diff --git a/man/pam_systemd.xml b/man/pam_systemd.xml index 7d5fcad631..883b50b640 100644 --- a/man/pam_systemd.xml +++ b/man/pam_systemd.xml @@ -69,8 +69,7 @@ created and its ownership changed to the user that is logging in. - If - is set, the + The $XDG_SESSION_ID environment variable is initialized. If auditing is available and @@ -82,20 +81,10 @@ an independent session counter is used. - If - is set, a new - control group + A new control group /user/$USER/$XDG_SESSION_ID is created and the login process moved into it. - - If - is set, a new - control group - /user/$USER/user - is created and the login process moved into - it. - On logout, this module ensures the following: @@ -103,38 +92,13 @@ If $XDG_SESSION_ID is set and - specified, all + specified, all remaining processes in the /user/$USER/$XDG_SESSION_ID control group are killed and the control group is removed. - If - $XDG_SESSION_ID is set and - specified, all - remaining processes in the - /user/$USER/$XDG_SESSION_ID - control group are migrated to - /user/$USER/user and - the original control group is - removed. - - If - is specified, and - no other user session control group remains, - except - /user/$USER/user, - all remaining processes in the - /user/$USER hierarchy - are killed and the control group is removed. - - If - is specified, and - no process remains in the - /user/$USER hierarchy the - control group is removed. - - If the + If last subgroup of the /user/$USER control group was removed the $XDG_RUNTIME_DIR directory @@ -155,27 +119,7 @@ - - - Takes a boolean - argument. If true, a new session is - created: the - $XDG_SESSION_ID - environment variable is set and the - login process moved to the - /user/$USER/$XDG_SESSION_ID - control group. It is recommended that - all services which are directly created - on the user's behalf set this - option. Only for services that shall - automatically be terminated when the - user logs out completely, otherwise - create-session=0 - should be set. - - - - + Takes a boolean argument. If true, all processes @@ -185,22 +129,6 @@ session. - - - - Takes a boolean - argument. If true, all processes - created by the user during his session - and from his session will be - terminated after he logged out - completely. This is a weaker version - of and is - more friendly for users logged in more - than once, as their processes are - terminated only on their complete - logout. - - @@ -208,8 +136,7 @@ separated list of user names or numeric user ids as argument. If this option is used the effect of the - and - options + options will apply only to the listed users. If this option is not used the option applies to all local @@ -228,8 +155,7 @@ numeric user ids as argument. Users listed in this argument will not be subject to the effect of - or - . Note + . Note that that this option takes precedence over , and @@ -245,56 +171,59 @@ Takes a comma - separated list of cgroup controllers - in which hierarchies a user/session - cgroup will be created by default for - each user logging in, in addition to - the cgroup in the named 'name=systemd' + separated list of control group + controllers in which hierarchies a + user/session control group will be + created by default for each user + logging in, in addition to the control + group in the named 'name=systemd' hierarchy. If omitted, defaults to an - empty list. This may be used to move - user sessions into their own groups in - the 'cpu' hierarchy which ensures that - every logged in user gets an equal - amount of CPU time regardless how many - processes he has - started. + empty list. Takes a comma - separated list of cgroup controllers - in which hierarchies the logged in - processes will be reset to the root - cgroup. If omitted, defaults to 'cpu', - meaning that a 'cpu' cgroup grouping - inherited from the login manager will - be reset for the processes of the - logged in user. + separated list of control group + controllers in which hierarchies the + logged in processes will be reset to + the root control + group. Takes a boolean - argument. If true, logs debugging - information. + argument. If yes, the module will log + debugging information as it + operates. - Note that setting kill-user=1 - or even kill-session=1 will break - tools like + Note that setting + kill-session-processes=1 will break tools + like screen1. + Note that + kill-session-processes=1 is a + stricter version of + KillUserProcesses=1 which may be + configured system-wide in + systemd-logind.conf5. The + former kills processes of a session as soon as it + ends, the latter kills processes as soon as the last + session of the user ends. + If the options are omitted they default to - , - , - , - , + , , - . + , + , + , + . @@ -369,7 +298,7 @@ account required pam_unix.so password required pam_unix.so session required pam_unix.so session required pam_loginuid.so -session required pam_systemd.so kill-user=1 +session required pam_systemd.so kill-session-processes=1 @@ -379,6 +308,7 @@ session required pam_systemd.so kill-user=1 pam.d5, pam8, pam_loginuid8, + systemd-logind.conf5, systemd1 diff --git a/man/systemd-logind.conf.xml b/man/systemd-logind.conf.xml index 889bd1567e..2dc9994954 100644 --- a/man/systemd-logind.conf.xml +++ b/man/systemd-logind.conf.xml @@ -147,6 +147,20 @@ cpu. + + Note that setting + KillUserProcesses=1 will break tools + like + screen1. + + Note that KillUserProcesses=1 + is a weaker version of + kill-session-processes=1 which may + be configured per-service for + pam_systemd8. The + latter kills processes of a session as soon as it + ends, the former kills processes as soon as the last + session of the user ends. diff --git a/src/logind.h b/src/logind.h index df1364fd72..59ea799d52 100644 --- a/src/logind.h +++ b/src/logind.h @@ -36,9 +36,9 @@ * * spawn user systemd * direct client API - * add configuration file man page * verify access to SetIdleHint * add FlushDevices bus call + * hook up ACL tool for udev * * udev: * drop redundant udev_device_get_is_initialized() use as soon as libudev is fixed diff --git a/src/pam-module.c b/src/pam-module.c index 90da898ff8..a15b4cae1c 100644 --- a/src/pam-module.c +++ b/src/pam-module.c @@ -57,9 +57,9 @@ static int parse_argv(pam_handle_t *handle, for (i = 0; i < (unsigned) argc; i++) { int k; - if (startswith(argv[i], "kill-processes=")) { - if ((k = parse_boolean(argv[i] + 15)) < 0) { - pam_syslog(handle, LOG_ERR, "Failed to parse kill-processes= argument."); + if (startswith(argv[i], "kill-session-processes=")) { + if ((k = parse_boolean(argv[i] + 23)) < 0) { + pam_syslog(handle, LOG_ERR, "Failed to parse kill-session-processes= argument."); return k; }