From 9b4d319e9bb89116ee883381912f53823d5b2234 Mon Sep 17 00:00:00 2001

From: Ray Strode <rstrode@redhat.com>

Date: Wed, 30 Oct 2013 13:30:40 -0400

Subject: [PATCH 1/5] slave: don't run initial-setup on remote displays

GDM will run initial-setup if there are no configured user accounts

on the system.  We correctly skip checking if there are configured user

accounts on remote XDMCP displays, but incorrectly, still run initial-setup.

This commit makes sure we only every do any of the initial-setup logic

in the local display code paths.

---

 daemon/gdm-simple-slave.c | 11 +++++++++++

 1 file changed, 11 insertions(+)

diff --git a/daemon/gdm-simple-slave.c b/daemon/gdm-simple-slave.c

index 217c33b..bee6c37 100644

--- a/daemon/gdm-simple-slave.c

+++ b/daemon/gdm-simple-slave.c

@@ -1285,60 +1285,71 @@ start_greeter (GdmSimpleSlave *slave)

 {

         start_launch_environment (slave, GDM_USERNAME, NULL);

 }

 static void

 start_initial_setup (GdmSimpleSlave *slave)

 {

         slave->priv->doing_initial_setup = TRUE;

         start_launch_environment (slave, INITIAL_SETUP_USERNAME, "gnome-initial-setup");

 }

 static gboolean

 wants_autologin (GdmSimpleSlave *slave)

 {

         gboolean enabled = FALSE;

         int delay = 0;

         /* FIXME: handle wait-for-go */

         if (g_file_test (GDM_RAN_ONCE_MARKER_FILE, G_FILE_TEST_EXISTS)) {

                 return FALSE;

         }

         gdm_slave_get_timed_login_details (GDM_SLAVE (slave), &enabled, NULL, &delay);

         return enabled && delay == 0;

 }

 static gboolean

 wants_initial_setup (GdmSimpleSlave *slave)

 {

         gboolean enabled = FALSE;

+        gboolean display_is_local = FALSE;

+

+        g_object_get (G_OBJECT (slave),

+                      "display-is-local", &display_is_local,

+                      NULL);

+

+        /* don't run initial-setup on remote displays

+         */

+        if (!display_is_local) {

+                return FALSE;

+        }

         /* don't run if the system has existing users */

         if (slave->priv->have_existing_user_accounts) {

                 return FALSE;

         }

         /* don't run if initial-setup is unavailable */

         if (!can_create_environment ("gnome-initial-setup")) {

                 return FALSE;

         }

         if (!gdm_settings_direct_get_boolean (GDM_KEY_INITIAL_SETUP_ENABLE, &enabled)) {

                 return FALSE;

         }

         return enabled;

 }

 static void

 setup_session (GdmSimpleSlave *slave)

 {

         if (wants_initial_setup (slave)) {

                 start_initial_setup (slave);

         } else if (wants_autologin (slave)) {

                 /* Run the init script. gdmslave suspends until script has terminated */

                 gdm_slave_run_script (GDM_SLAVE (slave), GDMCONFDIR "/Init", GDM_USERNAME);

         } else {

                 start_greeter (slave);

         }

         create_new_session (slave);

-- 

1.8.3.1

From 29b3f4ea9c69deb3bac2edf76489fa42755d7cd2 Mon Sep 17 00:00:00 2001

From: Ray Strode <rstrode@redhat.com>

Date: Thu, 31 Oct 2013 14:57:04 -0400

Subject: [PATCH 2/5] slave: don't kill slave when client disconnects

Right now we stop the slave if a greeter running on a remote

X server exits. This is wrong, since the greeter will exit as

part of the login screen process.  We already have mechanisms in

place to reap the slave at the appropriate time, so stopping the

slave on disconnection is totally unneeded and actively harmful.

This commit drops that code.

---

 daemon/gdm-simple-slave.c | 10 ----------

 1 file changed, 10 deletions(-)

diff --git a/daemon/gdm-simple-slave.c b/daemon/gdm-simple-slave.c

index bee6c37..35951c7 100644

--- a/daemon/gdm-simple-slave.c

+++ b/daemon/gdm-simple-slave.c

@@ -816,71 +816,61 @@ on_session_client_connected (GdmSession          *session,

                                                          (GDestroyNotify)

                                                          g_object_unref);

                 g_cancellable_connect (cancellable,

                                        G_CALLBACK (g_source_remove),

                                        GINT_TO_POINTER (timeout_id),

                                        NULL);

                 g_object_weak_ref (G_OBJECT (session),

                                    (GWeakNotify)

                                    g_cancellable_cancel,

                                    cancellable);

                 g_object_weak_ref (G_OBJECT (session),

                                    (GWeakNotify)

                                    g_object_unref,

                                    cancellable);

                 g_object_weak_ref (G_OBJECT (session),

                                    (GWeakNotify)

                                    g_free,

                                    source_tag);

         }

         g_free (username);

 }

 static void

 on_session_client_disconnected (GdmSession          *session,

                                 GCredentials        *credentials,

                                 GPid                 pid_of_client,

                                 GdmSimpleSlave      *slave)

 {

-        gboolean display_is_local;

-

         g_debug ("GdmSimpleSlave: client disconnected");

-

-        g_object_get (slave,

-                      "display-is-local", &display_is_local,

-                      NULL);

-

-        if ( ! display_is_local && !slave->priv->session_is_running) {

-                gdm_slave_stop (GDM_SLAVE (slave));

-        }

 }

 static void

 on_session_cancelled (GdmSession      *session,

                       GdmSimpleSlave  *slave)

 {

         g_debug ("GdmSimpleSlave: Session was cancelled");

         queue_greeter_reset (slave);

 }

 static void

 touch_marker_file (GdmSimpleSlave *slave)

 {

         int fd;

         fd = g_creat (GDM_RAN_ONCE_MARKER_FILE, 0644);

         if (fd < 0 && errno != EEXIST) {

                 g_warning ("could not create %s to mark run, this may cause auto login "

                            "to repeat: %m", GDM_RAN_ONCE_MARKER_FILE);

                 return;

         }

         fsync (fd);

         close (fd);

 }

 static void

 create_new_session (GdmSimpleSlave  *slave)

 {

-- 

1.8.3.1

From 0c6811cc358fa1e5ff22fe3ec656c351ab94a899 Mon Sep 17 00:00:00 2001

From: Ray Strode <rstrode@redhat.com>

Date: Thu, 31 Oct 2013 15:00:26 -0400

Subject: [PATCH 3/5] manager: return ACCESS DENIED for most

 open-reauth-channel failures

gnome-shell only falls back to opening a new session if the reauth

channel fails to open because of denied access.  For XDMCP we currently

fail for other reasons.

This commit returns ACCESS DENIED for those cases as well, so the

intended fallback happens.

---

 daemon/gdm-manager.c | 34 ++++++++++++++++++++++++++++------

 1 file changed, 28 insertions(+), 6 deletions(-)

diff --git a/daemon/gdm-manager.c b/daemon/gdm-manager.c

index 74c6888..eef7233 100644

--- a/daemon/gdm-manager.c

+++ b/daemon/gdm-manager.c

@@ -698,90 +698,112 @@ gdm_manager_handle_open_session (GdmDBusManager        *manager,

                                                 address);

         g_free (address);

         return TRUE;

 }

 static gboolean

 gdm_manager_handle_open_reauthentication_channel (GdmDBusManager        *manager,

                                                   GDBusMethodInvocation *invocation,

                                                   const char            *username)

 {

         GdmManager       *self = GDM_MANAGER (manager);

         GDBusConnection  *connection;

         GdmDisplay       *display;

         const char       *sender;

         char             *seat_id;

         char             *session_id = NULL;

         GError           *error;

         char             *address;

         int               ret;

         GPid              pid;

         uid_t             caller_uid;

         g_debug ("GdmManager: trying to open reauthentication channel for user %s", username);

         sender = g_dbus_method_invocation_get_sender (invocation);

         error = NULL;

         ret = gdm_dbus_get_pid_for_name (sender, &pid, &error);

         if (!ret) {

-                g_prefix_error (&error, "Error while retrieving caller session id: ");

-                g_dbus_method_invocation_return_gerror (invocation, error);

+                g_debug ("GdmManager: could not get pid of caller: %s",

+                         error->message);

                 g_error_free (error);

+

+                g_dbus_method_invocation_return_error_literal (invocation,

+                                                               G_DBUS_ERROR,

+                                                               G_DBUS_ERROR_ACCESS_DENIED,

+                                                               "Error getting process id of caller");

                 return TRUE;

         }

         ret = gdm_dbus_get_uid_for_name (sender, &caller_uid, &error);

         if (!ret) {

-                g_prefix_error (&error, "Error while retrieving caller session id: ");

-                g_dbus_method_invocation_return_gerror (invocation, error);

+                g_debug ("GdmManager: could not get uid of caller: %s",

+                         error->message);

                 g_error_free (error);

+

+                g_dbus_method_invocation_return_error_literal (invocation,

+                                                               G_DBUS_ERROR,

+                                                               G_DBUS_ERROR_ACCESS_DENIED,

+                                                               "Error getting user id of caller");

                 return TRUE;

         }

         connection = g_dbus_method_invocation_get_connection (invocation);

         seat_id = get_seat_id_for_pid (connection, pid, &error);

         if (seat_id == NULL) {

-                g_dbus_method_invocation_return_gerror (invocation, error);

+                g_debug ("GdmManager: could not get seat id of caller: %s",

+                         error->message);

                 g_error_free (error);

+

+                g_dbus_method_invocation_return_error_literal (invocation,

+                                                               G_DBUS_ERROR,

+                                                               G_DBUS_ERROR_ACCESS_DENIED,

+                                                               "Error getting seat id of caller");

                 return TRUE;

         }

         session_id = get_session_id_for_user_on_seat (connection, username, seat_id, &error);

         if (session_id == NULL) {

-                g_dbus_method_invocation_return_gerror (invocation, error);

+                g_debug ("GdmManager: could not get session id for caller: %s",

+                         error->message);

                 g_error_free (error);

+

+                g_dbus_method_invocation_return_error_literal (invocation,

+                                                               G_DBUS_ERROR,

+                                                               G_DBUS_ERROR_ACCESS_DENIED,

+                                                               "Error getting session id for caller");

                 return TRUE;

         }

         display = gdm_display_store_find (self->priv->display_store,

                                           lookup_by_session_id,

                                           (gpointer) session_id);

         g_free (session_id);

         if (display == NULL) {

                 g_dbus_method_invocation_return_error_literal (invocation,

                                                                G_DBUS_ERROR,

                                                                G_DBUS_ERROR_ACCESS_DENIED,

                                                                _("No session available"));

                 return TRUE;

         }

         address = gdm_display_open_reauthentication_channel_sync (display,

                                                                   username,

                                                                   pid,

                                                                   caller_uid,

                                                                   NULL,

                                                                   &error);

         if (address == NULL) {

                 g_dbus_method_invocation_return_gerror (invocation, error);

                 g_error_free (error);

                 return TRUE;

         }

-- 

1.8.3.1

From c4472c5e07b5d4e35a7a0c797ba96c882d97feb7 Mon Sep 17 00:00:00 2001

From: Ray Strode <rstrode@redhat.com>

Date: Fri, 1 Nov 2013 12:40:10 -0400

Subject: [PATCH 4/5] daemon: don't require seat to locate reauth channel

With systemd, XDMCP sessions don't have associated seats.

Currently, reauth channels find the session by first looking up

the seat, which means unlocking fails for XDMCP.

This commit changes the code to determine session strictly from pid.

---

 daemon/gdm-manager.c | 503 +++++++--------------------------------------------

 1 file changed, 61 insertions(+), 442 deletions(-)

diff --git a/daemon/gdm-manager.c b/daemon/gdm-manager.c

index eef7233..6c0fe1d 100644

--- a/daemon/gdm-manager.c

+++ b/daemon/gdm-manager.c

@@ -226,605 +226,224 @@ get_uid_for_consolekit_session_id (GDBusConnection  *connection,

         }

         g_variant_get (reply, "(u)", &uid);

         g_variant_unref (reply);

         *out_uid = (uid_t) uid;

         return TRUE;

 }

 #endif

 static gboolean

 get_uid_for_session_id (GDBusConnection  *connection,

                         const char       *session_id,

                         uid_t            *uid,

                         GError          **error)

 {

 #ifdef WITH_SYSTEMD

         if (LOGIND_RUNNING()) {

                 return get_uid_for_systemd_session_id (session_id, uid, error);

         }

 #endif

 #ifdef WITH_CONSOLE_KIT

         return get_uid_for_consolekit_session_id (connection, session_id, uid, error);

 #endif

         return FALSE;

 }

-#ifdef WITH_SYSTEMD

-static char *

-get_session_id_for_user_on_seat_systemd (const char  *username,

-                                         const char  *seat,

-                                         GError     **error)

-{

-        struct passwd  *pwent;

-        uid_t           uid;

-        int             i;

-        char          **sessions;

-        char           *session = NULL;

-        int             ret;

-

-        pwent = NULL;

-        gdm_get_pwent_for_name (username, &pwent);

-

-        if (pwent == NULL) {

-                g_set_error (error,

-                             G_DBUS_ERROR,

-                             G_DBUS_ERROR_ACCESS_DENIED,

-                             _("Unable to look up UID of user %s"),

-                             username);

-                return NULL;

-        }

-

-        uid = pwent->pw_uid;

-

-        session = NULL;

-        ret = sd_seat_get_sessions (seat, &sessions, NULL, NULL);

-        if (ret < 0 || sessions == NULL) {

-                g_set_error (error,

-                             G_DBUS_ERROR,

-                             G_DBUS_ERROR_ACCESS_DENIED,

-                             "Error getting session ids from systemd: %s",

-                             ret < 0? g_strerror (-ret) : _("no sessions available"));

-                return NULL;

-        }

-

-        for (i = 0; sessions[i] != NULL; i++) {

-                char     *type;

-                char     *state;

-                gboolean  is_closing;

-                gboolean  is_x11;

-                uid_t     session_uid;

-

-                ret = sd_session_get_uid (sessions[i], &session_uid);

-

-                if (ret < 0) {

-                        g_warning ("GdmManager: could not fetch uid of session '%s': %s",

-                                   sessions[i], strerror (-ret));

-                        continue;

-                }

-

-                if (uid != session_uid) {

-                        continue;

-                }

-

-                ret = sd_session_get_type (sessions[i], &type);

-

-                if (ret < 0) {

-                        g_warning ("GdmManager: could not fetch type of session '%s': %s",

-                                   sessions[i], strerror (-ret));

-                        continue;

-                }

-

-                is_x11 = g_strcmp0 (type, "x11") == 0;

-                free (type);

-

-                if (!is_x11) {

-                        continue;

-                }

-

-                ret = sd_session_get_state (sessions[i], &state);

-                if (ret < 0) {

-                        g_warning ("GdmManager: could not fetch state of session '%s': %s",

-                                   sessions[i], strerror (-ret));

-                        continue;

-                }

-

-                is_closing = g_strcmp0 (state, "closing") == 0;

-

-                if (is_closing) {

-                        continue;

-                }

-

-                session = g_strdup (sessions[i]);

-                break;

-

-        }

-

-        if (session == NULL) {

-                g_debug ("GdmManager: There are no applicable sessions (%d looked at)", i);

-                g_set_error (error,

-                             G_DBUS_ERROR,

-                             G_DBUS_ERROR_ACCESS_DENIED,

-                             _("No sessions for %s available for reauthentication"),

-                             username);

-                return NULL;

-        }

-

-        g_debug ("GdmManager: session %s is available for reauthentication", session);

-

-        return session;

-}

-#endif

-

-#ifdef WITH_CONSOLE_KIT

-static char *

-get_session_id_for_user_on_seat_consolekit (GDBusConnection  *connection,

-                                            const char       *username,

-                                            const char       *seat,

-                                            GError          **error)

-{

-        GVariant       *reply;

-        const gchar   **sessions;

-        char           *session = NULL;

-        struct passwd  *pwent;

-        uid_t           uid;

-        int             i;

-

-        pwent = NULL;

-        gdm_get_pwent_for_name (username, &pwent);

-

-        if (pwent == NULL) {

-                g_set_error (error,

-                             G_DBUS_ERROR,

-                             G_DBUS_ERROR_ACCESS_DENIED,

-                             _("Unable to look up UID of user %s"),

-                             username);

-                return NULL;

-        }

-

-        uid = pwent->pw_uid;

-

-        reply = g_dbus_connection_call_sync (connection,

-                                             "org.freedesktop.ConsoleKit",

-                                             "/org/freedesktop/ConsoleKit/Manager",

-                                             "org.freedesktop.ConsoleKit.Manager",

-                                             "GetSessionsForUnixUser",

-                                             g_variant_new ("(u)", (guint32) uid),

-                                             G_VARIANT_TYPE ("(ao)"),

-                                             G_DBUS_CALL_FLAGS_NONE,

-                                             -1,

-                                             NULL,

-                                             error);

-        if (reply == NULL) {

-                g_set_error (error,

-                             G_DBUS_ERROR,

-                             G_DBUS_ERROR_ACCESS_DENIED,

-                             _("Unable to find session for user %s"),

-                             username);

-                return NULL;

-        }

-

-        g_variant_get_child (reply, 0, "^a&o", &sessions);

-        for (i = 0; sessions[i] != NULL; i++) {

-                GVariant *reply2;

-                GError   *error2 = NULL;

-                gchar    *display;

-                gchar    *session_seat_id;

-

-                reply2 = g_dbus_connection_call_sync (connection,

-                                                     "org.freedesktop.ConsoleKit",

-                                                     sessions[i],

-                                                     "org.freedesktop.ConsoleKit.Session",

-                                                     "GetSeatId",

-                                                     NULL,

-                                                     G_VARIANT_TYPE ("(o)"),

-                                                     G_DBUS_CALL_FLAGS_NONE,

-                                                     -1,

-                                                     NULL,

-                                                     &error2);

-                if (reply2 == NULL) {

-                        continue;

-                }

-

-                g_variant_get (reply2, "(o)", &session_seat_id);

-                g_variant_unref (reply2);

-

-                if (g_strcmp0 (seat, session_seat_id) != 0) {

-                        g_free (session_seat_id);

-                        continue;

-                }

-                g_free (session_seat_id);

-

-                reply2 = g_dbus_connection_call_sync (connection,

-                                                     "org.freedesktop.ConsoleKit",

-                                                     sessions[i],

-                                                     "org.freedesktop.ConsoleKit.Session",

-                                                     "GetX11DisplayDevice",

-                                                     NULL,

-                                                     G_VARIANT_TYPE ("(s)"),

-                                                     G_DBUS_CALL_FLAGS_NONE,

-                                                     -1,

-                                                     NULL,

-                                                     &error2);

-                if (reply2 == NULL) {

-                        continue;

-                }

-

-                g_variant_get (reply2, "(s)", &display);

-                g_variant_unref (reply2);

-

-                if (display[0] == '\0') {

-                        g_free (display);

-                        continue;

-                }

-

-                session = g_strdup (sessions[i]);

-                break;

-

-        }

-        g_free (sessions);

-        g_variant_unref (reply);

-

-        if (session == NULL) {

-                g_set_error (error,

-                             G_DBUS_ERROR,

-                             G_DBUS_ERROR_ACCESS_DENIED,

-                             _("Unable to find appropriate session for user %s"),

-                             username);

-        }

-        return session;

-}

-#endif

-

-static char *

-get_session_id_for_user_on_seat (GDBusConnection  *connection,

-                                 const char       *username,

-                                 const char       *seat,

-                                 GError          **error)

-{

-#ifdef WITH_SYSTEMD

-        if (LOGIND_RUNNING()) {

-                return get_session_id_for_user_on_seat_systemd (username, seat, error);

-        }

-#endif

-

-#ifdef WITH_CONSOLE_KIT

-        return get_session_id_for_user_on_seat_consolekit (connection, username, seat, error);

-#endif

-

-        return NULL;

-}

-

 static gboolean

 lookup_by_session_id (const char *id,

                       GdmDisplay *display,

                       gpointer    user_data)

 {

         const char *looking_for = user_data;

         char *current;

         gboolean res;

         current = gdm_display_get_session_id (display);

         res = g_strcmp0 (current, looking_for) == 0;

         g_free (current);

         return res;

 }

-#ifdef WITH_SYSTEMD

-static char *

-get_seat_id_for_pid_systemd (pid_t    pid,

-                             GError **error)

+static GdmDisplay *

+get_display_and_details_for_bus_sender (GdmManager       *self,

+                            GDBusConnection  *connection,

+                            const char       *sender,

+                            GPid             *out_pid,

+                            uid_t            *out_uid)

 {

-        char *session;

-        char *seat, *gseat;

-        int ret;

+        GdmDisplay *display = NULL;

+        char       *session_id = NULL;

+        GError     *error = NULL;

+        int         ret;

+        GPid        pid;

+        uid_t       caller_uid, session_uid;

-        session = get_session_id_for_pid_systemd (pid, error);

+        ret = gdm_dbus_get_pid_for_name (sender, &pid, &error);

-        if (session == NULL) {

-                return NULL;

+        if (!ret) {

+                g_debug ("GdmManager: Error while retrieving pid for sender: %s",

+                         error->message);

+                g_error_free (error);

+                goto out;

         }

-        seat = NULL;

-        ret = sd_session_get_seat (session, &seat;;

-        free (session);

+        ret = gdm_dbus_get_uid_for_name (sender, &caller_uid, &error);

-        if (ret < 0) {

-                g_set_error (error,

-                             GDM_DISPLAY_ERROR,

-                             GDM_DISPLAY_ERROR_GETTING_SESSION_INFO,

-                             "Error getting seat id from systemd: %s",

-                             g_strerror (-ret));

-                return NULL;

+        if (!ret) {

+                g_debug ("GdmManager: Error while retrieving uid for sender: %s",

+                         error->message);

+                g_error_free (error);

+                goto out;

         }

-        if (seat != NULL) {

-                gseat = g_strdup (seat);

-                free (seat);

+        session_id = get_session_id_for_pid (connection, pid, &error);

-                return gseat;

-        } else {

-                return NULL;

+        if (session_id == NULL) {

+                g_debug ("GdmManager: Error while retrieving session id for sender: %s",

+                         error->message);

+                g_error_free (error);

+                goto out;

         }

-}

-#endif

-

-#ifdef WITH_CONSOLE_KIT

-static char *

-get_seat_id_for_pid_consolekit (GDBusConnection  *connection,

-                                pid_t             pid,