chiark / gitweb /
core: general cgroup rework
[elogind.git] / src / login / logind-session.c
index 5ea7e260a7d3d0bf2fa4a8e3e45d136927d4c1b0..760425329b70253eb2d8bf1523211cc2143cc471 100644 (file)
@@ -6,16 +6,16 @@
   Copyright 2011 Lennart Poettering
 
   systemd is free software; you can redistribute it and/or modify it
-  under the terms of the GNU General Public License as published by
-  the Free Software Foundation; either version 2 of the License, or
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
   (at your option) any later version.
 
   systemd is distributed in the hope that it will be useful, but
   WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-  General Public License for more details.
+  Lesser General Public License for more details.
 
-  You should have received a copy of the GNU General Public License
+  You should have received a copy of the GNU Lesser General Public License
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 ***/
 
 #include <sys/epoll.h>
 #include <fcntl.h>
 
-#include "logind-session.h"
+#include "systemd/sd-id128.h"
+#include "systemd/sd-messages.h"
 #include "strv.h"
 #include "util.h"
+#include "mkdir.h"
+#include "path-util.h"
 #include "cgroup-util.h"
+#include "logind-session.h"
+#include "fileio.h"
 
-#define IDLE_THRESHOLD_USEC (5*USEC_PER_MINUTE)
-
-Session* session_new(Manager *m, User *u, const char *id) {
+Session* session_new(Manager *m, const char *id) {
         Session *s;
 
         assert(m);
@@ -48,19 +51,16 @@ Session* session_new(Manager *m, User *u, const char *id) {
                 return NULL;
         }
 
-        s->id = file_name_from_path(s->state_file);
+        s->id = path_get_file_name(s->state_file);
 
         if (hashmap_put(m->sessions, s->id, s) < 0) {
-                free(s->id);
+                free(s->state_file);
                 free(s);
                 return NULL;
         }
 
         s->manager = m;
         s->fifo_fd = -1;
-        s->user = u;
-
-        LIST_PREPEND(Session, sessions_by_user, u->sessions, s);
 
         return s;
 }
@@ -86,7 +86,7 @@ void session_free(Session *s) {
         }
 
         if (s->cgroup_path)
-                hashmap_remove(s->manager->cgroups, s->cgroup_path);
+                hashmap_remove(s->manager->session_cgroups, s->cgroup_path);
 
         free(s->cgroup_path);
         strv_free(s->controllers);
@@ -96,26 +96,37 @@ void session_free(Session *s) {
         free(s->remote_host);
         free(s->remote_user);
         free(s->service);
+        free(s->slice);
 
         hashmap_remove(s->manager->sessions, s->id);
-
         session_remove_fifo(s);
 
         free(s->state_file);
         free(s);
 }
 
+void session_set_user(Session *s, User *u) {
+        assert(s);
+        assert(!s->user);
+
+        s->user = u;
+        LIST_PREPEND(Session, sessions_by_user, u->sessions, s);
+}
+
 int session_save(Session *s) {
-        FILE *f;
+        _cleanup_fclose_ FILE *f = NULL;
+        _cleanup_free_ char *temp_path = NULL;
         int r = 0;
-        char *temp_path;
 
         assert(s);
 
+        if (!s->user)
+                return -ESTALE;
+
         if (!s->started)
                 return 0;
 
-        r = safe_mkdir("/run/systemd/sessions", 0755, 0, 0);
+        r = mkdir_safe_label("/run/systemd/sessions", 0755, 0, 0);
         if (r < 0)
                 goto finish;
 
@@ -132,73 +143,64 @@ int session_save(Session *s) {
                 "UID=%lu\n"
                 "USER=%s\n"
                 "ACTIVE=%i\n"
+                "STATE=%s\n"
                 "REMOTE=%i\n"
                 "KILL_PROCESSES=%i\n",
                 (unsigned long) s->user->uid,
                 s->user->name,
                 session_is_active(s),
+                session_state_to_string(session_get_state(s)),
                 s->remote,
                 s->kill_processes);
 
         if (s->type >= 0)
-                fprintf(f,
-                        "TYPE=%s\n",
-                        session_type_to_string(s->type));
+                fprintf(f, "TYPE=%s\n", session_type_to_string(s->type));
+
+        if (s->class >= 0)
+                fprintf(f, "CLASS=%s\n", session_class_to_string(s->class));
 
         if (s->cgroup_path)
-                fprintf(f,
-                        "CGROUP=%s\n",
-                        s->cgroup_path);
+                fprintf(f, "CGROUP=%s\n", s->cgroup_path);
 
         if (s->fifo_path)
-                fprintf(f,
-                        "FIFO=%s\n",
-                        s->fifo_path);
+                fprintf(f, "FIFO=%s\n", s->fifo_path);
 
         if (s->seat)
-                fprintf(f,
-                        "SEAT=%s\n",
-                        s->seat->id);
+                fprintf(f, "SEAT=%s\n", s->seat->id);
 
         if (s->tty)
-                fprintf(f,
-                        "TTY=%s\n",
-                        s->tty);
+                fprintf(f, "TTY=%s\n", s->tty);
 
         if (s->display)
-                fprintf(f,
-                        "DISPLAY=%s\n",
-                        s->display);
+                fprintf(f, "DISPLAY=%s\n", s->display);
 
         if (s->remote_host)
-                fprintf(f,
-                        "REMOTE_HOST=%s\n",
-                        s->remote_host);
+                fprintf(f, "REMOTE_HOST=%s\n", s->remote_host);
 
         if (s->remote_user)
-                fprintf(f,
-                        "REMOTE_USER=%s\n",
-                        s->remote_user);
+                fprintf(f, "REMOTE_USER=%s\n", s->remote_user);
 
         if (s->service)
-                fprintf(f,
-                        "SERVICE=%s\n",
-                        s->service);
+                fprintf(f, "SERVICE=%s\n", s->service);
+
+        if (s->seat)
+                fprintf(f, "SLICE=%s\n", s->slice);
 
         if (s->seat && seat_can_multi_session(s->seat))
-                fprintf(f,
-                        "VTNR=%i\n",
-                        s->vtnr);
+                fprintf(f, "VTNR=%i\n", s->vtnr);
 
         if (s->leader > 0)
-                fprintf(f,
-                        "LEADER=%lu\n",
-                        (unsigned long) s->leader);
+                fprintf(f, "LEADER=%lu\n", (unsigned long) s->leader);
 
         if (s->audit_id > 0)
+                fprintf(f, "AUDIT=%"PRIu32"\n", s->audit_id);
+
+        if (dual_timestamp_is_set(&s->timestamp))
                 fprintf(f,
-                        "AUDIT=%llu\n",
-                        (unsigned long long) s->audit_id);
+                        "REALTIME=%llu\n"
+                        "MONOTONIC=%llu\n",
+                        (unsigned long long) s->timestamp.realtime,
+                        (unsigned long long) s->timestamp.monotonic);
 
         fflush(f);
 
@@ -208,9 +210,6 @@ int session_save(Session *s) {
                 unlink(temp_path);
         }
 
-        fclose(f);
-        free(temp_path);
-
 finish:
         if (r < 0)
                 log_error("Failed to save session data for %s: %s", s->id, strerror(-r));
@@ -219,13 +218,17 @@ finish:
 }
 
 int session_load(Session *s) {
-        char *remote = NULL,
+        _cleanup_free_ char *remote = NULL,
                 *kill_processes = NULL,
                 *seat = NULL,
                 *vtnr = NULL,
                 *leader = NULL,
                 *audit_id = NULL,
-                *type = NULL;
+                *type = NULL,
+                *class = NULL,
+                *uid = NULL,
+                *realtime = NULL,
+                *monotonic = NULL;
 
         int k, r;
 
@@ -242,13 +245,44 @@ int session_load(Session *s) {
                            "REMOTE_HOST",    &s->remote_host,
                            "REMOTE_USER",    &s->remote_user,
                            "SERVICE",        &s->service,
+                           "SLICE",          &s->slice,
                            "VTNR",           &vtnr,
                            "LEADER",         &leader,
                            "TYPE",           &type,
+                           "CLASS",          &class,
+                           "UID",            &uid,
+                           "REALTIME",       &realtime,
+                           "MONOTONIC",      &monotonic,
                            NULL);
 
-        if (r < 0)
-                goto finish;
+        if (r < 0) {
+                log_error("Failed to read %s: %s", s->state_file, strerror(-r));
+                return r;
+        }
+
+        if (!s->user) {
+                uid_t u;
+                User *user;
+
+                if (!uid) {
+                        log_error("UID not specified for session %s", s->id);
+                        return -ENOENT;
+                }
+
+                r = parse_uid(uid, &u);
+                if (r < 0)  {
+                        log_error("Failed to parse UID value %s for session %s.", uid, s->id);
+                        return r;
+                }
+
+                user = hashmap_get(s->manager->users, ULONG_TO_PTR((unsigned long) u));
+                if (!user) {
+                        log_error("User of session %s not known.", s->id);
+                        return -ENOENT;
+                }
+
+                session_set_user(s, user);
+        }
 
         if (remote) {
                 k = parse_boolean(remote);
@@ -279,14 +313,9 @@ int session_load(Session *s) {
         }
 
         if (leader) {
-                pid_t pid;
-
-                k = parse_pid(leader, &pid);
-                if (k >= 0 && pid >= 1) {
-                        s->leader = pid;
-
-                        audit_session_from_pid(pid, &s->audit_id);
-                }
+                k = parse_pid(leader, &s->leader);
+                if (k >= 0)
+                        audit_session_from_pid(s->leader, &s->audit_id);
         }
 
         if (type) {
@@ -297,6 +326,14 @@ int session_load(Session *s) {
                         s->type = t;
         }
 
+        if (class) {
+                SessionClass c;
+
+                c = session_class_from_string(class);
+                if (c >= 0)
+                        s->class = c;
+        }
+
         if (s->fifo_path) {
                 int fd;
 
@@ -310,14 +347,17 @@ int session_load(Session *s) {
                         close_nointr_nofail(fd);
         }
 
+        if (realtime) {
+                unsigned long long l;
+                if (sscanf(realtime, "%llu", &l) > 0)
+                        s->timestamp.realtime = l;
+        }
 
-finish:
-        free(remote);
-        free(kill_processes);
-        free(seat);
-        free(vtnr);
-        free(leader);
-        free(audit_id);
+        if (monotonic) {
+                unsigned long long l;
+                if (sscanf(monotonic, "%llu", &l) > 0)
+                        s->timestamp.monotonic = l;
+        }
 
         return r;
 }
@@ -326,6 +366,7 @@ int session_activate(Session *s) {
         int r;
 
         assert(s);
+        assert(s->user);
 
         if (s->vtnr < 0)
                 return -ENOTSUP;
@@ -361,26 +402,27 @@ static int session_link_x11_socket(Session *s) {
 
         k = strspn(s->display+1, "0123456789");
         f = new(char, sizeof("/tmp/.X11-unix/X") + k);
-        if (!f) {
-                log_error("Out of memory");
-                return -ENOMEM;
-        }
+        if (!f)
+                return log_oom();
 
         c = stpcpy(f, "/tmp/.X11-unix/X");
         memcpy(c, s->display+1, k);
         c[k] = 0;
 
         if (access(f, F_OK) < 0) {
-                log_warning("Session %s has display %s with nonexisting socket %s.", s->id, s->display, f);
+                log_warning("Session %s has display %s with non-existing socket %s.", s->id, s->display, f);
                 free(f);
                 return -ENOENT;
         }
 
+        /* Note that this cannot be in a subdir to avoid
+         * vulnerabilities since we are privileged but the runtime
+         * path is owned by the user */
+
         t = strappend(s->user->runtime_path, "/X11-display");
         if (!t) {
-                log_error("Out of memory");
                 free(f);
-                return -ENOMEM;
+                return log_oom();
         }
 
         if (link(f, t) < 0) {
@@ -421,20 +463,21 @@ static int session_create_one_group(Session *s, const char *controller, const ch
         int r;
 
         assert(s);
-        assert(controller);
+        assert(s->user);
         assert(path);
 
-        if (s->leader > 0) {
+        if (s->leader > 0)
                 r = cg_create_and_attach(controller, path, s->leader);
-                if (r < 0)
-                        r = cg_create(controller, path);
-        } else
-                r = cg_create(controller, path);
+        else
+                r = -EINVAL;
 
-        if (r < 0)
-                return r;
+        if (r < 0) {
+                r = cg_create(controller, path);
+                if (r < 0)
+                        return r;
+        }
 
-        r = cg_set_task_access(controller, path, 0644, s->user->uid, s->user->gid, -1);
+        r = cg_set_task_access(controller, path, 0644, s->user->uid, s->user->gid);
         if (r >= 0)
                 r = cg_set_group_access(controller, path, 0755, s->user->uid, s->user->gid);
 
@@ -443,7 +486,6 @@ static int session_create_one_group(Session *s, const char *controller, const ch
 
 static int session_create_cgroup(Session *s) {
         char **k;
-        char *p;
         int r;
 
         assert(s);
@@ -451,31 +493,51 @@ static int session_create_cgroup(Session *s) {
         assert(s->user->cgroup_path);
 
         if (!s->cgroup_path) {
-                if (asprintf(&p, "%s/%s", s->user->cgroup_path, s->id) < 0) {
-                        log_error("Out of memory");
-                        return -ENOMEM;
-                }
-        } else
-                p = s->cgroup_path;
+                _cleanup_free_ char *name = NULL, *escaped = NULL;
+
+                name = strappend(s->id, ".session");
+                if (!name)
+                        return log_oom();
+
+                escaped = cg_escape(name);
+                if (!escaped)
+                        return log_oom();
 
-        r = session_create_one_group(s, SYSTEMD_CGROUP_CONTROLLER, p);
+                if (s->slice) {
+                        _cleanup_free_ char *slice = NULL;
+
+                        r = cg_slice_to_path(s->slice, &slice);
+                        if (r < 0)
+                                return r;
+
+                        s->cgroup_path = strjoin(s->manager->cgroup_root, "/", slice, "/", escaped, NULL);
+                } else
+                        s->cgroup_path = strjoin(s->user->cgroup_path, "/", escaped, NULL);
+
+                if (!s->cgroup_path)
+                        return log_oom();
+        }
+
+        if (!s->slice) {
+                s->slice = strdup(s->user->slice);
+                if (!s->slice)
+                        return log_oom();
+        }
+
+        r = session_create_one_group(s, SYSTEMD_CGROUP_CONTROLLER, s->cgroup_path);
         if (r < 0) {
-                log_error("Failed to create "SYSTEMD_CGROUP_CONTROLLER":%s: %s", p, strerror(-r));
-                free(p);
-                s->cgroup_path = NULL;
+                log_error("Failed to create "SYSTEMD_CGROUP_CONTROLLER":%s: %s", s->cgroup_path, strerror(-r));
                 return r;
         }
 
-        s->cgroup_path = p;
-
         STRV_FOREACH(k, s->controllers) {
 
                 if (strv_contains(s->reset_controllers, *k))
                         continue;
 
-                r = session_create_one_group(s, *k, p);
+                r = session_create_one_group(s, *k, s->cgroup_path);
                 if (r < 0)
-                        log_warning("Failed to create %s:%s: %s", *k, p, strerror(-r));
+                        log_warning("Failed to create %s:%s: %s", *k, s->cgroup_path, strerror(-r));
         }
 
         STRV_FOREACH(k, s->manager->controllers) {
@@ -485,9 +547,9 @@ static int session_create_cgroup(Session *s) {
                     strv_contains(s->controllers, *k))
                         continue;
 
-                r = session_create_one_group(s, *k, p);
+                r = session_create_one_group(s, *k, s->cgroup_path);
                 if (r < 0)
-                        log_warning("Failed to create %s:%s: %s", *k, p, strerror(-r));
+                        log_warning("Failed to create %s:%s: %s", *k, s->cgroup_path, strerror(-r));
         }
 
         if (s->leader > 0) {
@@ -508,11 +570,12 @@ static int session_create_cgroup(Session *s) {
                         r = cg_attach(*k, "/", s->leader);
                         if (r < 0)
                                 log_warning("Failed to reset controller %s: %s", *k, strerror(-r));
-
                 }
         }
 
-        hashmap_put(s->manager->cgroups, s->cgroup_path, s);
+        r = hashmap_put(s->manager->session_cgroups, s->cgroup_path, s);
+        if (r < 0)
+                log_warning("Failed to create mapping between cgroup and session");
 
         return 0;
 }
@@ -521,7 +584,9 @@ int session_start(Session *s) {
         int r;
 
         assert(s);
-        assert(s->user);
+
+        if (!s->user)
+                return -ESTALE;
 
         if (s->started)
                 return 0;
@@ -530,8 +595,13 @@ int session_start(Session *s) {
         if (r < 0)
                 return r;
 
-        log_full(s->type == SESSION_TTY || s->type == SESSION_X11 ? LOG_INFO : LOG_DEBUG,
-                 "New session %s of user %s.", s->id, s->user->name);
+        log_struct(s->type == SESSION_TTY || s->type == SESSION_X11 ? LOG_INFO : LOG_DEBUG,
+                   MESSAGE_ID(SD_MESSAGE_SESSION_START),
+                   "SESSION_ID=%s", s->id,
+                   "USER_ID=%s", s->user->name,
+                   "LEADER=%lu", (unsigned long) s->leader,
+                   "MESSAGE=New session %s of user %s.", s->id, s->user->name,
+                   NULL);
 
         /* Create cgroup */
         r = session_create_cgroup(s);
@@ -541,7 +611,8 @@ int session_start(Session *s) {
         /* Create X11 symlink */
         session_link_x11_socket(s);
 
-        dual_timestamp_get(&s->timestamp);
+        if (!dual_timestamp_is_set(&s->timestamp))
+                dual_timestamp_get(&s->timestamp);
 
         if (s->seat)
                 seat_read_active_vt(s->seat);
@@ -601,6 +672,23 @@ static int session_terminate_cgroup(Session *s) {
                         log_error("Failed to kill session cgroup: %s", strerror(-r));
 
         } else {
+                if (s->leader > 0) {
+                        Session *t;
+
+                        /* We still send a HUP to the leader process,
+                         * even if we are not supposed to kill the
+                         * whole cgroup. But let's first check the
+                         * leader still exists and belongs to our
+                         * session... */
+
+                        r = manager_get_session_by_pid(s->manager, s->leader, &t);
+                        if (r > 0 && t == s) {
+                                kill(s->leader, SIGTERM); /* for normal processes */
+                                kill(s->leader, SIGHUP);  /* for shells */
+                                kill(s->leader, SIGCONT); /* in case they are stopped */
+                        }
+                }
+
                 r = cg_is_empty_recursive(SYSTEMD_CGROUP_CONTROLLER, s->cgroup_path, true);
                 if (r < 0)
                         log_error("Failed to check session cgroup: %s", strerror(-r));
@@ -608,19 +696,18 @@ static int session_terminate_cgroup(Session *s) {
                         r = cg_delete(SYSTEMD_CGROUP_CONTROLLER, s->cgroup_path);
                         if (r < 0)
                                 log_error("Failed to delete session cgroup: %s", strerror(-r));
-                } else
-                        r = -EBUSY;
+                }
         }
 
         STRV_FOREACH(k, s->user->manager->controllers)
                 cg_trim(*k, s->cgroup_path, true);
 
-        hashmap_remove(s->manager->cgroups, s->cgroup_path);
+        hashmap_remove(s->manager->session_cgroups, s->cgroup_path);
 
         free(s->cgroup_path);
         s->cgroup_path = NULL;
 
-        return r;
+        return 0;
 }
 
 static int session_unlink_x11_socket(Session *s) {
@@ -636,10 +723,8 @@ static int session_unlink_x11_socket(Session *s) {
         s->user->display = NULL;
 
         t = strappend(s->user->runtime_path, "/X11-display");
-        if (!t) {
-                log_error("Out of memory");
-                return -ENOMEM;
-        }
+        if (!t)
+                return log_oom();
 
         r = unlink(t);
         free(t);
@@ -652,9 +737,17 @@ int session_stop(Session *s) {
 
         assert(s);
 
+        if (!s->user)
+                return -ESTALE;
+
         if (s->started)
-                log_full(s->type == SESSION_TTY || s->type == SESSION_X11 ? LOG_INFO : LOG_DEBUG,
-                         "Removed session %s.", s->id);
+                log_struct(s->type == SESSION_TTY || s->type == SESSION_X11 ? LOG_INFO : LOG_DEBUG,
+                           MESSAGE_ID(SD_MESSAGE_SESSION_STOP),
+                           "SESSION_ID=%s", s->id,
+                           "USER_ID=%s", s->user->name,
+                           "LEADER=%lu", (unsigned long) s->leader,
+                           "MESSAGE=Removed session %s.", s->id,
+                           NULL);
 
         /* Kill cgroup */
         k = session_terminate_cgroup(s);
@@ -671,16 +764,18 @@ int session_stop(Session *s) {
         if (s->started)
                 session_send_signal(s, false);
 
+        s->started = false;
+
         if (s->seat) {
                 if (s->seat->active == s)
                         seat_set_active(s->seat, NULL);
 
                 seat_send_changed(s->seat, "Sessions\0");
+                seat_save(s->seat);
         }
 
         user_send_changed(s->user, "Sessions\0");
-
-        s->started = false;
+        user_save(s->user);
 
         return r;
 }
@@ -694,15 +789,50 @@ bool session_is_active(Session *s) {
         return s->seat->active == s;
 }
 
-int session_get_idle_hint(Session *s, dual_timestamp *t) {
-        char *p;
+static int get_tty_atime(const char *tty, usec_t *atime) {
+        _cleanup_free_ char *p = NULL;
         struct stat st;
-        usec_t u, n;
-        bool b;
-        int k;
+
+        assert(tty);
+        assert(atime);
+
+        if (!path_is_absolute(tty)) {
+                p = strappend("/dev/", tty);
+                if (!p)
+                        return -ENOMEM;
+
+                tty = p;
+        } else if (!path_startswith(tty, "/dev/"))
+                return -ENOENT;
+
+        if (lstat(tty, &st) < 0)
+                return -errno;
+
+        *atime = timespec_load(&st.st_atim);
+        return 0;
+}
+
+static int get_process_ctty_atime(pid_t pid, usec_t *atime) {
+        _cleanup_free_ char *p = NULL;
+        int r;
+
+        assert(pid > 0);
+        assert(atime);
+
+        r = get_ctty(pid, NULL, &p);
+        if (r < 0)
+                return r;
+
+        return get_tty_atime(p, atime);
+}
+
+int session_get_idle_hint(Session *s, dual_timestamp *t) {
+        usec_t atime = 0, n;
+        int r;
 
         assert(s);
 
+        /* Explicit idle hint is set */
         if (s->idle_hint) {
                 if (t)
                         *t = s->idle_hint_timestamp;
@@ -710,41 +840,65 @@ int session_get_idle_hint(Session *s, dual_timestamp *t) {
                 return s->idle_hint;
         }
 
-        if (isempty(s->tty))
+        /* Graphical sessions should really implement a real
+         * idle hint logic */
+        if (s->display)
                 goto dont_know;
 
-        if (s->tty[0] != '/') {
-                p = strappend("/dev/", s->tty);
-                if (!p)
-                        return -ENOMEM;
-        } else
-                p = NULL;
+        /* For sessions with an explicitly configured tty, let's check
+         * its atime */
+        if (s->tty) {
+                r = get_tty_atime(s->tty, &atime);
+                if (r >= 0)
+                        goto found_atime;
+        }
 
-        if (!startswith(p ? p : s->tty, "/dev/")) {
-                free(p);
-                goto dont_know;
+        /* For sessions with a leader but no explicitly configured
+         * tty, let's check the controlling tty of the leader */
+        if (s->leader > 0) {
+                r = get_process_ctty_atime(s->leader, &atime);
+                if (r >= 0)
+                        goto found_atime;
         }
 
-        k = lstat(p ? p : s->tty, &st);
-        free(p);
+        /* For other TTY sessions, let's find the most recent atime of
+         * the ttys of any of the processes of the session */
+        if (s->cgroup_path) {
+                _cleanup_fclose_ FILE *f = NULL;
 
-        if (k < 0)
-                goto dont_know;
+                if (cg_enumerate_processes(SYSTEMD_CGROUP_CONTROLLER, s->cgroup_path, &f) >= 0) {
+                        pid_t pid;
 
-        u = timespec_load(&st.st_atim);
-        n = now(CLOCK_REALTIME);
-        b = u + IDLE_THRESHOLD_USEC < n;
+                        atime = 0;
+                        while (cg_read_pid(f, &pid) > 0) {
+                                usec_t a;
 
-        if (t)
-                dual_timestamp_from_realtime(t, u + b ? IDLE_THRESHOLD_USEC : 0);
+                                if (get_process_ctty_atime(pid, &a) >= 0)
+                                        if (atime == 0 || atime < a)
+                                                atime = a;
+                        }
 
-        return b;
+                        if (atime != 0)
+                                goto found_atime;
+                }
+        }
 
 dont_know:
         if (t)
                 *t = s->idle_hint_timestamp;
 
         return 0;
+
+found_atime:
+        if (t)
+                dual_timestamp_from_realtime(t, atime);
+
+        n = now(CLOCK_REALTIME);
+
+        if (s->manager->idle_action_usec <= 0)
+                return 0;
+
+        return atime + s->manager->idle_action_usec <= n;
 }
 
 void session_set_idle_hint(Session *s, bool b) {
@@ -785,7 +939,7 @@ int session_create_fifo(Session *s) {
 
         /* Create FIFO */
         if (!s->fifo_path) {
-                r = safe_mkdir("/run/systemd/sessions", 0755, 0, 0);
+                r = mkdir_safe_label("/run/systemd/sessions", 0755, 0, 0);
                 if (r < 0)
                         return r;
 
@@ -798,19 +952,18 @@ int session_create_fifo(Session *s) {
 
         /* Open reading side */
         if (s->fifo_fd < 0) {
-                struct epoll_event ev;
+                struct epoll_event ev = {};
 
                 s->fifo_fd = open(s->fifo_path, O_RDONLY|O_CLOEXEC|O_NDELAY);
                 if (s->fifo_fd < 0)
                         return -errno;
 
-                r = hashmap_put(s->manager->fifo_fds, INT_TO_PTR(s->fifo_fd + 1), s);
+                r = hashmap_put(s->manager->session_fds, INT_TO_PTR(s->fifo_fd + 1), s);
                 if (r < 0)
                         return r;
 
-                zero(ev);
                 ev.events = 0;
-                ev.data.u32 = FD_FIFO_BASE + s->fifo_fd;
+                ev.data.u32 = FD_OTHER_BASE + s->fifo_fd;
 
                 if (epoll_ctl(s->manager->epoll_fd, EPOLL_CTL_ADD, s->fifo_fd, &ev) < 0)
                         return -errno;
@@ -828,10 +981,13 @@ void session_remove_fifo(Session *s) {
         assert(s);
 
         if (s->fifo_fd >= 0) {
-                assert_se(hashmap_remove(s->manager->fifo_fds, INT_TO_PTR(s->fifo_fd + 1)) == s);
+                assert_se(hashmap_remove(s->manager->session_fds, INT_TO_PTR(s->fifo_fd + 1)) == s);
                 assert_se(epoll_ctl(s->manager->epoll_fd, EPOLL_CTL_DEL, s->fifo_fd, NULL) == 0);
                 close_nointr_nofail(s->fifo_fd);
                 s->fifo_fd = -1;
+
+                session_save(s);
+                user_save(s->user);
         }
 
         if (s->fifo_path) {
@@ -849,6 +1005,9 @@ int session_check_gc(Session *s, bool drop_not_started) {
         if (drop_not_started && !s->started)
                 return 0;
 
+        if (!s->user)
+                return 0;
+
         if (s->fifo_fd >= 0) {
 
                 r = pipe_eof(s->fifo_fd);
@@ -882,9 +1041,21 @@ void session_add_to_gc_queue(Session *s) {
         s->in_gc_queue = true;
 }
 
+SessionState session_get_state(Session *s) {
+        assert(s);
+
+        if (s->fifo_fd < 0)
+                return SESSION_CLOSING;
+
+        if (session_is_active(s))
+                return SESSION_ACTIVE;
+
+        return SESSION_ONLINE;
+}
+
 int session_kill(Session *s, KillWho who, int signo) {
+        _cleanup_set_free_ Set *pid_set = NULL;
         int r = 0;
-        Set *pid_set = NULL;
 
         assert(s);
 
@@ -903,7 +1074,7 @@ int session_kill(Session *s, KillWho who, int signo) {
 
                 pid_set = set_new(trivial_hash_func, trivial_compare_func);
                 if (!pid_set)
-                        return -ENOMEM;
+                        return log_oom();
 
                 if (s->leader > 0) {
                         q = set_put(pid_set, LONG_TO_PTR(s->leader));
@@ -917,12 +1088,17 @@ int session_kill(Session *s, KillWho who, int signo) {
                                 r = q;
         }
 
-        if (pid_set)
-                set_free(pid_set);
-
         return r;
 }
 
+static const char* const session_state_table[_SESSION_TYPE_MAX] = {
+        [SESSION_ONLINE] = "online",
+        [SESSION_ACTIVE] = "active",
+        [SESSION_CLOSING] = "closing"
+};
+
+DEFINE_STRING_TABLE_LOOKUP(session_state, SessionState);
+
 static const char* const session_type_table[_SESSION_TYPE_MAX] = {
         [SESSION_TTY] = "tty",
         [SESSION_X11] = "x11",
@@ -931,6 +1107,15 @@ static const char* const session_type_table[_SESSION_TYPE_MAX] = {
 
 DEFINE_STRING_TABLE_LOOKUP(session_type, SessionType);
 
+static const char* const session_class_table[_SESSION_CLASS_MAX] = {
+        [SESSION_USER] = "user",
+        [SESSION_GREETER] = "greeter",
+        [SESSION_LOCK_SCREEN] = "lock-screen",
+        [SESSION_BACKGROUND] = "background"
+};
+
+DEFINE_STRING_TABLE_LOOKUP(session_class, SessionClass);
+
 static const char* const kill_who_table[_KILL_WHO_MAX] = {
         [KILL_LEADER] = "leader",
         [KILL_ALL] = "all"