The sessions listed in loginctl are created and their IDs assigned by systemd-logind (when asked by pam_systemd).
If /proc/*/loginuid and /proc/*/sessionid are available (set up by pam_loginuid), then logind directly takes the audit session ID as logind session ID.
If those are not available (kernel audit support disabled), then logind itself allocates a logind session ID and adds the "c" prefix to prevent collisions with audit IDs.
src/login/logind-dbus.c:870: if (asprintf(&id, "c%lu", ++m->session_counter) < 0)
On Wed, Jan 11, 2023, 05:58 hai wu <haiwu.us@xxxxxxxxx> wrote:
Where is the systemd sessionid like `c508` being generated? If kernel
auditd is disabled, then it seems systemd `loginctl list-sessions`
command would list user session ids all with `c` character prefix
instead.
I could not find the source code where these session ids got
generated. Are these session ids generated from systemd source code or
from Linux kernel source code?
systemd has this function `sd_pid_get_session` to get session id, it
seems that's parsing `/proc/self/cgroup`, instead of generating such
session ids..
Regards,
Hai
