pam: always rely on loginuid instead of uid to determine cgroup and XDG_RUNTIME_DIR

2 files changed, 29 insertions, 13 deletions

diff --git a/TODO b/TODO
index 8853dab24c..69670d3a54 100644
--- a/TODO
+++ b/TODO
@@ -71,8 +71,6 @@
 
 * allow runtime changing of log level and target
 
-* in the PAM module rely on loginuid to figure out XDG_RUNTIME_DIR
-
 * automatically determine TERM= based on tty name even for /dev/console
 
 * declare /etc/os-release cross-distro standard
diff --git a/src/pam-module.c b/src/pam-module.c
index d9458df98b..bc99684e11 100644
--- a/src/pam-module.c
+++ b/src/pam-module.c
@@ -128,7 +128,7 @@ static uint64_t get_session_id(int *mode) {
                 r = safe_atou32(s, &u);
                 free(s);
 
-                if (r >= 0 && u != (uint32_t) -1) {
+                if (r >= 0 && u != (uint32_t) -1 && u > 0) {
                         *mode = SESSION_ID_AUDIT;
                         return (uint64_t) u;
                 }
@@ -179,31 +179,49 @@ static int get_user_data(
                 const char **ret_username,
                 struct passwd **ret_pw) {
 
-        const char *username;
-        struct passwd *pw;
+        const char *username = NULL;
+        struct passwd *pw = NULL;
         int r;
+        bool have_loginuid = false;
+        char *s;
 
         assert(handle);
         assert(ret_username);
         assert(ret_pw);
 
-        if ((r = pam_get_user(handle, &username, NULL)) != PAM_SUCCESS) {
-                pam_syslog(handle, LOG_ERR, "Failed to get user name.");
-                return r;
+        if (read_one_line_file("/proc/self/loginuid", &s) >= 0) {
+                uint32_t u;
+
+                r = safe_atou32(s, &u);
+                free(s);
+
+                if (r >= 0 && u != (uint32_t) -1 && u > 0) {
+                        have_loginuid = true;
+                        pw = pam_modutil_getpwuid(handle, u);
+                }
         }
 
-        if (!username || !*username) {
-                pam_syslog(handle, LOG_ERR, "User name not valid.");
-                return PAM_AUTH_ERR;
+        if (!have_loginuid) {
+                if ((r = pam_get_user(handle, &username, NULL)) != PAM_SUCCESS) {
+                        pam_syslog(handle, LOG_ERR, "Failed to get user name.");
+                        return r;
+                }
+
+                if (!username || !*username) {
+                        pam_syslog(handle, LOG_ERR, "User name not valid.");
+                        return PAM_AUTH_ERR;
+                }
+
+                pw = pam_modutil_getpwnam(handle, username);
         }
 
-        if (!(pw = pam_modutil_getpwnam(handle, username))) {
+        if (!pw) {
                 pam_syslog(handle, LOG_ERR, "Failed to get user data.");
                 return PAM_USER_UNKNOWN;
         }
 
         *ret_pw = pw;
-        *ret_username = username;
+        *ret_username = username ? username : pw->pw_name;
 
         return PAM_SUCCESS;
 }