Zbigniew Jędrzejewski-Szmek
fc0bb7ccc7
logind: make ReleaseSession "unprivileged" and allow closing of own session
...
Fixes https://github.com/systemd/systemd/issues/28514 .
Quoting https://github.com/systemd/systemd/issues/28514#issuecomment-1831781486 :
> Whenever PAM is enabled for a service, we set up the PAM session and then
> fork off a process whose only job is to eventually close the PAM session when
> the service dies. That services we run with service privileges, both to
> minimize attack surface and because we want to use PR_SET_DEATHSIG to be get
> a notification via signal whenever the main process dies. But that only works
> if we have the same credentials as that main process.
>
> Now, if pam_systemd runs inside the PAM stack (which it normally does) it's
> session close hook will ask logind to synchronously end the session via a bus
> call. Currently that call is not accessible to unprivileged clients. And
> that's the part we need to relax: allow users to end their own sessions.
The check is implemented in a way that allows the kill if the sender is in
the target session.
I found 'sudo systemctl --user -M "zbyszek@" is-system-running' to
be a convenient reproducer.
Before:
May 16 16:25:26 x1c systemd[1]: run-u24754.service: Deactivated successfully.
May 16 16:25:26 x1c dbus-broker[1489]: A security policy denied :1.24757 to send method call /org/freedesktop/login1:org.freedesktop.login1.Manager.ReleaseSession to org.freedesktop.login1.
May 16 16:25:26 x1c (sd-pam)[3036470]: pam_systemd(login:session): Failed to release session: Access denied
May 16 16:25:26 x1c systemd[1]: Stopping session-114.scope...
May 16 16:25:26 x1c systemd[1]: session-114.scope: Deactivated successfully.
May 16 16:25:26 x1c systemd[1]: Stopped session-114.scope.
May 16 16:25:26 x1c systemd[1]: session-c151.scope: Deactivated successfully.
May 16 16:25:26 x1c systemd-logind[1513]: Session c151 logged out. Waiting for processes to exit.
May 16 16:25:26 x1c systemd-logind[1513]: Removed session c151.
After:
May 16 17:02:15 x1c systemd[1]: run-u24770.service: Deactivated successfully.
May 16 17:02:15 x1c systemd[1]: Stopping session-115.scope...
May 16 17:02:15 x1c systemd[1]: session-c153.scope: Deactivated successfully.
May 16 17:02:15 x1c systemd[1]: session-115.scope: Deactivated successfully.
May 16 17:02:15 x1c systemd[1]: Stopped session-115.scope.
May 16 17:02:15 x1c systemd-logind[1513]: Session c153 logged out. Waiting for processes to exit.
May 16 17:02:15 x1c systemd-logind[1513]: Removed session c153.
Edit: this seems to also fix https://github.com/systemd/systemd/issues/8598 .
It seems that with the call to ReleaseSession, we wait for the pam session
close hooks to finish. I inserted a 'sleep(10)' after the call to ReleaseSession
in pam_systemd, and things block on that, nothing is killed prematurely.
2024-05-20 20:59:15 +02:00
..
2024-04-22 15:16:54 +02:00
2021-10-01 17:27:34 +01:00
2022-10-26 08:39:34 +02:00
2022-10-26 08:39:34 +02:00
2023-12-25 15:51:47 +01:00
2024-01-31 10:32:46 +00:00
2024-05-18 02:51:24 +09:00
2024-04-15 10:40:11 +02:00
2024-03-14 11:34:04 +01:00
2023-12-25 09:15:53 +01:00
2022-10-26 08:39:34 +02:00
2022-10-26 08:39:34 +02:00
2022-10-26 08:39:34 +02:00
2024-04-22 15:16:54 +02:00
2024-03-07 19:14:36 +01:00
2024-04-15 10:40:11 +02:00
2024-03-21 02:49:38 +01:00
2024-04-19 16:38:48 +01:00
2024-04-14 23:41:34 +08:00
2024-03-20 15:24:11 +01:00
2023-07-04 22:56:59 +02:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-04-04 02:30:29 +09:00
2023-09-26 17:03:26 +02:00
2023-12-25 15:51:47 +01:00
2022-10-26 08:39:34 +02:00
2024-05-08 17:14:32 +02:00
2024-03-07 19:14:36 +01:00
2023-12-25 15:51:47 +01:00
2024-01-22 14:39:22 +01:00
2023-03-29 02:08:18 +01:00
2024-04-04 02:30:29 +09:00
2023-12-25 15:51:47 +01:00
2022-10-26 08:39:34 +02:00
2024-03-16 12:52:48 +01:00
2022-10-26 08:39:34 +02:00
2024-05-08 17:14:32 +02:00
2023-12-25 15:51:47 +01:00
2024-04-03 17:58:35 +09:00
2024-04-03 17:58:35 +09:00
2024-04-04 02:30:29 +09:00
2024-04-03 17:58:35 +09:00
2024-04-03 17:58:35 +09:00
2024-03-07 19:14:36 +01:00
2024-04-04 02:30:29 +09:00
2024-03-07 19:14:36 +01:00
2024-05-10 11:43:57 +09:00
2024-04-30 14:19:55 +02:00
2024-04-29 14:34:22 +02:00
2024-03-08 21:26:48 +00:00
2023-12-24 09:23:53 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-01-24 17:54:38 +01:00
2023-12-25 15:51:47 +01:00
2024-04-04 03:23:20 +09:00
2024-01-17 11:30:04 +08:00
2024-03-07 19:14:36 +01:00
2024-01-24 02:19:00 +01:00
2023-12-25 15:51:47 +01:00
2024-03-04 16:12:23 +04:00
2021-10-01 17:27:34 +01:00
2024-04-04 03:23:20 +09:00
2023-12-25 15:51:47 +01:00
2024-04-16 13:31:14 +09:00
2024-04-22 18:44:48 +09:00
2024-04-04 12:18:30 +02:00
2024-04-23 17:03:01 +02:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-03-07 19:14:36 +01:00
2024-03-23 01:05:13 +00:00
2024-04-19 16:02:14 +02:00
2024-03-01 22:29:07 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-05-20 20:59:15 +02:00
2024-05-08 09:56:42 +01:00
2024-01-12 21:43:34 +01:00
2024-01-23 16:27:50 +01:00
2024-04-19 13:25:32 +01:00
2024-04-23 01:42:11 +09:00
2024-04-25 13:40:41 +02:00
2023-12-25 15:51:47 +01:00
2024-01-24 17:54:38 +01:00
2024-01-17 23:59:05 +00:00
2024-04-18 20:56:58 +12:00
2024-05-15 14:19:01 +02:00
2024-04-03 17:58:39 +09:00
2024-04-19 13:25:32 +01:00
2023-12-25 15:51:47 +01:00
2024-04-03 17:58:35 +09:00
2024-04-03 17:58:35 +09:00
2024-03-07 19:14:36 +01:00
2024-03-30 00:08:12 +00:00
2024-04-15 10:40:11 +02:00
2024-03-08 08:25:07 +01:00
2024-05-14 18:12:30 +09:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-04-18 09:45:51 +09:00
2024-04-18 09:45:51 +09:00
2024-04-18 09:45:51 +09:00
2024-04-18 09:45:51 +09:00
2024-04-18 09:45:51 +09:00
2024-04-18 09:45:51 +09:00
2024-04-18 09:45:51 +09:00
2024-04-18 09:45:51 +09:00
2024-04-18 09:45:51 +09:00
2024-04-18 09:45:51 +09:00
2024-04-18 09:45:51 +09:00
2024-04-18 09:45:51 +09:00
2024-04-18 09:45:51 +09:00
2024-04-18 09:45:51 +09:00
2024-04-18 09:45:51 +09:00
2024-04-03 17:58:39 +09:00
2024-04-18 09:45:51 +09:00
2024-04-18 09:45:51 +09:00
2024-04-18 09:45:51 +09:00
2023-12-25 15:51:47 +01:00
2024-04-18 09:45:51 +09:00
2024-04-18 09:45:51 +09:00
2024-04-18 09:45:51 +09:00
2024-04-18 09:45:51 +09:00
2024-04-18 09:45:51 +09:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-04-18 09:45:51 +09:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-23 08:28:57 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-04-18 09:45:51 +09:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-04-03 17:58:35 +09:00
2024-05-08 17:14:32 +02:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-01-26 14:41:20 +00:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-04-20 11:14:32 +02:00
2024-05-07 08:53:58 +02:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-03-01 22:25:42 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-04-18 09:45:51 +09:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-04-20 12:10:42 +02:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-04-17 22:01:53 +02:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-04-17 22:01:53 +02:00
2024-03-14 14:25:52 +08:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-04-27 12:11:13 +02:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-02-14 14:58:37 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-04-04 03:23:20 +09:00
2022-10-26 08:39:34 +02:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-26 13:10:35 +01:00
2024-04-14 23:46:54 +08:00
2023-12-25 15:51:47 +01:00
2022-10-26 08:39:34 +02:00
2023-12-25 15:51:47 +01:00
2024-03-10 16:30:34 +01:00
2024-03-07 19:14:36 +01:00
2024-04-15 10:40:11 +02:00
2023-12-24 09:23:53 +01:00
2023-12-24 10:46:55 +01:00
2023-12-25 15:51:47 +01:00
2023-12-26 08:59:53 +01:00
2023-12-26 08:59:53 +01:00
2024-05-08 17:14:32 +02:00
2023-12-25 15:51:47 +01:00
2024-04-15 10:40:11 +02:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-01-03 09:30:41 +09:00
2024-02-28 15:33:51 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-03-14 16:54:49 +00:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-03-21 23:03:42 +00:00
2024-04-15 10:40:11 +02:00
2024-03-14 14:25:53 +08:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-04-15 10:40:11 +02:00
2024-05-14 18:33:27 +02:00
2023-12-25 15:51:47 +01:00
2024-04-27 12:11:13 +02:00
2024-05-11 19:46:15 +02:00
2023-12-26 13:10:36 +01:00
2024-01-10 03:08:31 +09:00
2024-02-17 11:20:00 +00:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-02-08 20:36:44 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-04-19 18:36:33 +02:00
2024-03-10 16:13:19 +00:00
2024-04-03 22:07:43 +08:00
2024-02-19 11:18:11 +00:00
2023-12-25 15:51:47 +01:00
2023-12-26 13:10:36 +01:00
2024-01-11 17:54:19 +01:00
2024-03-01 22:29:07 +01:00
2023-12-26 13:10:35 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-03-06 09:55:01 +00:00
2024-03-06 09:55:01 +00:00
2024-03-06 09:55:01 +00:00
2024-04-30 14:19:55 +02:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-05-08 11:54:31 +01:00
2023-12-25 15:51:47 +01:00
2024-04-19 05:58:56 -07:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-04-06 16:08:24 +02:00
2024-04-16 12:45:08 +09:00
2024-04-15 10:40:11 +02:00
2023-12-25 15:51:47 +01:00
2024-04-15 10:40:11 +02:00
2024-04-22 15:47:44 +02:00
2024-04-06 16:08:24 +02:00
2023-12-26 13:10:35 +01:00
2024-01-17 11:25:45 +08:00
2024-05-08 13:34:07 +02:00
2024-05-08 13:34:07 +02:00
2023-12-25 15:51:47 +01:00
2024-03-20 15:24:11 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-05-17 15:16:07 +02:00
2023-12-25 15:51:47 +01:00
2024-04-15 10:40:11 +02:00
2024-03-26 13:36:42 +00:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-03-26 13:19:33 +01:00
2024-04-06 02:16:54 +08:00
2024-04-15 10:40:11 +02:00
2024-04-22 15:16:54 +02:00
2024-05-17 16:49:58 +02:00
2024-02-23 12:52:28 +00:00
2024-01-11 16:05:20 +01:00
2023-12-25 15:51:47 +01:00
2024-03-20 15:24:11 +01:00
2024-04-27 12:11:13 +02:00
2024-03-05 12:12:35 -05:00
2024-01-11 12:19:44 +00:00
2024-05-06 10:54:15 +02:00
2023-12-25 15:51:47 +01:00
2024-04-29 14:34:22 +02:00
2023-12-25 15:51:47 +01:00
2024-02-09 17:57:41 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-03-06 21:44:12 +00:00
2023-12-25 15:51:47 +01:00
2024-02-12 13:33:30 +01:00
2024-01-03 13:49:02 +01:00
2024-03-20 15:24:11 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-02-28 15:33:51 +01:00
2024-02-28 15:33:51 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-01-11 12:19:44 +00:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-05-02 19:31:42 +02:00
2023-12-25 15:51:47 +01:00
2024-01-03 18:38:46 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-03-18 13:16:48 +00:00
2023-12-25 15:51:47 +01:00
2024-05-07 22:02:42 +08:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-04-25 01:12:27 +08:00
2023-12-25 15:51:47 +01:00
2024-05-20 11:11:22 +01:00
2024-05-03 11:36:56 +02:00
2024-04-27 12:11:13 +02:00
2024-04-14 23:41:34 +08:00
2024-05-08 17:14:32 +02:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-05-08 13:34:07 +02:00
2024-02-08 20:36:44 +01:00
2024-04-22 15:16:54 +02:00
2024-02-12 16:49:42 +00:00
2024-04-02 14:53:31 +01:00
2024-05-03 11:36:56 +02:00
2024-05-03 11:36:56 +02:00
2024-03-26 13:19:33 +01:00
2024-05-03 11:36:56 +02:00
2023-12-25 15:51:47 +01:00
2024-04-30 14:19:55 +02:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-05-18 02:51:34 +09:00
2024-02-17 11:20:00 +00:00
2024-04-29 14:34:22 +02:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-24 09:32:26 +01:00
2023-12-25 15:51:47 +01:00
2023-12-24 10:46:55 +01:00
2024-03-04 16:12:23 +04:00
2024-03-07 19:14:36 +01:00
2024-04-18 10:53:20 +02:00
2023-09-26 17:03:26 +02:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2023-12-25 15:51:47 +01:00
2024-01-12 05:12:44 +09:00
2024-02-20 13:10:30 +09:00
2024-04-16 09:45:25 +09:00
2023-06-14 13:18:00 +02:00
2024-04-22 20:38:16 +02:00
2024-03-14 11:34:04 +01:00
2024-03-14 11:34:04 +01:00
2024-04-15 10:40:11 +02:00
2024-04-15 10:40:11 +02:00
2023-12-25 15:51:47 +01:00
2024-03-20 15:24:11 +01:00
2024-05-13 19:53:51 +09:00
2024-02-17 11:20:00 +00:00
2024-04-04 02:30:29 +09:00
2022-06-28 13:10:05 +02:00
2023-09-26 17:03:26 +02:00