pam: always rely on loginuid instead of uid to determine cgroup and XDG_RUNTIME_DIR

[elogind.git] / src / pam-module.c

diff --git a/src/pam-module.c b/src/pam-module.c
index f668c3b37386d59cf6b613a08b14c84e8264930f..bc99684e110702587dd6398995081047c2ee066e 100644 (file)
--- a/src/pam-module.c
+++ b/src/pam-module.c
@@ -1,4 +1,4 @@
-/*-*- Mode: C; c-basic-offset: 8 -*-*/
+/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
 
 /***
   This file is part of systemd.
@@ -128,7 +128,7 @@ static uint64_t get_session_id(int *mode) {
                 r = safe_atou32(s, &u);
                 free(s);
 
-                if (r >= 0 && u != (uint32_t) -1) {
+                if (r >= 0 && u != (uint32_t) -1 && u > 0) {
                         *mode = SESSION_ID_AUDIT;
                         return (uint64_t) u;
                 }
@@ -179,31 +179,49 @@ static int get_user_data(
                 const char **ret_username,
                 struct passwd **ret_pw) {
 
-        const char *username;
-        struct passwd *pw;
+        const char *username = NULL;
+        struct passwd *pw = NULL;
         int r;
+        bool have_loginuid = false;
+        char *s;
 
         assert(handle);
         assert(ret_username);
         assert(ret_pw);
 
-        if ((r = pam_get_user(handle, &username, NULL)) != PAM_SUCCESS) {
-                pam_syslog(handle, LOG_ERR, "Failed to get user name.");
-                return r;
+        if (read_one_line_file("/proc/self/loginuid", &s) >= 0) {
+                uint32_t u;
+
+                r = safe_atou32(s, &u);
+                free(s);
+
+                if (r >= 0 && u != (uint32_t) -1 && u > 0) {
+                        have_loginuid = true;
+                        pw = pam_modutil_getpwuid(handle, u);
+                }
         }
 
-        if (!username || !*username) {
-                pam_syslog(handle, LOG_ERR, "User name not valid.");
-                return PAM_AUTH_ERR;
+        if (!have_loginuid) {
+                if ((r = pam_get_user(handle, &username, NULL)) != PAM_SUCCESS) {
+                        pam_syslog(handle, LOG_ERR, "Failed to get user name.");
+                        return r;
+                }
+
+                if (!username || !*username) {
+                        pam_syslog(handle, LOG_ERR, "User name not valid.");
+                        return PAM_AUTH_ERR;
+                }
+
+                pw = pam_modutil_getpwnam(handle, username);
         }
 
-        if (!(pw = pam_modutil_getpwnam(handle, username))) {
+        if (!pw) {
                 pam_syslog(handle, LOG_ERR, "Failed to get user data.");
                 return PAM_USER_UNKNOWN;
         }
 
         *ret_pw = pw;
-        *ret_username = username;
+        *ret_username = username ? username : pw->pw_name;
 
         return PAM_SUCCESS;
 }
@@ -335,7 +353,7 @@ _public_ PAM_EXTERN int pam_sm_open_session(
 
                 r = asprintf(&buf, "/user/%s/%s", username, id);
         } else
-                r = asprintf(&buf, "/user/%s/no-session", username);
+                r = asprintf(&buf, "/user/%s/master", username);
 
         if (r < 0) {
                 r = PAM_BUF_ERR;
@@ -369,7 +387,7 @@ static int session_remains(pam_handle_t *handle, const char *user_path) {
 
         while ((r = cg_read_subgroup(d, &subgroup)) > 0) {
 
-                remains = !streq(subgroup, "no-session");
+                remains = !streq(subgroup, "master");
                 free(subgroup);
 
                 if (remains)
@@ -416,7 +434,7 @@ _public_ PAM_EXTERN int pam_sm_close_session(
                 goto finish;
         }
 
-        /* We are probably still in some session/no-session dir. Move ourselves out of the way as first step */
+        /* We are probably still in some session/user dir. Move ourselves out of the way as first step */
         if ((r = cg_attach(SYSTEMD_CGROUP_CONTROLLER, "/user", 0)) < 0)
                 pam_syslog(handle, LOG_ERR, "Failed to move us away: %s", strerror(-r));
 
@@ -430,7 +448,7 @@ _public_ PAM_EXTERN int pam_sm_close_session(
         if ((id = pam_getenv(handle, "XDG_SESSION_ID")) && created) {
 
                 if (asprintf(&session_path, "/user/%s/%s", username, id) < 0 ||
-                    asprintf(&nosession_path, "/user/%s/no-session", username) < 0) {
+                    asprintf(&nosession_path, "/user/%s/master", username) < 0) {
                         r = PAM_BUF_ERR;
                         goto finish;
                 }
@@ -444,10 +462,10 @@ _public_ PAM_EXTERN int pam_sm_close_session(
                 } else {
                         pam_syslog(handle, LOG_INFO, "Moving remaining processes of user session %s of %s into control group %s.", id, username, nosession_path);
 
-                        /* Migrate processes from session to
-                         * no-session cgroup. First, try to create the
-                         * no-session group in case it doesn't exist
-                         * yet. Also, delete the session group. */
+                        /* Migrate processes from session to user
+                         * cgroup. First, try to create the user group
+                         * in case it doesn't exist yet. Also, delete
+                         * the session group. */
                         create_user_group(handle, nosession_path, pw, false, false);
 
                         if ((r = cg_migrate_recursive(SYSTEMD_CGROUP_CONTROLLER, session_path, nosession_path, false, true)) < 0)
@@ -464,7 +482,7 @@ _public_ PAM_EXTERN int pam_sm_close_session(
         /* Kill user processes not attached to any session */
         if (kill_user && r == 0) {
 
-                /* Kill no-session cgroup */
+                /* Kill user cgroup */
                 if ((r = cg_kill_recursive_and_wait(SYSTEMD_CGROUP_CONTROLLER, user_path, true)) < 0)
                         pam_syslog(handle, LOG_ERR, "Failed to kill user cgroup: %s", strerror(-r));
         } else {