diff options
author | Philip Withnall <withnall@endlessm.com> | 2019-06-12 09:41:45 +0100 |
---|---|---|
committer | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2019-10-28 09:44:31 +0100 |
commit | adc09af234047126b5ed65869d575c99dec3f9cc (patch) | |
tree | fea2894b0e54370cf7dc0fec474a4214ae1dc983 /src/login/pam_systemd.c | |
parent | 9ed7de605d7c1a3290e544e92ea5de6141c26bbc (diff) | |
download | systemd-adc09af234047126b5ed65869d575c99dec3f9cc.tar.gz |
pam_systemd: Forward systemd.runtime_max_sec setting to session scope
Allow earlier PAM modules to set `systemd.runtime_max_sec`. If they do,
parse it and set it as the `RuntimeMaxUSec=` property of the session
scope, to limit the maximum lifetime of the session. This could be
useful for time-limiting login sessions, for example.
Signed-off-by: Philip Withnall <withnall@endlessm.com>
Fixes: #12035
Diffstat (limited to 'src/login/pam_systemd.c')
-rw-r--r-- | src/login/pam_systemd.c | 32 |
1 files changed, 29 insertions, 3 deletions
diff --git a/src/login/pam_systemd.c b/src/login/pam_systemd.c index 3f762cbbc3..e62ed969a3 100644 --- a/src/login/pam_systemd.c +++ b/src/login/pam_systemd.c @@ -279,6 +279,27 @@ static int append_session_memory_max(pam_handle_t *handle, sd_bus_message *m, co return 0; } +static int append_session_runtime_max_sec(pam_handle_t *handle, sd_bus_message *m, const char *limit) { + usec_t val; + int r; + + /* No need to parse "infinity" here, it will be set by default later in scope_init() */ + if (isempty(limit) || streq(limit, "infinity")) + return 0; + + r = parse_sec(limit, &val); + if (r >= 0) { + r = sd_bus_message_append(m, "(sv)", "RuntimeMaxUSec", "t", (uint64_t) val); + if (r < 0) { + pam_syslog(handle, LOG_ERR, "Failed to append to bus message: %s", strerror_safe(r)); + return r; + } + } else + pam_syslog(handle, LOG_WARNING, "Failed to parse systemd.runtime_max_sec: %s, ignoring.", limit); + + return 0; +} + static int append_session_tasks_max(pam_handle_t *handle, sd_bus_message *m, const char *limit) { uint64_t val; int r; @@ -412,7 +433,7 @@ _public_ PAM_EXTERN int pam_sm_open_session( *seat = NULL, *type = NULL, *class = NULL, *class_pam = NULL, *type_pam = NULL, *cvtnr = NULL, *desktop = NULL, *desktop_pam = NULL, - *memory_max = NULL, *tasks_max = NULL, *cpu_weight = NULL, *io_weight = NULL; + *memory_max = NULL, *tasks_max = NULL, *cpu_weight = NULL, *io_weight = NULL, *runtime_max_sec = NULL; _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL; int session_fd = -1, existing, r; bool debug = false, remote; @@ -545,6 +566,7 @@ _public_ PAM_EXTERN int pam_sm_open_session( (void) pam_get_data(handle, "systemd.tasks_max", (const void **)&tasks_max); (void) pam_get_data(handle, "systemd.cpu_weight", (const void **)&cpu_weight); (void) pam_get_data(handle, "systemd.io_weight", (const void **)&io_weight); + (void) pam_get_data(handle, "systemd.runtime_max_sec", (const void **)&runtime_max_sec); /* Talk to logind over the message bus */ @@ -563,8 +585,8 @@ _public_ PAM_EXTERN int pam_sm_open_session( strempty(seat), vtnr, strempty(tty), strempty(display), yes_no(remote), strempty(remote_user), strempty(remote_host)); pam_syslog(handle, LOG_DEBUG, "Session limits: " - "memory_max=%s tasks_max=%s cpu_weight=%s io_weight=%s", - strna(memory_max), strna(tasks_max), strna(cpu_weight), strna(io_weight)); + "memory_max=%s tasks_max=%s cpu_weight=%s io_weight=%s runtime_max_sec=%s", + strna(memory_max), strna(tasks_max), strna(cpu_weight), strna(io_weight), strna(runtime_max_sec)); } r = sd_bus_message_new_method_call( @@ -608,6 +630,10 @@ _public_ PAM_EXTERN int pam_sm_open_session( if (r < 0) return PAM_SESSION_ERR; + r = append_session_runtime_max_sec(handle, m, runtime_max_sec); + if (r < 0) + return PAM_SESSION_ERR; + r = append_session_tasks_max(handle, m, tasks_max); if (r < 0) return PAM_SESSION_ERR; |