Fixed F18 remaining blocker: pkexec/etc.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi everyone,

For those not on IRC, I have identified the last remaining F18 blocker.
You can read the gory details on my G+ and I'll write a blog, but
briefly the summary is that systemd-logind is used to manage user
sessions[0]. It talks over D-BUS (what doesn't these days) and is
collaborating with a custom systemd pam plugin which runs during session
setup. During a pkexec (polkit1) invocation of a binary, a call is made
to systemd-logind to setup a new session, which it does. But when it
does this, on systems without CONFIG_AUDITSYSCALL enabled[1], it cannot
see /proc/pid/sessionid, and decides that this means there cannot be an
existing session (the one you used to invoke pkexec).

When a new session is created, systemd opens a special fifo for the
session and registers to poll on this so that it can see if the session
died mysterously and needs cleaning up. In the case of a sudo-like
command, it needs to clean this fifo up ahead of time so that it won't
later (right as the new processing being driven by pkexec is spawned)
kill what you just tried to run. But if you do not have auditing setup,
systemd will never do any of these things and its "login manager" will
kill whatever you are trying to run with a SIGTERM. That's why you see
those "Terminated" messages and errors when trying to run e.g. yumex.

I'll write this up using better and more accurate language. I just
wanted to throw something out there to say that we know what the problem
is and that a fixed kernel package will be built soon.

Jon.

[0] see the FreeDesktop docs on heads and sessions, also see loginctl.

[1] This is set in the base config but is not inherited on all of the
3.6 kernel variants, and a similar though slightly different situation
exists on 3.7. Peter is fixing the kernel config with a new 3.6 kernel.
_______________________________________________
arm mailing list
arm@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/arm



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux ARM (Vger)]     [Linux ARM]     [ARM Kernel]     [Fedora User Discussion]     [Older Fedora Users Discussion]     [Fedora Advisory Board]     [Fedora Security]     [Fedora Maintainers]     [Fedora Devel Java]     [Fedora Legacy]     [Fedora Desktop]     [ATA RAID]     [Fedora Marketing]     [Fedora Mentors]     [Fedora Package Announce]     [Fedora Package Review]     [Fedora Music]     [Fedora Packaging]     [Centos]     [Fedora SELinux]     [Coolkey]     [Yum Users]     [Tux]     [Yosemite News]     [Linux Apps]     [KDE Users]     [Fedora Tools]     [Fedora Art]     [Fedora Docs]     [Asterisk PBX]

Powered by Linux