daandemeyer / rpms / systemd

Forked from rpms/systemd 2 years ago
Clone
09f814
From 0ef48896d9f23b9fd547a532a4e6e6b8f8b12901 Mon Sep 17 00:00:00 2001
09f814
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
09f814
Date: Wed, 23 Nov 2022 16:09:56 +0100
09f814
Subject: [PATCH 2/2] pam: add a call to pam_namespace
09f814
09f814
A call to pam_namespace is required so that children of user@.service end up in
09f814
a namespace as expected. pam_namespace gets called as part of the stack that
09f814
creates a session (login, sshd, gdm, etc.) and those processes end up in a
09f814
namespace, but it also needs to be called from our stack which is parallel and
09f814
descends from pid1 itself.
09f814
09f814
The call to pam_namespace is similar to the call to pam_keyinit that was added
09f814
in ab79099d1684457d040ee7c28b2012e8c1ea9a4f. The pam stack for user@.service
09f814
creates a new session which is disconnected from the parent environment. Both
09f814
calls are not suitable for inclusion in the shared part of the stack (e.g.
09f814
@system-auth on Fedora/RHEL systems), because for example su/sudo/runuser
09f814
should not include them.
09f814
09f814
Fixes #17043 (Allow to execute user service into dedicated namespace
09f814
              if pam_namespace enabled)
09f814
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1861836
09f814
(Polyinstantiation is ignored/bypassed in GNOME sessions)
09f814
---
09f814
 src/login/systemd-user.in | 1 +
09f814
 1 file changed, 1 insertion(+)
09f814
09f814
diff --git a/src/login/systemd-user.in b/src/login/systemd-user.in
09f814
index d5597d28cb..06f7e36458 100644
09f814
--- a/src/login/systemd-user.in
09f814
+++ b/src/login/systemd-user.in
09f814
@@ -15,6 +15,7 @@ session  required pam_selinux.so nottys open
09f814
 {% endif %}
09f814
 session  required pam_loginuid.so
09f814
 session  optional pam_keyinit.so force revoke
09f814
+session  required pam_namespace.so
09f814
 {% if ENABLE_HOMED %}
09f814
 -session  optional pam_systemd_home.so
09f814
 {% endif %}
09f814
-- 
09f814
2.38.1
09f814