sessions.

The check is implemented in a way that allows the kill if the sender is in
the target session.

I found 'sudo systemctl --user -M "zbyszek@" is-system-running' to
be a convenient reproducer.

Before:
May 16 16:25:26 x1c systemd[1]: run-u24754.service: Deactivated successfully.
May 16 16:25:26 x1c dbus-broker[1489]: A security policy denied :1.24757 to send method call /org/freedesktop/login1:org.freedesktop.login1.Manager.ReleaseSession to org.freedesktop.login1.
May 16 16:25:26 x1c (sd-pam)[3036470]: pam_systemd(login:session): Failed to release session: Access denied
May 16 16:25:26 x1c systemd[1]: Stopping session-114.scope...
May 16 16:25:26 x1c systemd[1]: session-114.scope: Deactivated successfully.
May 16 16:25:26 x1c systemd[1]: Stopped session-114.scope.
May 16 16:25:26 x1c systemd[1]: session-c151.scope: Deactivated successfully.
May 16 16:25:26 x1c systemd-logind[1513]: Session c151 logged out. Waiting for processes to exit.
May 16 16:25:26 x1c systemd-logind[1513]: Removed session c151.
After:
May 16 17:02:15 x1c systemd[1]: run-u24770.service: Deactivated successfully.
May 16 17:02:15 x1c systemd[1]: Stopping session-115.scope...
May 16 17:02:15 x1c systemd[1]: session-c153.scope: Deactivated successfully.
May 16 17:02:15 x1c systemd[1]: session-115.scope: Deactivated successfully.
May 16 17:02:15 x1c systemd[1]: Stopped session-115.scope.
May 16 17:02:15 x1c systemd-logind[1513]: Session c153 logged out. Waiting for processes to exit.
May 16 17:02:15 x1c systemd-logind[1513]: Removed session c153.

Edit: this seems to also fix https://github.com/systemd/systemd/issues/8598.
It seems that with the call to ReleaseSession, we wait for the pam session
close hooks to finish. I inserted a 'sleep(10)' after the call to ReleaseSession
in pam_systemd, and things block on that, nothing is killed prematurely.

(cherry picked from commit fc0bb7ccc763ec79efe7a8a58220e9bc80f34f81)

Resolves https://bugzilla.redhat.com/show_bug.cgi?id=2221337.

(cherry picked from commit 97ad9a336a7f121770e6b74e8411da7278847d4f)
2024-11-30 10:58:42 +00:00
..
2022-06-28 13:10:05 +02:00
2024-04-25 20:06:35 +02:00
2022-11-16 00:12:16 +01:00
2023-08-09 13:51:00 +02:00
2023-05-15 22:53:22 +02:00
2022-06-28 13:10:05 +02:00
2022-12-07 10:26:31 +01:00
2023-07-19 15:13:01 +02:00
2023-04-22 17:41:17 +01:00
2021-01-04 11:01:17 +00:00
2021-06-30 23:33:00 +09:00
2023-03-08 15:32:59 +01:00
2023-05-15 22:53:22 +02:00
2023-05-15 22:53:22 +02:00
2023-05-15 22:53:22 +02:00
2023-05-15 22:53:22 +02:00
2023-07-02 11:10:12 +01:00
2023-05-15 22:53:22 +02:00
2023-05-15 22:53:22 +02:00
2023-05-15 22:53:22 +02:00
2023-05-15 22:53:22 +02:00
2022-08-23 12:14:58 +02:00
2023-03-14 18:03:32 +01:00
2023-07-27 09:54:43 +01:00
2024-04-25 20:06:35 +02:00
2024-07-24 20:11:48 +01:00
2020-12-16 17:21:48 +01:00