Re: User authentication service isn't killed fully

[beroal <me@xxxxxxxxxxxx>]

I was not aware of `PAMName`. After reading its documentation, it's still not clear to me what it does and how it can be used. What's a PAM session? Do you have any references? Google search wasn't very helpful. AFAIK from the PAM documentation, session is not an entity, for example, it has no identifier. Is it a session stored in logind?

I would also like to know how systemd is supposed to handle authentication programs that can start a process for any user, not the one in the systemd unit file. I posted just a minimal example.

-------- Original Message --------
Subject: Re: [systemd-devel] User authentication service isn't killed fully
From: Mantas Mikulėnas
To: beroal
CC: systemd-devel@xxxxxxxxxxxxxxxxxxxxx

On Sun, Dec 26, 2021 at 3:03 PM beroal <me@xxxxxxxxxxxx> wrote:

Hi. I have an autologin program which authenticates a user without asking for a password and starts a child process executing a user shell (for example, Bash, Xorg, or a Wayland compositor).

This program is a systemd service. I discovered that systemd kills the autologin program, but does not kill the child of the autologin program. As I understand from the systemd documentation, systemd should kill both.

Systemd doesn't kill child processes when stopping a service – it only kills processes found in the service's cgroup. As pam_systemd has intentionally moved your processes to a separate per-session .slice cgroup, they're no longer tied to the original .service's lifetime.

(I'm not very familiar with Wayland's requirements, but does your autologin program do anything specific that the built-in [Service] PAMName= wouldn't do anyway?)

--

Mantas Mikulėnas