Using libpam with systemd but without systemd-logind

Using libpam with systemd but without systemd-logind

[Matt Spinler]

Hi,

Our embedded system uses systemd and libpam, but doesn't use systemd's
logind package.

The libpam recipe,
https://github.com/openembedded/openembedded-core/blob/master/meta/recipes-extended/pam/libpam_1.3.0.bb#L149,
will add pam_systemd.so to common-session if it detects systemd is used.

However, systemd will only even build pam_systemd.so if the logind 
package is enabled, shown here:
https://github.com/systemd/systemd/blob/15b1180945f2cfa0f7938626ff060c8b52606a1a/meson.build#L1747

So in our case, since we are explicitly disabling logind, pam will 
complain
in the journal about not being able to find pam_systemd.so.

As logind isn't a systemd distro feature, I'm not sure how libpam can 
really know
that it doesn't need to add pam_systemd.so to common-session?

Does anyone have any ideas on ways to handle this?

Thanks,
Matt

Re: [oe] Using libpam with systemd but without systemd-logind

[Peter Kjellerstedt]

[ This discussion really belongs on the openembedded-core mailing list 
  since it concerns libpam and systemd, both of which are part of OE-Core, 
  so that is where I am responding. However, I have kept openembeded-devel 
  as bcc: to inform of this move. ]

> -----Original Message-----
> From: openembedded-devel-bounces@lists.openembedded.org <openembedded-
> devel-bounces@lists.openembedded.org> On Behalf Of Matt Spinler
> Sent: den 26 oktober 2018 17:25
> To: openembedded-devel@lists.openembedded.org
> Subject: [oe] Using libpam with systemd but without systemd-logind
> 
> Hi,
> 
> Our embedded system uses systemd and libpam, but doesn't use systemd's
> logind package.
> 
> The libpam recipe,
> https://github.com/openembedded/openembedded-core/blob/master/meta/recipes-extended/pam/libpam_1.3.0.bb#L149,
> will add pam_systemd.so to common-session if it detects systemd is
> used.
> 
> However, systemd will only even build pam_systemd.so if the logind
> package is enabled, shown here:
> https://github.com/systemd/systemd/blob/15b1180945f2cfa0f7938626ff060c8b52606a1a/meson.build#L1747
> 
> So in our case, since we are explicitly disabling logind, pam will
> complain in the journal about not being able to find pam_systemd.so.
> 
> As logind isn't a systemd distro feature, I'm not sure how libpam can
> really know that it doesn't need to add pam_systemd.so to common-session?
> 
> Does anyone have any ideas on ways to handle this?
> 
> Thanks,
> Matt

I am by no means any PAM expert, but prefixing the line inserted into 
/etc/pam.d/common-session with a '-' should make libpam not output 
anything to the logs if pam_systemd.so does not exist.

//Peter

Re: Using libpam with systemd but without systemd-logind

[Peter Kjellerstedt]

[ This discussion really belongs on the openembedded-core mailing list 
  since it concerns libpam and systemd, both of which are part of OE-Core, 
  so that is where I am responding. However, I have kept openembeded-devel 
  as bcc: to inform of this move. ]

> -----Original Message-----
> From: openembedded-devel-bounces@lists.openembedded.org <openembedded-
> devel-bounces@lists.openembedded.org> On Behalf Of Matt Spinler
> Sent: den 26 oktober 2018 17:25
> To: openembedded-devel@lists.openembedded.org
> Subject: [oe] Using libpam with systemd but without systemd-logind
> 
> Hi,
> 
> Our embedded system uses systemd and libpam, but doesn't use systemd's
> logind package.
> 
> The libpam recipe,
> https://github.com/openembedded/openembedded-core/blob/master/meta/recipes-extended/pam/libpam_1.3.0.bb#L149,
> will add pam_systemd.so to common-session if it detects systemd is
> used.
> 
> However, systemd will only even build pam_systemd.so if the logind
> package is enabled, shown here:
> https://github.com/systemd/systemd/blob/15b1180945f2cfa0f7938626ff060c8b52606a1a/meson.build#L1747
> 
> So in our case, since we are explicitly disabling logind, pam will
> complain in the journal about not being able to find pam_systemd.so.
> 
> As logind isn't a systemd distro feature, I'm not sure how libpam can
> really know that it doesn't need to add pam_systemd.so to common-session?
> 
> Does anyone have any ideas on ways to handle this?
> 
> Thanks,
> Matt

I am by no means any PAM expert, but prefixing the line inserted into 
/etc/pam.d/common-session with a '-' should make libpam not output 
anything to the logs if pam_systemd.so does not exist.

//Peter

Re: [oe] Using libpam with systemd but without systemd-logind

[Richard Purdie]

On Sat, 2018-10-27 at 10:36 +0000, Peter Kjellerstedt wrote:
> 
> > Our embedded system uses systemd and libpam, but doesn't use
> > systemd's logind package.
> > 
> > The libpam recipe,
> > 
https://github.com/openembedded/openembedded-core/blob/master/meta/recipes-extended/pam/libpam_1.3.0.bb#L149
> > ,
> > will add pam_systemd.so to common-session if it detects systemd is
> > used.
> > 
> > However, systemd will only even build pam_systemd.so if the logind
> > package is enabled, shown here:
> > 
https://github.com/systemd/systemd/blob/15b1180945f2cfa0f7938626ff060c8b52606a1a/meson.build#L1747
> > 
> > So in our case, since we are explicitly disabling logind, pam will
> > complain in the journal about not being able to find
> > pam_systemd.so.
> > 
> > As logind isn't a systemd distro feature, I'm not sure how libpam
> > can
> > really know that it doesn't need to add pam_systemd.so to common-
> > session?
> > 
> > Does anyone have any ideas on ways to handle this?
> 
> I am by no means any PAM expert, but prefixing the line inserted
> into 
> /etc/pam.d/common-session with a '-' should make libpam not output 
> anything to the logs if pam_systemd.so does not exist.

The best way I can think of is if each recipe have their own
PACKAGECONFIG entries as appropriate and then your distro configures
both recipes to do the right thing?

Cheers,

Richard