Re: Systemd sessionid like `c508`

[hai wu <haiwu.us@xxxxxxxxx>]

Thank you Mantas!

On Tue, Jan 10, 2023 at 10:58 PM Mantas Mikulėnas <grawity@xxxxxxxxx> wrote:
>
> The sessions listed in loginctl are created and their IDs assigned by systemd-logind (when asked by pam_systemd).
>
> If /proc/*/loginuid and /proc/*/sessionid are available (set up by pam_loginuid), then logind directly takes the audit session ID as logind session ID.
>
> If those are not available (kernel audit support disabled), then logind itself allocates a logind session ID and adds the "c" prefix to prevent collisions with audit IDs.
>
> src/login/logind-dbus.c:870:                        if (asprintf(&id, "c%lu", ++m->session_counter) < 0)
>
> On Wed, Jan 11, 2023, 05:58 hai wu <haiwu.us@xxxxxxxxx> wrote:
>>
>> Where is the systemd sessionid like `c508` being generated? If kernel
>> auditd is disabled, then it seems systemd `loginctl list-sessions`
>> command would list user session ids all with `c` character prefix
>> instead.
>>
>> I could not find the source code where these session ids got
>> generated. Are these session ids generated from systemd source code or
>> from Linux kernel source code?
>>
>> systemd has this function `sd_pid_get_session` to get session id, it
>> seems that's parsing `/proc/self/cgroup`, instead of generating such
>> session ids..
>>
>> Regards,
>> Hai