LightDM - Dec 2015 - pam usage

Hello,

While working on the audit patch for lightdm, I found out that for every 
login, it runs exactly 2 pam sessions back to back. No other login program 
does this. I showed this to an upstream pam maintainer and he was also 
puzzled. With the audit patch applied, I see the following:

# ausearch --start 10:30 -x lightdm --raw -m user_start | aureport --summary 
--pid

Pid Summary Report
=========================total  pid
=========================1  8939
1  8971

The first session shows this:

# ausearch --start 10:30 -p 8939 --raw | aureport --summary --event -i

Event Summary Report
=====================total  type
=====================1  CRED_ACQ
1  CRED_DISP
1  USER_START
1  USER_END
1  USER_LOGIN

And the second this:

[root at x2 ~]# ausearch --start 10:30 -p 8971 --raw | aureport --summary
--event
-i

Event Summary Report
=====================total  type
=====================1  LOGIN
1  USER_AUTH
1  USER_ACCT
1  CRED_ACQ
1  USER_START
1  USER_LOGIN
1  USER_ROLE_CHANGE

The first session is the odd one because its missing several events. Zeroing in 
on that one:

# ausearch --start 10:30 -p 8939 -i -m USER_START
----
type=USER_START msg=audit(12/03/2015 10:34:39.814:649) : pid=8939 uid=root 
auid=unset ses=unset subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 
msg='op=PAM:session_open grantors=pam_unix,pam_systemd acct=lightdm 
exe=/usr/sbin/lightdm hostname=? addr=? terminal=:0 res=success' 

What I found was that lightdm-greeter is running a pam session that appears to 
be for the sole purpose of calling pam_systemd.  In checking to see what all 
uses pam_systemd, I found that its normally called in system-auth which the 
regular lightdm calls. This is how all the other system entry points start the 
user session.

So, I was curious, what's the story behind the lightdm-greeter pam setup?
Can
llightdm be reworked to not need to run pam in the greeter? In reading the 
pam_systemd man page, it also says that it sets the $XDG_SESSION_ID variable 
which is based on the kernel assigned credentials set by pam_loginuid which is 
only run in the second session. (See the LOGIN event in the above reports.) It 
falls back to tracking a session another way, but it prefers being called 
after pam_loginuid. It seems like something is odd here.

Thanks,
-Steve

Hi Steve,

The greeter is a full session so it runs a PAM session as the lightdm user.
Other display managers (e.g. GDM) also do it this way. A full session is
required to be able to make a greeter that can access many modern features.

--Robert

On Fri, 4 Dec 2015 at 10:00 Steve Grubb <sgrubb at redhat.com> wrote:
> Hello,
>
> While working on the audit patch for lightdm, I found out that for every
> login, it runs exactly 2 pam sessions back to back. No other login program
> does this. I showed this to an upstream pam maintainer and he was also
> puzzled. With the audit patch applied, I see the following:
>
> # ausearch --start 10:30 -x lightdm --raw -m user_start | aureport
> --summary
> --pid
>
> Pid Summary Report
> =========================> total  pid
> =========================> 1  8939
> 1  8971
>
> The first session shows this:
>
> # ausearch --start 10:30 -p 8939 --raw | aureport --summary --event -i
>
> Event Summary Report
> =====================> total  type
> =====================> 1  CRED_ACQ
> 1  CRED_DISP
> 1  USER_START
> 1  USER_END
> 1  USER_LOGIN
>
> And the second this:
>
> [root at x2 ~]# ausearch --start 10:30 -p 8971 --raw | aureport --summary
> --event
> -i
>
> Event Summary Report
> =====================> total  type
> =====================> 1  LOGIN
> 1  USER_AUTH
> 1  USER_ACCT
> 1  CRED_ACQ
> 1  USER_START
> 1  USER_LOGIN
> 1  USER_ROLE_CHANGE
>
> The first session is the odd one because its missing several events.
> Zeroing in
> on that one:
>
> # ausearch --start 10:30 -p 8939 -i -m USER_START
> ----
> type=USER_START msg=audit(12/03/2015 10:34:39.814:649) : pid=8939 uid=root
> auid=unset ses=unset subj=system_u:system_r:xdm_t:s0-s0:c0.c1023
> msg='op=PAM:session_open grantors=pam_unix,pam_systemd acct=lightdm
> exe=/usr/sbin/lightdm hostname=? addr=? terminal=:0 res=success'
>
> What I found was that lightdm-greeter is running a pam session that
> appears to
> be for the sole purpose of calling pam_systemd.  In checking to see what
> all
> uses pam_systemd, I found that its normally called in system-auth which the
> regular lightdm calls. This is how all the other system entry points start
> the
> user session.
>
> So, I was curious, what's the story behind the lightdm-greeter pam
setup?
> Can
> llightdm be reworked to not need to run pam in the greeter? In reading the
> pam_systemd man page, it also says that it sets the $XDG_SESSION_ID
> variable
> which is based on the kernel assigned credentials set by pam_loginuid
> which is
> only run in the second session. (See the LOGIN event in the above
> reports.) It
> falls back to tracking a session another way, but it prefers being called
> after pam_loginuid. It seems like something is odd here.
>
> Thanks,
> -Steve
>
> _______________________________________________
> LightDM mailing list
> LightDM at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/lightdm
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.freedesktop.org/archives/lightdm/attachments/20151210/52e78ed8/attachment.html>