pam-systemd: talk to logind via varlink

This makes sure we now use Varlink per default as transport for allocating sessions. This reduces the time it takes to do one run0 cycle by roughly ~10% on my completely synthetic test setup (assuming the target user's service manager is already started) The D-Bus codepaths are kept in place for two reasons: * To make upgrades easy * If the user actually sets resource properties on the PAM session we fall back to the D-Bus codepaths, as we currently have no way to encode the scope properties in JSON, this is only supported for D-Bus serialization. The latter should be revisited once it is possible to allocate a scope unit from PID1 via varlink.
logind: add basic Varlink API
2024-11-21 15:24:24 +01:00 · 2024-11-21 12:06:56 +01:00 · 2024-11-21 12:06:53 +01:00 · 2024-11-21 12:06:50 +01:00 · 2024-11-21 12:06:46 +01:00 · 2024-11-21 12:06:43 +01:00
26 changed files with 43 additions and 40 deletions
--- a/hwdb.d/60-keyboard.hwdb
+++ b/hwdb.d/60-keyboard.hwdb
@ -1438,11 +1438,6 @@ evdev:input:b0003v046DpC309*
 KEYBOARD_KEY_c01b6=images                              # My Pictures (F11)
 KEYBOARD_KEY_c01b7=audio                               # My Music (F12)

-# Logitech MX Keys for Mac
-evdev:input:b0003v046Dp4092*
- KEYBOARD_KEY_70035=102nd                               # '<' key
- KEYBOARD_KEY_70064=grave                               # '^' key
-
 ###########################################################
 # Maxdata
 ###########################################################
--- a/po/uk.po
+++ b/po/uk.po
@ -9,8 +9,8 @@ msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2024-11-06 14:42+0000\n"
-"PO-Revision-Date: 2024-11-21 19:38+0000\n"
-"Last-Translator: Yuri Chornoivan <yurchor@ukr.net>\n"
+"PO-Revision-Date: 2024-11-20 19:13+0000\n"
+"Last-Translator: Dmytro Markevych <hotr1pak@gmail.com>\n"
 "Language-Team: Ukrainian <https://translate.fedoraproject.org/projects/"
 "systemd/main/uk/>\n"
 "Language: uk\n"
@ -120,11 +120,11 @@ msgstr "Для оновлення домашньої теки користува

 #: src/home/org.freedesktop.home1.policy:53
 msgid "Update your home area"
-msgstr "Оновлення домашньої області"
+msgstr "Оновіть свій домашній простір"

 #: src/home/org.freedesktop.home1.policy:54
 msgid "Authentication is required to update your home area."
-msgstr "Для оновлення домашньої області слід пройти розпізнавання."
+msgstr "Для оновлення домашньої області потрібна автентифікація."

 #: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
@ -1215,7 +1215,7 @@ msgstr "Керування додатковими функціями"

 #: src/sysupdate/org.freedesktop.sysupdate1.policy:76
 msgid "Authentication is required to manage optional features"
-msgstr "Для керування додатковими можливостями слід пройти розпізнавання"
+msgstr "Для керування додатковими функціями потрібна автентифікація"

 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
--- a/shell-completion/bash/systemd-cryptenroll
+++ b/shell-completion/bash/systemd-cryptenroll
@ -38,12 +38,19 @@ __get_tpm2_devices() {
    done
 }

+__get_block_devices() {
+    local i
+    for i in /dev/*; do
+        [ -b "$i" ] && printf '%s\n' "$i"
+    done
+}
+
 _systemd_cryptenroll() {
    local comps
    local cur=${COMP_WORDS[COMP_CWORD]} prev=${COMP_WORDS[COMP_CWORD-1]} words cword
    local -A OPTS=(
        [STANDALONE]='-h --help --version
-                     --password --recovery-key --list-devices'
+                     --password --recovery-key'
        [ARG]='--unlock-key-file
               --unlock-fido2-device
               --unlock-tpm2-device
@ -109,7 +116,7 @@ _systemd_cryptenroll() {
        return 0
    fi

-    comps=$(systemd-cryptenroll --list-devices)
+    comps=$(__get_block_devices)
    COMPREPLY=( $(compgen -W '$comps' -- "$cur") )
    return 0
 }
--- a/src/basic/socket-util.c
+++ b/src/basic/socket-util.c
@ -983,7 +983,7 @@ int getpeerpidref(int fd, PidRef *ret) {

        int pidfd = getpeerpidfd(fd);
        if (pidfd < 0)  {
-                if (!ERRNO_IS_NEG_NOT_SUPPORTED(pidfd) && pidfd != -EINVAL)
+                if (!ERRNO_IS_NEG_NOT_SUPPORTED(pidfd))
                        return pidfd;

                struct ucred ucred;
--- a/src/core/service.c
+++ b/src/core/service.c
@ -3426,12 +3426,14 @@ static int service_deserialize_item(Unit *u, const char *key, const char *value,
                        return 0;
                }

-                r = service_add_fd_store(s, TAKE_FD(fd), fdn, do_poll);
+                r = service_add_fd_store(s, fd, fdn, do_poll);
                if (r < 0) {
                        log_unit_debug_errno(u, r,
                                             "Failed to store deserialized fd '%s', ignoring: %m", fdn);
                        return 0;
                }
+
+                TAKE_FD(fd);
        } else if (streq(key, "extra-fd")) {
                _cleanup_free_ char *fdv = NULL, *fdn = NULL;
                _cleanup_close_ int fd = -EBADF;
--- a/src/libsystemd/sd-varlink/varlink-util.c
+++ b/src/libsystemd/sd-varlink/varlink-util.c
@ -16,7 +16,7 @@ int varlink_get_peer_pidref(sd_varlink *v, PidRef *ret) {

        int pidfd = sd_varlink_get_peer_pidfd(v);
        if (pidfd < 0) {
-                if (!ERRNO_IS_NEG_NOT_SUPPORTED(pidfd) && pidfd != -EINVAL)
+                if (!ERRNO_IS_NEG_NOT_SUPPORTED(pidfd))
                        return pidfd;

                pid_t pid;
--- a/tmpfiles.d/20-systemd-shell-extra.conf.in
+++ b/tmpfiles.d/20-systemd-shell-extra.conf.in
@ -5,7 +5,7 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.

-# See tmpfiles.d(5) for details.
+# See tmpfiles.d(5) for details

 {% if LINK_SHELL_EXTRA_DROPIN %}
 L$ {{SHELLPROFILEDIR}}/70-systemd-shell-extra.sh - - - - {{LIBEXECDIR}}/profile.d/70-systemd-shell-extra.sh
--- a/tmpfiles.d/20-systemd-ssh-generator.conf.in
+++ b/tmpfiles.d/20-systemd-ssh-generator.conf.in
@ -5,7 +5,7 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.

-# See tmpfiles.d(5) for details.
+# See tmpfiles.d(5) for details

 {% if LINK_SSH_PROXY_DROPIN %}
 L$ {{SSHCONFDIR}}/20-systemd-ssh-proxy.conf - - - - {{LIBEXECDIR}}/ssh_config.d/20-systemd-ssh-proxy.conf
--- a/tmpfiles.d/20-systemd-stub.conf.in
+++ b/tmpfiles.d/20-systemd-stub.conf.in
@ -5,7 +5,7 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.

-# See tmpfiles.d(5) for details.
+# See tmpfiles.d(5) for details

 # Copy systemd-stub provided metadata such as PCR signature and public key file
 # from initrd into /run/, so that it will survive the initrd stage
--- a/tmpfiles.d/20-systemd-userdb.conf.in
+++ b/tmpfiles.d/20-systemd-userdb.conf.in
@ -5,7 +5,7 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.

-# See tmpfiles.d(5) for details.
+# See tmpfiles.d(5) for details

 {% if LINK_SSHD_USERDB_DROPIN %}
 L {{SSHDCONFDIR}}/20-systemd-userdb.conf - - - - {{LIBEXECDIR}}/sshd_config.d/20-systemd-userdb.conf
--- a/tmpfiles.d/credstore.conf
+++ b/tmpfiles.d/credstore.conf
@ -5,7 +5,7 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.

-# See tmpfiles.d(5) for details.
+# See tmpfiles.d(5) for details

 d /etc/credstore 0700 root root
 d /etc/credstore.encrypted 0700 root root
--- a/tmpfiles.d/etc.conf.in
+++ b/tmpfiles.d/etc.conf.in
@ -5,7 +5,7 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.

-# See tmpfiles.d(5) for details.
+# See tmpfiles.d(5) for details

 L /etc/os-release - - - - ../usr/lib/os-release
 L+ /etc/mtab - - - - ../proc/self/mounts
--- a/tmpfiles.d/home.conf
+++ b/tmpfiles.d/home.conf
@ -5,7 +5,7 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.

-# See tmpfiles.d(5) for details.
+# See tmpfiles.d(5) for details

 Q /home 0755 - - -
 q /srv 0755 - - -
--- a/tmpfiles.d/journal-nocow.conf
+++ b/tmpfiles.d/journal-nocow.conf
@ -5,7 +5,7 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.

-# See tmpfiles.d(5) for details.
+# See tmpfiles.d(5) for details

 # Set the NOCOW attribute for directories of journal files. This flag
 # is inherited by their new files and sub-directories. Matters only
--- a/tmpfiles.d/legacy.conf.in
+++ b/tmpfiles.d/legacy.conf.in
@ -5,11 +5,10 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.

-# See tmpfiles.d(5) for details.
+# See tmpfiles.d(5) for details

-# The functionality provided by these files and directories has been replaced
-# by newer interfaces. Their use is discouraged on legacy-free systems. This
-# configuration is provided to maintain backward compatibility.
+# These files are considered legacy and are unnecessary on legacy-free
+# systems.

 d /run/lock 0755 root root -
 L /var/lock - - - - ../run/lock
@ -17,15 +16,15 @@ L /var/lock - - - - ../run/lock
 L$ /var/log/README - - - - ../..{{DOC_DIR}}/README.logs
 {% endif %}

-{% if HAVE_SYSV_COMPAT %}
 # /run/lock/subsys is used for serializing SysV service execution, and
 # hence without use on SysV-less systems.
+
 d /run/lock/subsys 0755 root root -

 # /forcefsck, /fastboot and /forcequotacheck are deprecated in favor of the
 # kernel command line options 'fsck.mode=force', 'fsck.mode=skip' and
 # 'quotacheck.mode=force'
+
 r! /forcefsck
 r! /fastboot
 r! /forcequotacheck
-{% endif %}
--- a/tmpfiles.d/meson.build
+++ b/tmpfiles.d/meson.build
@ -35,7 +35,7 @@ in_files = [
        ['20-systemd-stub.conf',          'ENABLE_EFI'],
        ['20-systemd-userdb.conf',        'ENABLE_SSH_USERDB_CONFIG'],
        ['etc.conf'],
-        ['legacy.conf'],
+        ['legacy.conf',                   'HAVE_SYSV_COMPAT'],
        ['static-nodes-permissions.conf'],
        ['systemd.conf'],
        ['var.conf'],
--- a/tmpfiles.d/portables.conf
+++ b/tmpfiles.d/portables.conf
@ -1,4 +1,4 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
-# See tmpfiles.d(5) for details.
+# See tmpfiles.d(5) for details

 Q /var/lib/portables 0700
--- a/tmpfiles.d/provision.conf
+++ b/tmpfiles.d/provision.conf
@ -5,7 +5,7 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.

-# See tmpfiles.d(5) for details.
+# See tmpfiles.d(5) for details

 # Provision additional login messages from credentials, if they are set. Note
 # that these lines are NOPs if the credentials are not set or if the files
--- a/tmpfiles.d/systemd-network.conf
+++ b/tmpfiles.d/systemd-network.conf
@ -5,7 +5,7 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.

-# See tmpfiles.d(5) for details.
+# See tmpfiles.d(5) for details

 d$ /run/systemd/netif        0755 systemd-network systemd-network -
 d$ /run/systemd/netif/links  0755 systemd-network systemd-network -
--- a/tmpfiles.d/systemd-nspawn.conf
+++ b/tmpfiles.d/systemd-nspawn.conf
@ -5,7 +5,7 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.

-# See tmpfiles.d(5) for details.
+# See tmpfiles.d(5) for details

 Q /var/lib/machines 0700 - - -

--- a/tmpfiles.d/systemd-resolve.conf
+++ b/tmpfiles.d/systemd-resolve.conf
@ -5,6 +5,6 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.

-# See tmpfiles.d(5) for details.
+# See tmpfiles.d(5) for details

 L! /etc/resolv.conf - - - - ../run/systemd/resolve/stub-resolv.conf
--- a/tmpfiles.d/systemd-tmp.conf
+++ b/tmpfiles.d/systemd-tmp.conf
@ -5,7 +5,7 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.

-# See tmpfiles.d(5) for details.
+# See tmpfiles.d(5) for details

 # Exclude namespace mountpoints created with PrivateTmp=yes
 x /tmp/systemd-private-%b-*
--- a/tmpfiles.d/systemd.conf.in
+++ b/tmpfiles.d/systemd.conf.in
@ -5,7 +5,7 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.

-# See tmpfiles.d(5) for details.
+# See tmpfiles.d(5) for details

 d /run/user 0755 root root -
 {% if ENABLE_UTMP %}
--- a/tmpfiles.d/tmp.conf
+++ b/tmpfiles.d/tmp.conf
@ -5,7 +5,7 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.

-# See tmpfiles.d(5) for details.
+# See tmpfiles.d(5) for details

 # Clear tmp directories separately, to make them easier to override
 q /tmp 1777 root root 10d
--- a/tmpfiles.d/var.conf.in
+++ b/tmpfiles.d/var.conf.in
@ -5,7 +5,7 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.

-# See tmpfiles.d(5) for details.
+# See tmpfiles.d(5) for details

 q /var 0755 - - -

--- a/tmpfiles.d/x11.conf
+++ b/tmpfiles.d/x11.conf
@ -5,7 +5,7 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.

-# See tmpfiles.d(5) for details.
+# See tmpfiles.d(5) for details

 # Make sure these are created by default so that nobody else can
 # or empty them at startup
Author	SHA1	Message	Date
Lennart Poettering	28a591e192	pam-systemd: talk to logind via varlink This makes sure we now use Varlink per default as transport for allocating sessions. This reduces the time it takes to do one run0 cycle by roughly ~10% on my completely synthetic test setup (assuming the target user's service manager is already started) The D-Bus codepaths are kept in place for two reasons: * To make upgrades easy * If the user actually sets resource properties on the PAM session we fall back to the D-Bus codepaths, as we currently have no way to encode the scope properties in JSON, this is only supported for D-Bus serialization. The latter should be revisited once it is possible to allocate a scope unit from PID1 via varlink.	2024-11-21 15:24:24 +01:00
Lennart Poettering	cbbf4f1bc0	logind: add basic Varlink API For now this only covers CreateSession() and ReleaseSession(), i.e. the two operations pam_systemd cares about.	2024-11-21 12:06:56 +01:00
Lennart Poettering	f402bf0249	logind: split create session reply handling in two This prepares ground so that later on we can reply with either D-Bus or Varlink depending on the client's request.	2024-11-21 12:06:53 +01:00
Lennart Poettering	5820a3110a	logind: also potentially GC the session if we cannot send reply	2024-11-21 12:06:50 +01:00
Lennart Poettering	57980e639e	logind: indicate that 'error' parameter is input by making it const	2024-11-21 12:06:46 +01:00
Lennart Poettering	349ed71b02	logind: rework session creation logic, to be more reusable for varlink codepaths This separates the preparatory checks that generate D-Bus errors from the code that actually allocates the session. This make the logic easier to follow and prepares ground so that we can reuse the 2nd part later when exposing session creation via Varlink.	2024-11-21 12:06:43 +01:00
Lennart Poettering	fa98d06a59	logind: split out logic that finds free session ID into helper call Just some refactoring to make an overly large function a bit smaller.	2024-11-21 12:06:39 +01:00
Lennart Poettering	4dc2a994bd	logind: normalize parameter to create_session() We can pass a properly typed Manager object here, no reason to pass it as void*.	2024-11-21 12:06:36 +01:00
Lennart Poettering	b6c3118315	sd-varlink: fix bug when enqueuing messages with fds asynchronously When determining the poll events to wait for we need to take the queue of pending messages that carry fds into account. Otherwise we might end up not waking up if such an fd-carrying message is enqueued asynchronously (i.e. not from a dispatch callback).	2024-11-21 12:06:33 +01:00
Lennart Poettering	a3ab6ede95	sd-varlink: add flag for sd_varlink_server for creating connections with fd passing enabled Let's add a simple flag that enables fd passing for all connections of a server. It's much easier to use this than to install a connect handler which manually enables this for each connection.	2024-11-21 12:06:26 +01:00
Lennart Poettering	af748aba2f	terminal-util: modernize vtnr_from_tty() a bit	2024-11-21 12:06:19 +01:00
Lennart Poettering	482bbb932f	sd-login: make use of getpeerpidref() and cg_pidref_get_*()	2024-11-21 12:06:16 +01:00
Lennart Poettering	8808bcf68b	socket-util: introduce getpeerpidref() This combines getpeercred() and getpeerpidfd() and returns a PidRef	2024-11-21 12:06:02 +01:00
Lennart Poettering	894fb2b1b4	cgroup-util: add pidref counterparts for cg_pid_get_session() + cg_pid_get_owner_uid()	2024-11-21 12:05:45 +01:00
Lennart Poettering	a088ebfcf5	tree-wide: use pidref_is_self() at more places	2024-11-21 12:05:42 +01:00
Lennart Poettering	dc997664b6	sd-json: add json_dispatch_const_path() helper The new json_dispatch_const_path() is to json_dispatch_path() what sd_json_dispatch_const_string() is to sd_json_dispatch_ string(), i.e. doesn't implicitly strdup() the string, but gives you the pointer into the JSON structure, and thus requires you to keep it pinned.	2024-11-21 12:05:28 +01:00
Lennart Poettering	8baa1059ba	pam_systemd: introduce pam_get_data_many() helper and make use of it This is to pam_get_data() what pam_get_item() is to pam_get_item_many().	2024-11-21 12:05:13 +01:00
Lennart Poettering	5a140b38f6	pam_systemd: fix error code confusion when prepping D-Bus message We got confused by the error codes here, and sometimes return PAM errors where the caller propagated them unconverted as negative errno errors. Fix that.	2024-11-21 12:05:10 +01:00
Lennart Poettering	0a9ab33875	pam_systemd: split pam_sm_open_session() into more digestable blocks Let's separate four different parts of pam_sm_open_session(): 1. Acquiring of our various parameters from pam env, pam data, pam items 2. Mangling of that data to clean it up 3. Registering of the service with logind 4. Importing shell credentials into environment variables 5. Enforcement of user record data This makes the code a lot more readable, and gets rid of an ugly got label. It also corrects things: if step 3 doesnt work because logind is not around, we'll now still do step 4, which we previously erroneously skipped. Besodes that no real code changes.	2024-11-21 12:05:07 +01:00
Lennart Poettering	174829c534	pam_systemd: split out setting of shell env vars from credentials and move it later Let's shorten the code of pam_sm_open_session() a bit, and also make sure the importing of the env vars from the creds also happens if the session registration with logind is skipped.	2024-11-21 12:05:03 +01:00
Lennart Poettering	a047e131df	pam_systemd: drop "uid" field from SessionContext Let's instead just pass over the UserRecord, it's a much more useful object with lots more information we'll sooner or later need (preparation for later commits).	2024-11-21 12:05:00 +01:00
Lennart Poettering	422c880e22	pam_systemd: drop "pid" field from SessionContext We never use the field and this is not going to change... This addresses a weird asymmetry, as create_session_message() always went to the process' own PID when doing pidfds but otherwise (i.e. without pidfds) would honour the PID specified as function parameter.	2024-11-21 12:04:56 +01:00
Lennart Poettering	f79c8a3e34	pam-systemd: normalize parsing of XDG_VTNR Let's make it more like the parsing of the "incomplete" boolean env var, to streamline things.	2024-11-21 12:04:34 +01:00