summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--man/pam_systemd.xml154
-rw-r--r--man/systemd-logind.conf.xml14
-rw-r--r--src/logind.h2
-rw-r--r--src/pam-module.c6
4 files changed, 60 insertions, 116 deletions
diff --git a/man/pam_systemd.xml b/man/pam_systemd.xml
index 7d5fcad631..883b50b640 100644
--- a/man/pam_systemd.xml
+++ b/man/pam_systemd.xml
@@ -69,8 +69,7 @@
created and its ownership changed to the user
that is logging in.</para></listitem>
- <listitem><para>If
- <option>create-session=1</option> is set, the
+ <listitem><para>The
<varname>$XDG_SESSION_ID</varname> environment
variable is initialized. If auditing is
available and
@@ -82,20 +81,10 @@
an independent session counter is
used.</para></listitem>
- <listitem><para>If
- <option>create-session=1</option> is set, a new
- control group
+ <listitem><para>A new control group
<filename>/user/$USER/$XDG_SESSION_ID</filename>
is created and the login process moved into
it.</para></listitem>
-
- <listitem><para>If
- <option>create-session=0</option> is set, a new
- control group
- <filename>/user/$USER/user</filename>
- is created and the login process moved into
- it.</para></listitem>
-
</orderedlist>
<para>On logout, this module ensures the following:</para>
@@ -103,38 +92,13 @@
<orderedlist>
<listitem><para>If
<varname>$XDG_SESSION_ID</varname> is set and
- <option>kill-session=1</option> specified, all
+ <option>kill-session-processes=1</option> specified, all
remaining processes in the
<filename>/user/$USER/$XDG_SESSION_ID</filename>
control group are killed and the control group
is removed.</para></listitem>
- <listitem><para>If
- <varname>$XDG_SESSION_ID</varname> is set and
- <option>kill-session=0</option> specified, all
- remaining processes in the
- <filename>/user/$USER/$XDG_SESSION_ID</filename>
- control group are migrated to
- <filename>/user/$USER/user</filename> and
- the original control group is
- removed.</para></listitem>
-
- <listitem><para>If
- <option>kill-user=1</option> is specified, and
- no other user session control group remains,
- except
- <filename>/user/$USER/user</filename>,
- all remaining processes in the
- <filename>/user/$USER</filename> hierarchy
- are killed and the control group is removed.</para></listitem>
-
- <listitem><para>If
- <option>kill-user=0</option> is specified, and
- no process remains in the
- <filename>/user/$USER</filename> hierarchy the
- control group is removed.</para></listitem>
-
- <listitem><para>If the
+ <listitem><para>If last subgroup of the
<filename>/user/$USER</filename> control group
was removed the
<varname>$XDG_RUNTIME_DIR</varname> directory
@@ -155,27 +119,7 @@
<variablelist>
<varlistentry>
- <term><option>create-session=</option></term>
-
- <listitem><para>Takes a boolean
- argument. If true, a new session is
- created: the
- <varname>$XDG_SESSION_ID</varname>
- environment variable is set and the
- login process moved to the
- <filename>/user/$USER/$XDG_SESSION_ID</filename>
- control group. It is recommended that
- all services which are directly created
- on the user's behalf set this
- option. Only for services that shall
- automatically be terminated when the
- user logs out completely, otherwise
- <varname>create-session=0</varname>
- should be set.</para></listitem>
- </varlistentry>
-
- <varlistentry>
- <term><option>kill-session=</option></term>
+ <term><option>kill-session-processes=</option></term>
<listitem><para>Takes a boolean
argument. If true, all processes
@@ -186,30 +130,13 @@
</varlistentry>
<varlistentry>
- <term><option>kill-user=</option></term>
-
- <listitem><para>Takes a boolean
- argument. If true, all processes
- created by the user during his session
- and from his session will be
- terminated after he logged out
- completely. This is a weaker version
- of <option>kill-session=1</option> and is
- more friendly for users logged in more
- than once, as their processes are
- terminated only on their complete
- logout.</para></listitem>
- </varlistentry>
-
- <varlistentry>
<term><option>kill-only-users=</option></term>
<listitem><para>Takes a comma
separated list of user names or
numeric user ids as argument. If this
option is used the effect of the
- <option>kill-session=</option> and
- <option>kill-user=</option> options
+ <option>kill-session-processes=</option> options
will apply only to the listed
users. If this option is not used the
option applies to all local
@@ -228,8 +155,7 @@
numeric user ids as argument. Users
listed in this argument will not be
subject to the effect of
- <option>kill-session=</option> or
- <option>kill-user=</option>. Note
+ <option>kill-session-processes=</option>. Note
that that this option takes precedence
over
<option>kill-only-users=</option>, and
@@ -245,56 +171,59 @@
<term><option>controllers=</option></term>
<listitem><para>Takes a comma
- separated list of cgroup controllers
- in which hierarchies a user/session
- cgroup will be created by default for
- each user logging in, in addition to
- the cgroup in the named 'name=systemd'
+ separated list of control group
+ controllers in which hierarchies a
+ user/session control group will be
+ created by default for each user
+ logging in, in addition to the control
+ group in the named 'name=systemd'
hierarchy. If omitted, defaults to an
- empty list. This may be used to move
- user sessions into their own groups in
- the 'cpu' hierarchy which ensures that
- every logged in user gets an equal
- amount of CPU time regardless how many
- processes he has
- started.</para></listitem>
+ empty list.</para></listitem>
</varlistentry>
<varlistentry>
<term><option>reset-controllers=</option></term>
<listitem><para>Takes a comma
- separated list of cgroup controllers
- in which hierarchies the logged in
- processes will be reset to the root
- cgroup. If omitted, defaults to 'cpu',
- meaning that a 'cpu' cgroup grouping
- inherited from the login manager will
- be reset for the processes of the
- logged in user.</para></listitem>
+ separated list of control group
+ controllers in which hierarchies the
+ logged in processes will be reset to
+ the root control
+ group.</para></listitem>
</varlistentry>
<varlistentry>
<term><option>debug=</option></term>
<listitem><para>Takes a boolean
- argument. If true, logs debugging
- information.</para></listitem>
+ argument. If yes, the module will log
+ debugging information as it
+ operates.</para></listitem>
</varlistentry>
</variablelist>
- <para>Note that setting <varname>kill-user=1</varname>
- or even <varname>kill-session=1</varname> will break
- tools like
+ <para>Note that setting
+ <varname>kill-session-processes=1</varname> will break tools
+ like
<citerefentry><refentrytitle>screen</refentrytitle><manvolnum>1</manvolnum></citerefentry>.</para>
+ <para>Note that
+ <varname>kill-session-processes=1</varname> is a
+ stricter version of
+ <varname>KillUserProcesses=1</varname> which may be
+ configured system-wide in
+ <citerefentry><refentrytitle>systemd-logind.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>. The
+ former kills processes of a session as soon as it
+ ends, the latter kills processes as soon as the last
+ session of the user ends.</para>
+
<para>If the options are omitted they default to
- <option>create-session=1</option>,
- <option>kill-session=0</option>,
- <option>kill-user=0</option>,
- <option>reset-controllers=cpu</option>,
+ <option>kill-session-processes=0</option>,
<option>kill-only-users=</option>,
- <option>kill-exclude-users=root</option>.</para>
+ <option>kill-exclude-users=</option>,
+ <option>controllers=</option>,
+ <option>reset-controllers=</option>,
+ <option>debug=no</option>.</para>
</refsect1>
<refsect1>
@@ -369,7 +298,7 @@ account required pam_unix.so
password required pam_unix.so
session required pam_unix.so
session required pam_loginuid.so
-session required pam_systemd.so kill-user=1</programlisting>
+session required pam_systemd.so kill-session-processes=1</programlisting>
</refsect1>
<refsect1>
@@ -379,6 +308,7 @@ session required pam_systemd.so kill-user=1</programlisting>
<citerefentry><refentrytitle>pam.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
<citerefentry><refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
<citerefentry><refentrytitle>pam_loginuid</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+ <citerefentry><refentrytitle>systemd-logind.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
</para>
</refsect1>
diff --git a/man/systemd-logind.conf.xml b/man/systemd-logind.conf.xml
index 889bd1567e..2dc9994954 100644
--- a/man/systemd-logind.conf.xml
+++ b/man/systemd-logind.conf.xml
@@ -147,6 +147,20 @@
<literal>cpu</literal>.</para></listitem>
</varlistentry>
</variablelist>
+
+ <para>Note that setting
+ <varname>KillUserProcesses=1</varname> will break tools
+ like
+ <citerefentry><refentrytitle>screen</refentrytitle><manvolnum>1</manvolnum></citerefentry>.</para>
+
+ <para>Note that <varname>KillUserProcesses=1</varname>
+ is a weaker version of
+ <varname>kill-session-processes=1</varname> which may
+ be configured per-service for
+ <citerefentry><refentrytitle>pam_systemd</refentrytitle><manvolnum>8</manvolnum></citerefentry>. The
+ latter kills processes of a session as soon as it
+ ends, the former kills processes as soon as the last
+ session of the user ends.</para>
</refsect1>
<refsect1>
diff --git a/src/logind.h b/src/logind.h
index df1364fd72..59ea799d52 100644
--- a/src/logind.h
+++ b/src/logind.h
@@ -36,9 +36,9 @@
*
* spawn user systemd
* direct client API
- * add configuration file man page
* verify access to SetIdleHint
* add FlushDevices bus call
+ * hook up ACL tool for udev
*
* udev:
* drop redundant udev_device_get_is_initialized() use as soon as libudev is fixed
diff --git a/src/pam-module.c b/src/pam-module.c
index 90da898ff8..a15b4cae1c 100644
--- a/src/pam-module.c
+++ b/src/pam-module.c
@@ -57,9 +57,9 @@ static int parse_argv(pam_handle_t *handle,
for (i = 0; i < (unsigned) argc; i++) {
int k;
- if (startswith(argv[i], "kill-processes=")) {
- if ((k = parse_boolean(argv[i] + 15)) < 0) {
- pam_syslog(handle, LOG_ERR, "Failed to parse kill-processes= argument.");
+ if (startswith(argv[i], "kill-session-processes=")) {
+ if ((k = parse_boolean(argv[i] + 23)) < 0) {
+ pam_syslog(handle, LOG_ERR, "Failed to parse kill-session-processes= argument.");
return k;
}
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-11-08 10:13:25 +0000