summaryrefslogtreecommitdiffstats
path: root/src/login (follow)
Commit message (Collapse)AuthorAgeFilesLines
* tree-wide: make sigprocmask() changes more automaticLennart Poettering2024-09-131-12/+7
| | | | | | | | | | | | | This tries to get rid of most manual sigprocmask() changes, in favour of: 1. The SD_EVENT_SIGNAL_PROCMASK flag to sd_event_add_signal() 2. The sd_event_set_signal_exit() call for handling SIGTERM/SIGINT 3. Move masking of SIGWINCH into ptyfwd, out of nspawn/vmspawn/run And while we are at it get rid of a bunch of event source fields whose lifetime is bound to the sd_event object they belong to anyway, and make use of the "floating" event source feature of sd-event instead.
* shell: define three system credentials we can propagate into shell prompts ↵Lennart Poettering2024-09-091-0/+39
| | | | and welcome messages
* tree-wide: use UTMPX_FILE rather than _PATH_UTMPXLennart Poettering2024-09-061-6/+6
| | | | | | Apparently _PATH_UTMPX is a glibc'ism. UTMPX_FILE is the same thing and what everyone else uses. Since they are otherwise equivalent, let's just switch.
* tree-wide: drop msg argument for DEFINE_CONFIG_PARSE() macro and friendsYu Watanabe2024-09-011-1/+1
| | | | | This makes the macros use log_syntax_parse_error(), hopefully which provides more informative log message in general, and reduces binary size.
* Merge pull request #34096 from YHNdnzj/logind-followup-256Yu Watanabe2024-08-223-5/+18
|\ | | | | logind: two follow-ups
| * logind-session: downgrade user@.service dep to Wants=Mike Yuan2024-08-223-4/+17
| | | | | | | | | | | | | | | | | | | | This partially reverts 52bcc872b5f97a14a9b4e4e383f45bb3066e1643. We explicitly support running without user manager, hence only user-runtime-dir@.service should be required. Fixes #33405
| * logind: DesignatedMaintenanceTime is added in v257 and constantMike Yuan2024-08-221-1/+1
| | | | | | | | | | | | Follow-up for 0e10c3d8724b0a5d07871c9de71565ac91dd55b7 Addresses https://github.com/systemd/systemd/pull/25049#discussion_r1647513862
* | shared/logs-show: introduce journal_browse_prepare()Mike Yuan2024-08-221-6/+2
|/ | | | which combines sigbus_install() and bumping fd limit.
* polkit: add missing period in messagesYu Watanabe2024-08-221-1/+1
|
* Merge pull request #34055 from whot/wip/eviocrevoke-warningsYu Watanabe2024-08-211-4/+5
|\ | | | | Update warnings for failed EVIOCREVOKE invocations
| * logind: warn about EVIOCREVOKE errors other than EINVAL tooPeter Hutterer2024-08-211-1/+3
| | | | | | | | | | | | EINVAL means the kernel doesn't support it, ENODEV means it's already revoked or the device is no longer there which has the same effect anyway. All others - let's print an error to the logs.
| * logind: if EVIOCREVOKE fails, don't try it againPeter Hutterer2024-08-121-3/+2
| | | | | | | | | | Let's assume that if the ioctl fails once with EINVAL, we won't have to try this again.
* | tree-wide: voidify polkit_agent_open_if_enabled()Yu Watanabe2024-08-191-9/+9
|/
* logind: add PreparingForShutdownWithMetadata propertyLuca Boccassi2024-08-051-0/+30
| | | | | | | The PrepareForShutdownWithMetadata signal was added via e4aab5cf1a00bbb73f325f4f785dd4171ccdae77 but a corresponding property was not. A property has to be a single type, so the bool needs to be one of the key/value pairs as 'ba{sv}' is not a valid property.
* login: fix typoYu Watanabe2024-08-021-1/+1
| | | | Follow-up for 0e10c3d8724b0a5d07871c9de71565ac91dd55b7.
* logind: always check for inhibitor locksLuca Boccassi2024-07-256-26/+39
| | | | | | | | | | | | | | | | | | | | | | | Currently inhibitors are bypassed unless an explicit request is made to check for them, or even in that case when the requestor is root or the same uid as the holder of the lock. But in many cases this makes it impractical to rely on inhibitor locks. For example, in Debian there are several convoluted and archaic workarounds that divert systemctl/reboot to some hacky custom scripts to try and enforce blocking accidental reboots, when it's not expected that the requestor will remember to specify the command line option to enable checking for active inhibitor locks. Also in many cases one wants to ensure that locks taken by a user are respected by actions initiated by that same user. Change logind so that inhibitors checks are not skipped in these cases, and systemctl so that locks are checked in order to show a friendly error message rather than "permission denied". Add new block-weak and delay-weak modes that keep the previous behaviour unchanged.
* logind-dbus: check auth. for all inhibitor operationsDavid Tardon2024-07-251-17/+22
| | | | Fixes #33834
* logind-user: take gc_mode into account when reporting user stateMike Yuan2024-07-121-13/+13
| | | | | | | | | | | | | Prompted by #33650 Previously, if a user manually starts user@.service (which is something we support), we'd track it as 'manager' session. However, since user_get_state() ignores all non-pinning sessions, if lingering is not enabled, the user state would always be reported as 'closing', which is spurious. Let's instead take gc_mode into consideration, and ignore non-pinning sessions only if USER_GC_BY_PIN.
* logind-dbus: set gc_mode to USER_GC_BY_PIN when disable lingerTom Yan2024-07-091-1/+4
| | | | | | | The mode switch from any to pin is currently done in create_session(). However, if no (pinning) session is created before (or after) linger is disabled, the user will not be gc'd after that. Therefore, also perform the mode switch when linger is being disabled.
* Merge pull request #33491 from keszybz/allow-interactive-auth-in-inhibitLuca Boccassi2024-06-263-16/+28
|\ | | | | Allow interactive auth in inhibit
| * polkit: allow non-local users to block sleep and shutdownZbigniew Jędrzejewski-Szmek2024-06-261-2/+2
| | | | | | | | | | | | | | | | We already had 'auth_admin_keep' for org.freedesktop.login1.reboot and similar actions. If a user is allowed to perform an action, I think they should be allowed to _block_ the same action. Guarding this by auth_admin follows the general principle of not allowing fully unprivileged users to have too much say over the machine.
| * inhibit: add --no-ask-password option and allow interactive polkit authZbigniew Jędrzejewski-Szmek2024-06-261-13/+25
| | | | | | | | | | | | | | | | It seems entirely reasonable to make a policy which e.g. allows block operations for interactive users after authentication. The tool should support this, so that more complicated local policies can be used. Related to https://github.com/systemd/systemd/pull/30307.
| * Rename spawn-polkit-agent.c to just polkit-agent.cZbigniew Jędrzejewski-Szmek2024-06-261-1/+1
| | | | | | | | | | The functions in the file were *not* using the spawn prefix, and the prefix seems completely unnecessary.
* | login: Add a new SecureAttentionKey dbus signal when Ctrl+Alt+Shift+Esc is ↵nerdopolis2024-06-2410-39/+217
| | | | | | | | pressed
* | logind: implement maintenance timeLudwig Nussel2024-06-205-1/+57
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Update frameworks that work automatically in the background occasionally need to schedule reboots. Systemd-logind already provides a nice mechanism to schedule shutdowns, send notfications and block logins short before the time. Systemd has a framework for calendar events, so we may conveniently use logind to define a maintenance time for reboots. The existing ScheduleShutdown DBus method in logind expects a usec_t with an absolute time. Passing USEC_INFINITY as magic value now tells logind to take the time from the configured maintenance time if set. "shutdown -r" leverages that and uses the maintenance time automatically if configured. The one minute default is still used if nothing was specified. Similarly the new 'auto' setting for the --when parameter of systemctl uses the maintenance time if configured or a one minute timer like the shutdown command.
* | Merge pull request #32868 from keszybz/more-whomificationYu Watanabe2024-06-1913-35/+35
|\ \ | | | | | | Fix confusion between killer and prey
| * | various: move ptr indicator to return valueZbigniew Jędrzejewski-Szmek2024-06-196-6/+6
| | |
| * | various: move const ptr indicator to return valueZbigniew Jędrzejewski-Szmek2024-06-193-4/+4
| | |
| * | Fix confusion between killer and preyZbigniew Jędrzejewski-Szmek2024-06-196-26/+26
| |/ | | | | | | | | "who" is the entity doing the killing, "whom" is the target. Follow-up for 4ccde410a3fc141c9ddf285f24a22dfea99e0287.
* | login/user-runtime-dir: free ignored sd_bus_error, avoid triggering assertionMike Yuan2024-06-181-5/+16
| | | | | | | | Fixes #33388
* | login/user-runtime-dir: use STRLEN where appropriateMike Yuan2024-06-181-3/+3
|/ | | | Also, add missing trailing / to paths used in STRLEN/sizeof.
* logind: tweakletsLennart Poettering2024-06-171-1/+4
|
* libsystemd: turn json.[ch] into a public APILennart Poettering2024-06-122-6/+6
| | | | | | | | | | | | | | | This is preparation for making our Varlink API a public API. Since our Varlink API is built on top of our JSON API we need to make that public first (it's a nice API, but JSON APIs there are already enough, this is purely about the Varlink angle). I made most of the json.h APIs public, and just placed them in sd-json.h. Sometimes I wasn't so sure however, since the underlying data structures would have to be made public too. If in doubt I didn#t risk it, and moved the relevant API to src/libsystemd/sd-json/json-util.h instead (without any sd_* symbol prefixes). This is mostly a giant search/replace patch.
* login: re-used -> reusedYu Watanabe2024-06-111-1/+1
| | | | Suggested by Fossies.
* logind-user: check linger file in user_wants_service_manager tooMike Yuan2024-05-281-1/+4
| | | | | | Follow-up for 5099a50d4398e190387d204f5df81cc176bd33e2 Fixes #33005
* logind-user: add missing assertion for user_check_linger_fileMike Yuan2024-05-282-3/+6
| | | | Also make the function take const User*
* logind: use SD_BUS_ERROR_ACCESS_DENIEDZbigniew Jędrzejewski-Szmek2024-05-211-1/+2
| | | | | | | As requested in post-merge review https://github.com/systemd/systemd/pull/32869#pullrequestreview-2068161094: > NotInControl error is really about session controllers, but this here really > is different.
* logind: make ReleaseSession "unprivileged" and allow closing of own sessionZbigniew Jędrzejewski-Szmek2024-05-202-2/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes https://github.com/systemd/systemd/issues/28514. Quoting https://github.com/systemd/systemd/issues/28514#issuecomment-1831781486: > Whenever PAM is enabled for a service, we set up the PAM session and then > fork off a process whose only job is to eventually close the PAM session when > the service dies. That services we run with service privileges, both to > minimize attack surface and because we want to use PR_SET_DEATHSIG to be get > a notification via signal whenever the main process dies. But that only works > if we have the same credentials as that main process. > > Now, if pam_systemd runs inside the PAM stack (which it normally does) it's > session close hook will ask logind to synchronously end the session via a bus > call. Currently that call is not accessible to unprivileged clients. And > that's the part we need to relax: allow users to end their own sessions. The check is implemented in a way that allows the kill if the sender is in the target session. I found 'sudo systemctl --user -M "zbyszek@" is-system-running' to be a convenient reproducer. Before: May 16 16:25:26 x1c systemd[1]: run-u24754.service: Deactivated successfully. May 16 16:25:26 x1c dbus-broker[1489]: A security policy denied :1.24757 to send method call /org/freedesktop/login1:org.freedesktop.login1.Manager.ReleaseSession to org.freedesktop.login1. May 16 16:25:26 x1c (sd-pam)[3036470]: pam_systemd(login:session): Failed to release session: Access denied May 16 16:25:26 x1c systemd[1]: Stopping session-114.scope... May 16 16:25:26 x1c systemd[1]: session-114.scope: Deactivated successfully. May 16 16:25:26 x1c systemd[1]: Stopped session-114.scope. May 16 16:25:26 x1c systemd[1]: session-c151.scope: Deactivated successfully. May 16 16:25:26 x1c systemd-logind[1513]: Session c151 logged out. Waiting for processes to exit. May 16 16:25:26 x1c systemd-logind[1513]: Removed session c151. After: May 16 17:02:15 x1c systemd[1]: run-u24770.service: Deactivated successfully. May 16 17:02:15 x1c systemd[1]: Stopping session-115.scope... May 16 17:02:15 x1c systemd[1]: session-c153.scope: Deactivated successfully. May 16 17:02:15 x1c systemd[1]: session-115.scope: Deactivated successfully. May 16 17:02:15 x1c systemd[1]: Stopped session-115.scope. May 16 17:02:15 x1c systemd-logind[1513]: Session c153 logged out. Waiting for processes to exit. May 16 17:02:15 x1c systemd-logind[1513]: Removed session c153. Edit: this seems to also fix https://github.com/systemd/systemd/issues/8598. It seems that with the call to ReleaseSession, we wait for the pam session close hooks to finish. I inserted a 'sleep(10)' after the call to ReleaseSession in pam_systemd, and things block on that, nothing is killed prematurely.
* logind: group policy entries by interfaceZbigniew Jędrzejewski-Szmek2024-05-201-8/+8
|
* logind: do not fail creating a session when request is not from a unitLuca Boccassi2024-05-201-4/+2
| | | | | | | | | | | | | | | | | | When running inside an LXC container the 'su' process will not be part of any unit or slice. manager_get_user_by_pid() which was used until v255 (included) does not fail if it cannot find a unit/slice, but simply returns 'not found'. Do the same in manager_get_session_by_pidref(). This was not detected as Semaphore CI does not reboot the testbed before the logind test, so the session is started by the old logind from the base distro, instead of the one being tested. Follow-up for 8494f562c8963d8a936b0598e23eab277ff29374 Follow-up for 5099a50d4398e190387d204f5df81cc176bd33e2 Fixes https://github.com/systemd/systemd/issues/32929
* logind: add one more debug logLuca Boccassi2024-05-201-1/+4
| | | | Helped track down issue with session tracking
* logs-show: drop uid argument from add_matches_for_user_units()Yu Watanabe2024-05-101-10/+8
| | | | | It is always equivalent to getuid(). Let's call getuid() in the function instead.
* pidfd: properly detect if libc offers pidfd syscalls and make use of them thenLennart Poettering2024-05-081-0/+3
| | | | | We never updated the meson checks when glibc finally learned about these syscalls, address that.
* hibernate-util,logind: also differentiate the case of misconfigured resumeMike Yuan2024-05-081-0/+4
|
* hibernate-util,logind: emit a clear error if the specified resume dev is missingMike Yuan2024-05-081-0/+4
| | | | | | | | | Currently, SLEEP_NOT_ENOUGH_SWAP_SPACE (ENOSPC) is returned on all sorts of error conditions. But one important case that's worth differentiating from that is when the resume device is manually specified yet missing. Closes #32644
* reboot-util: Add some basic validation on reboot argumentsDaan De Meyer2024-05-011-0/+3
| | | | Let's only accept valid ASCII and put a size limit on reboot arguments.
* Merge pull request #32547 from YHNdnzj/minor-cleanupMike Yuan2024-04-291-2/+2
|\ | | | | Some cleanups prompted during review
| * pam_systemd_loadkey: add missing PAM_EXTERNMike Yuan2024-04-291-2/+2
| |
* | pam: Setup logging to syslogDaan De Meyer2024-04-292-0/+6
|/ | | | | | | We already log to syslog using pam_syslog() for logs generated directly within our pam plugins. However, any logs generated by our generic logging macros that are invoked within a pam plugin will log to the console. Let's make sure our generic logging macros are set up to log to syslog as well.
* tree-wide: Use log_setup() everywhereDaan De Meyer2024-04-252-5/+2
| | | | | Otherwise the default log target is the console and we won't use the journal socket even if it is available.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-13 10:08:28 +0100