AuxXxilium/eudev
1
0
Fork 0
mirror of https://github.com/AuxXxilium/eudev.git synced 2024-12-14 18:45:48 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity

man: update pam_systemd page to document new behaviour

Browse Source
This commit is contained in:
Lennart Poettering 2011-06-29 02:46:20 +02:00
parent 8fa365e586
commit c36eecdfcb
4 changed files with 60 additions and 116 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

154
man/pam_systemd.xml
View File

@ -69,8 +69,7 @@
created and its ownership changed to the user created and its ownership changed to the user
that is logging in.</para></listitem> that is logging in.</para></listitem>
<listitem><para>If <listitem><para>The
<option>create-session=1</option> is set, the
<varname>$XDG_SESSION_ID</varname> environment <varname>$XDG_SESSION_ID</varname> environment
variable is initialized. If auditing is variable is initialized. If auditing is
available and available and
@ -82,20 +81,10 @@
an independent session counter is an independent session counter is
used.</para></listitem> used.</para></listitem>
<listitem><para>If <listitem><para>A new control group
<option>create-session=1</option> is set, a new
control group
<filename>/user/$USER/$XDG_SESSION_ID</filename> <filename>/user/$USER/$XDG_SESSION_ID</filename>
is created and the login process moved into is created and the login process moved into
it.</para></listitem> it.</para></listitem>
<listitem><para>If
<option>create-session=0</option> is set, a new
control group
<filename>/user/$USER/user</filename>
is created and the login process moved into
it.</para></listitem>
</orderedlist> </orderedlist>
<para>On logout, this module ensures the following:</para> <para>On logout, this module ensures the following:</para>
@ -103,38 +92,13 @@
<orderedlist> <orderedlist>
<listitem><para>If <listitem><para>If
<varname>$XDG_SESSION_ID</varname> is set and <varname>$XDG_SESSION_ID</varname> is set and
<option>kill-session=1</option> specified, all <option>kill-session-processes=1</option> specified, all
remaining processes in the remaining processes in the
<filename>/user/$USER/$XDG_SESSION_ID</filename> <filename>/user/$USER/$XDG_SESSION_ID</filename>
control group are killed and the control group control group are killed and the control group
is removed.</para></listitem> is removed.</para></listitem>
<listitem><para>If <listitem><para>If last subgroup of the
<varname>$XDG_SESSION_ID</varname> is set and
<option>kill-session=0</option> specified, all
remaining processes in the
<filename>/user/$USER/$XDG_SESSION_ID</filename>
control group are migrated to
<filename>/user/$USER/user</filename> and
the original control group is
removed.</para></listitem>
<listitem><para>If
<option>kill-user=1</option> is specified, and
no other user session control group remains,
except
<filename>/user/$USER/user</filename>,
all remaining processes in the
<filename>/user/$USER</filename> hierarchy
are killed and the control group is removed.</para></listitem>
<listitem><para>If
<option>kill-user=0</option> is specified, and
no process remains in the
<filename>/user/$USER</filename> hierarchy the
control group is removed.</para></listitem>
<listitem><para>If the
<filename>/user/$USER</filename> control group <filename>/user/$USER</filename> control group
was removed the was removed the
<varname>$XDG_RUNTIME_DIR</varname> directory <varname>$XDG_RUNTIME_DIR</varname> directory
@ -155,27 +119,7 @@
<variablelist> <variablelist>
<varlistentry> <varlistentry>
<term><option>create-session=</option></term> <term><option>kill-session-processes=</option></term>
<listitem><para>Takes a boolean
argument. If true, a new session is
created: the
<varname>$XDG_SESSION_ID</varname>
environment variable is set and the
login process moved to the
<filename>/user/$USER/$XDG_SESSION_ID</filename>
control group. It is recommended that
all services which are directly created
on the user's behalf set this
option. Only for services that shall
automatically be terminated when the
user logs out completely, otherwise
<varname>create-session=0</varname>
should be set.</para></listitem>
</varlistentry>
<varlistentry>
<term><option>kill-session=</option></term>
<listitem><para>Takes a boolean <listitem><para>Takes a boolean
argument. If true, all processes argument. If true, all processes
@ -185,22 +129,6 @@
session.</para></listitem> session.</para></listitem>
</varlistentry> </varlistentry>
<varlistentry>
<term><option>kill-user=</option></term>
<listitem><para>Takes a boolean
argument. If true, all processes
created by the user during his session
and from his session will be
terminated after he logged out
completely. This is a weaker version
of <option>kill-session=1</option> and is
more friendly for users logged in more
than once, as their processes are
terminated only on their complete
logout.</para></listitem>
</varlistentry>
<varlistentry> <varlistentry>
<term><option>kill-only-users=</option></term> <term><option>kill-only-users=</option></term>
@ -208,8 +136,7 @@
separated list of user names or separated list of user names or
numeric user ids as argument. If this numeric user ids as argument. If this
option is used the effect of the option is used the effect of the
<option>kill-session=</option> and <option>kill-session-processes=</option> options
<option>kill-user=</option> options
will apply only to the listed will apply only to the listed
users. If this option is not used the users. If this option is not used the
option applies to all local option applies to all local
@ -228,8 +155,7 @@
numeric user ids as argument. Users numeric user ids as argument. Users
listed in this argument will not be listed in this argument will not be
subject to the effect of subject to the effect of
<option>kill-session=</option> or <option>kill-session-processes=</option>. Note
<option>kill-user=</option>. Note
that that this option takes precedence that that this option takes precedence
over over
<option>kill-only-users=</option>, and <option>kill-only-users=</option>, and
@ -245,56 +171,59 @@
<term><option>controllers=</option></term> <term><option>controllers=</option></term>
<listitem><para>Takes a comma <listitem><para>Takes a comma
separated list of cgroup controllers separated list of control group
in which hierarchies a user/session controllers in which hierarchies a
cgroup will be created by default for user/session control group will be
each user logging in, in addition to created by default for each user
the cgroup in the named 'name=systemd' logging in, in addition to the control
group in the named 'name=systemd'
hierarchy. If omitted, defaults to an hierarchy. If omitted, defaults to an
empty list. This may be used to move empty list.</para></listitem>
user sessions into their own groups in
the 'cpu' hierarchy which ensures that
every logged in user gets an equal
amount of CPU time regardless how many
processes he has
started.</para></listitem>
</varlistentry> </varlistentry>
<varlistentry> <varlistentry>
<term><option>reset-controllers=</option></term> <term><option>reset-controllers=</option></term>
<listitem><para>Takes a comma <listitem><para>Takes a comma
separated list of cgroup controllers separated list of control group
in which hierarchies the logged in controllers in which hierarchies the
processes will be reset to the root logged in processes will be reset to
cgroup. If omitted, defaults to 'cpu', the root control
meaning that a 'cpu' cgroup grouping group.</para></listitem>
inherited from the login manager will
be reset for the processes of the
logged in user.</para></listitem>
</varlistentry> </varlistentry>
<varlistentry> <varlistentry>
<term><option>debug=</option></term> <term><option>debug=</option></term>
<listitem><para>Takes a boolean <listitem><para>Takes a boolean
argument. If true, logs debugging argument. If yes, the module will log
information.</para></listitem> debugging information as it
operates.</para></listitem>
</varlistentry> </varlistentry>
</variablelist> </variablelist>
<para>Note that setting <varname>kill-user=1</varname> <para>Note that setting
or even <varname>kill-session=1</varname> will break <varname>kill-session-processes=1</varname> will break tools
tools like like
<citerefentry><refentrytitle>screen</refentrytitle><manvolnum>1</manvolnum></citerefentry>.</para> <citerefentry><refentrytitle>screen</refentrytitle><manvolnum>1</manvolnum></citerefentry>.</para>
<para>Note that
<varname>kill-session-processes=1</varname> is a
stricter version of
<varname>KillUserProcesses=1</varname> which may be
configured system-wide in
<citerefentry><refentrytitle>systemd-logind.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>. The
former kills processes of a session as soon as it
ends, the latter kills processes as soon as the last
session of the user ends.</para>
<para>If the options are omitted they default to <para>If the options are omitted they default to
<option>create-session=1</option>, <option>kill-session-processes=0</option>,
<option>kill-session=0</option>,
<option>kill-user=0</option>,
<option>reset-controllers=cpu</option>,
<option>kill-only-users=</option>, <option>kill-only-users=</option>,
<option>kill-exclude-users=root</option>.</para> <option>kill-exclude-users=</option>,
<option>controllers=</option>,
<option>reset-controllers=</option>,
<option>debug=no</option>.</para>
</refsect1> </refsect1>
<refsect1> <refsect1>
@ -369,7 +298,7 @@ account required pam_unix.so
password required pam_unix.so password required pam_unix.so
session required pam_unix.so session required pam_unix.so
session required pam_loginuid.so session required pam_loginuid.so
session required pam_systemd.so kill-user=1</programlisting> session required pam_systemd.so kill-session-processes=1</programlisting>
</refsect1> </refsect1>
<refsect1> <refsect1>
@ -379,6 +308,7 @@ session required pam_systemd.so kill-user=1</programlisting>
<citerefentry><refentrytitle>pam.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>, <citerefentry><refentrytitle>pam.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
<citerefentry><refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum></citerefentry>, <citerefentry><refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
<citerefentry><refentrytitle>pam_loginuid</refentrytitle><manvolnum>8</manvolnum></citerefentry>, <citerefentry><refentrytitle>pam_loginuid</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
<citerefentry><refentrytitle>systemd-logind.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry> <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
</para> </para>
</refsect1> </refsect1>

14
man/systemd-logind.conf.xml
View File

@ -147,6 +147,20 @@
<literal>cpu</literal>.</para></listitem> <literal>cpu</literal>.</para></listitem>
</varlistentry> </varlistentry>
</variablelist> </variablelist>
<para>Note that setting
<varname>KillUserProcesses=1</varname> will break tools
like
<citerefentry><refentrytitle>screen</refentrytitle><manvolnum>1</manvolnum></citerefentry>.</para>
<para>Note that <varname>KillUserProcesses=1</varname>
is a weaker version of
<varname>kill-session-processes=1</varname> which may
be configured per-service for
<citerefentry><refentrytitle>pam_systemd</refentrytitle><manvolnum>8</manvolnum></citerefentry>. The
latter kills processes of a session as soon as it
ends, the former kills processes as soon as the last
session of the user ends.</para>
</refsect1> </refsect1>
<refsect1> <refsect1>

2
src/logind.h
View File

@ -36,9 +36,9 @@
* *
* spawn user systemd * spawn user systemd
* direct client API * direct client API
* add configuration file man page
* verify access to SetIdleHint * verify access to SetIdleHint
* add FlushDevices bus call * add FlushDevices bus call
* hook up ACL tool for udev
* *
* udev: * udev:
* drop redundant udev_device_get_is_initialized() use as soon as libudev is fixed * drop redundant udev_device_get_is_initialized() use as soon as libudev is fixed

6
src/pam-module.c
View File

@ -57,9 +57,9 @@ static int parse_argv(pam_handle_t *handle,
for (i = 0; i < (unsigned) argc; i++) { for (i = 0; i < (unsigned) argc; i++) {
int k; int k;
if (startswith(argv[i], "kill-processes=")) { if (startswith(argv[i], "kill-session-processes=")) {
if ((k = parse_boolean(argv[i] + 15)) < 0) { if ((k = parse_boolean(argv[i] + 23)) < 0) {
pam_syslog(handle, LOG_ERR, "Failed to parse kill-processes= argument."); pam_syslog(handle, LOG_ERR, "Failed to parse kill-session-processes= argument.");
return k; return k;
} }