]>
Commit | Line | Data |
---|---|---|
160cd5c9 | 1 | <?xml version='1.0'?> <!--*-nxml-*--> |
3a54a157 | 2 | <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" |
12b42c76 | 3 | "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"> |
db9ecf05 | 4 | <!-- SPDX-License-Identifier: LGPL-2.1-or-later --> |
160cd5c9 | 5 | |
4623eecb | 6 | <refentry id="pam_systemd" conditional='HAVE_PAM' xmlns:xi="http://www.w3.org/2001/XInclude"> |
160cd5c9 | 7 | |
798d3a52 ZJS |
8 | <refentryinfo> |
9 | <title>pam_systemd</title> | |
10 | <productname>systemd</productname> | |
798d3a52 ZJS |
11 | </refentryinfo> |
12 | ||
13 | <refmeta> | |
14 | <refentrytitle>pam_systemd</refentrytitle> | |
15 | <manvolnum>8</manvolnum> | |
16 | </refmeta> | |
17 | ||
18 | <refnamediv> | |
19 | <refname>pam_systemd</refname> | |
20 | <refpurpose>Register user sessions in the systemd login manager</refpurpose> | |
21 | </refnamediv> | |
22 | ||
23 | <refsynopsisdiv> | |
24 | <para><filename>pam_systemd.so</filename></para> | |
25 | </refsynopsisdiv> | |
26 | ||
27 | <refsect1> | |
28 | <title>Description</title> | |
29 | ||
30 | <para><command>pam_systemd</command> registers user sessions with | |
31 | the systemd login manager | |
32 | <citerefentry><refentrytitle>systemd-logind.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>, | |
33 | and hence the systemd control group hierarchy.</para> | |
34 | ||
fc89f88e | 35 | <para>The module also applies various resource management and runtime parameters to the new session, as |
d6029680 | 36 | configured in the <ulink url="https://systemd.io/USER_RECORD">JSON User Records</ulink> of the user, when |
fc89f88e LP |
37 | one is defined.</para> |
38 | ||
66a5b902 LP |
39 | <para>On login, this module — in conjunction with <filename>systemd-logind.service</filename> — ensures the |
40 | following:</para> | |
798d3a52 ZJS |
41 | |
42 | <orderedlist> | |
66a5b902 LP |
43 | <listitem><para>If it does not exist yet, the user runtime directory <filename>/run/user/$UID</filename> is |
44 | either created or mounted as new <literal>tmpfs</literal> file system with quota applied, and its ownership | |
45 | changed to the user that is logging in.</para></listitem> | |
46 | ||
47 | <listitem><para>The <varname>$XDG_SESSION_ID</varname> environment variable is initialized. If auditing is | |
48 | available and <command>pam_loginuid.so</command> was run before this module (which is highly recommended), the | |
49 | variable is initialized from the auditing session id (<filename>/proc/self/sessionid</filename>). Otherwise, an | |
798d3a52 ZJS |
50 | independent session counter is used.</para></listitem> |
51 | ||
66a5b902 LP |
52 | <listitem><para>A new systemd scope unit is created for the session. If this is the first concurrent session of |
53 | the user, an implicit per-user slice unit below <filename>user.slice</filename> is automatically created and the | |
54 | scope placed into it. An instance of the system service <filename>user@.service</filename>, which runs the | |
fc89f88e LP |
55 | systemd user manager instance, is started.</para></listitem> |
56 | ||
57 | <listitem><para>The <literal>$TZ</literal>, <literal>$EMAIL</literal> and <literal>$LANG</literal> | |
58 | environment variables are configured for the user, based on the respective data from the user's JSON | |
59 | record (if it is defined). Moreover, any environment variables explicitly configured in the user record | |
60 | are imported, and the umask, nice level, and resource limits initialized.</para></listitem> | |
798d3a52 ZJS |
61 | </orderedlist> |
62 | ||
63 | <para>On logout, this module ensures the following:</para> | |
64 | ||
65 | <orderedlist> | |
66 | <listitem><para>If enabled in | |
67 | <citerefentry><refentrytitle>logind.conf</refentrytitle> | |
66a5b902 LP |
68 | <manvolnum>5</manvolnum></citerefentry> (<varname>KillUserProcesses=</varname>), all processes of the session are |
69 | terminated. If the last concurrent session of a user ends, the user's systemd instance will be terminated too, | |
70 | and so will the user's slice unit.</para></listitem> | |
798d3a52 ZJS |
71 | |
72 | <listitem><para>If the last concurrent session of a user ends, | |
5c50321c | 73 | the user runtime directory <filename>/run/user/$UID</filename> and all its |
798d3a52 ZJS |
74 | contents are removed, too.</para></listitem> |
75 | </orderedlist> | |
76 | ||
77 | <para>If the system was not booted up with systemd as init system, | |
78 | this module does nothing and immediately returns | |
79 | <constant>PAM_SUCCESS</constant>.</para> | |
80 | ||
81 | </refsect1> | |
82 | ||
83 | <refsect1> | |
84 | <title>Options</title> | |
85 | ||
86 | <para>The following options are understood:</para> | |
87 | ||
88 | <variablelist class='pam-directives'> | |
89 | ||
90 | <varlistentry> | |
2691d65c | 91 | <term><varname>class=</varname></term> |
798d3a52 | 92 | |
b115f33c LP |
93 | <listitem><para>Takes a string argument which sets the session class. The <varname>XDG_SESSION_CLASS</varname> |
94 | environment variable (see below) takes precedence. One of <literal>user</literal>, <literal>greeter</literal>, | |
95 | <literal>lock-screen</literal> or <literal>background</literal>. See | |
96 | <citerefentry><refentrytitle>sd_session_get_class</refentrytitle><manvolnum>3</manvolnum></citerefentry> for | |
ec07c3c8 AK |
97 | details about the session class.</para> |
98 | ||
99 | <xi:include href="version-info.xml" xpointer="v197"/></listitem> | |
798d3a52 ZJS |
100 | </varlistentry> |
101 | ||
102 | <varlistentry> | |
2691d65c | 103 | <term><varname>type=</varname></term> |
798d3a52 | 104 | |
b115f33c LP |
105 | <listitem><para>Takes a string argument which sets the session type. The <varname>XDG_SESSION_TYPE</varname> |
106 | environment variable (see below) takes precedence. One of <literal>unspecified</literal>, | |
107 | <literal>tty</literal>, <literal>x11</literal>, <literal>wayland</literal> or <literal>mir</literal>. See | |
108 | <citerefentry><refentrytitle>sd_session_get_type</refentrytitle><manvolnum>3</manvolnum></citerefentry> for | |
ec07c3c8 AK |
109 | details about the session type.</para> |
110 | ||
111 | <xi:include href="version-info.xml" xpointer="v209"/></listitem> | |
b115f33c LP |
112 | </varlistentry> |
113 | ||
114 | <varlistentry> | |
2691d65c | 115 | <term><varname>desktop=</varname></term> |
b115f33c LP |
116 | |
117 | <listitem><para>Takes a single, short identifier string for the desktop environment. The | |
118 | <varname>XDG_SESSION_DESKTOP</varname> environment variable (see below) takes precedence. This may be used to | |
119 | indicate the session desktop used, where this applies and if this information is available. For example: | |
120 | <literal>GNOME</literal>, or <literal>KDE</literal>. It is recommended to use the same identifiers and | |
121 | capitalization as for <varname>$XDG_CURRENT_DESKTOP</varname>, as defined by the <ulink | |
41d6f3bf | 122 | url="https://standards.freedesktop.org/desktop-entry-spec/latest/">Desktop Entry |
b115f33c LP |
123 | Specification</ulink>. (However, note that the option only takes a single item, and not a colon-separated list |
124 | like <varname>$XDG_CURRENT_DESKTOP</varname>.) See | |
125 | <citerefentry><refentrytitle>sd_session_get_desktop</refentrytitle><manvolnum>3</manvolnum></citerefentry> for | |
ec07c3c8 AK |
126 | further details.</para> |
127 | ||
128 | <xi:include href="version-info.xml" xpointer="v240"/></listitem> | |
798d3a52 ZJS |
129 | </varlistentry> |
130 | ||
bf1b9ae4 LP |
131 | <varlistentry> |
132 | <term><varname>default-capability-bounding-set=</varname></term> | |
133 | <term><varname>default-capability-ambient-set=</varname></term> | |
134 | ||
135 | <listitem><para>Takes a comma-separated list of process capabilities | |
136 | (e.g. <constant>CAP_WAKE_ALARM</constant>, <constant>CAP_BLOCK_SUSPEND</constant>, …) to set for the | |
137 | invoked session's processes, if the user record does not encode appropriate sets of capabilities | |
138 | directly. See <citerefentry | |
139 | project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry> | |
140 | for details on the capabilities concept. If not specified, the default bounding set is left as is | |
141 | (i.e. usually contains the full set of capabilities). The default ambient set is set to | |
142 | <constant>CAP_WAKE_ALARM</constant> for regular users if the PAM session is associated with a local | |
143 | seat or if it is invoked for the <literal>systemd-user</literal> service. Otherwise defaults to the | |
ec07c3c8 AK |
144 | empty set.</para> |
145 | ||
146 | <xi:include href="version-info.xml" xpointer="v254"/></listitem> | |
bf1b9ae4 LP |
147 | </varlistentry> |
148 | ||
798d3a52 | 149 | <varlistentry> |
2691d65c | 150 | <term><varname>debug</varname><optional>=</optional></term> |
798d3a52 | 151 | |
b115f33c LP |
152 | <listitem><para>Takes an optional boolean argument. If yes or without the argument, the module will log |
153 | debugging information as it operates.</para></listitem> | |
798d3a52 ZJS |
154 | </varlistentry> |
155 | </variablelist> | |
156 | </refsect1> | |
157 | ||
158 | <refsect1> | |
159 | <title>Module Types Provided</title> | |
160 | ||
161 | <para>Only <option>session</option> is provided.</para> | |
162 | </refsect1> | |
163 | ||
164 | <refsect1> | |
165 | <title>Environment</title> | |
166 | ||
b115f33c LP |
167 | <para>The following environment variables are initialized by the module and available to the processes of the |
168 | user's session:</para> | |
798d3a52 ZJS |
169 | |
170 | <variablelist class='environment-variables'> | |
171 | <varlistentry> | |
172 | <term><varname>$XDG_SESSION_ID</varname></term> | |
173 | ||
b115f33c LP |
174 | <listitem><para>A short session identifier, suitable to be used in filenames. The string itself should be |
175 | considered opaque, although often it is just the audit session ID as reported by | |
176 | <filename>/proc/self/sessionid</filename>. Each ID will be assigned only once during machine uptime. It may | |
177 | hence be used to uniquely label files or other resources of this session. Combine this ID with the boot | |
178 | identifier, as returned by | |
179 | <citerefentry><refentrytitle>sd_id128_get_boot</refentrytitle><manvolnum>3</manvolnum></citerefentry>, for a | |
e9dd6984 | 180 | globally unique identifier.</para></listitem> |
798d3a52 ZJS |
181 | </varlistentry> |
182 | ||
183 | <varlistentry> | |
184 | <term><varname>$XDG_RUNTIME_DIR</varname></term> | |
185 | ||
186 | <listitem><para>Path to a user-private user-writable directory | |
187 | that is bound to the user login time on the machine. It is | |
188 | automatically created the first time a user logs in and | |
189 | removed on the user's final logout. If a user logs in twice at | |
190 | the same time, both sessions will see the same | |
191 | <varname>$XDG_RUNTIME_DIR</varname> and the same contents. If | |
192 | a user logs in once, then logs out again, and logs in again, | |
193 | the directory contents will have been lost in between, but | |
194 | applications should not rely on this behavior and must be able | |
195 | to deal with stale files. To store session-private data in | |
196 | this directory, the user should include the value of | |
197 | <varname>$XDG_SESSION_ID</varname> in the filename. This | |
198 | directory shall be used for runtime file system objects such | |
199 | as <constant>AF_UNIX</constant> sockets, FIFOs, PID files and | |
200 | similar. It is guaranteed that this directory is local and | |
201 | offers the greatest possible file system feature set the | |
b938cb90 | 202 | operating system provides. For further details, see the <ulink |
41d6f3bf | 203 | url="https://standards.freedesktop.org/basedir-spec/basedir-spec-latest.html">XDG |
5c50321c AHL |
204 | Base Directory Specification</ulink>. <varname>$XDG_RUNTIME_DIR</varname> |
205 | is not set if the current user is not the original user of the session.</para></listitem> | |
798d3a52 ZJS |
206 | </varlistentry> |
207 | ||
fc89f88e LP |
208 | <varlistentry> |
209 | <term><varname>$TZ</varname></term> | |
210 | <term><varname>$EMAIL</varname></term> | |
211 | <term><varname>$LANG</varname></term> | |
212 | ||
213 | <listitem><para>If a JSON user record is known for the user logging in these variables are | |
ec07c3c8 AK |
214 | initialized from the respective data in the record.</para> |
215 | ||
216 | <xi:include href="version-info.xml" xpointer="v245"/></listitem> | |
fc89f88e LP |
217 | </varlistentry> |
218 | ||
798d3a52 ZJS |
219 | </variablelist> |
220 | ||
b115f33c LP |
221 | <para>The following environment variables are read by the module and may be used by the PAM service to pass |
222 | metadata to the module. If these variables are not set when the PAM module is invoked but can be determined | |
223 | otherwise they are set by the module, so that these variables are initialized for the session and applications if | |
224 | known at all.</para> | |
798d3a52 ZJS |
225 | |
226 | <variablelist class='environment-variables'> | |
227 | <varlistentry> | |
228 | <term><varname>$XDG_SESSION_TYPE</varname></term> | |
229 | ||
98647fa0 | 230 | <listitem><para>The session type. This may be used instead of <varname>type=</varname> on the module parameter |
ec07c3c8 AK |
231 | line, and is usually preferred.</para> |
232 | ||
233 | <xi:include href="version-info.xml" xpointer="v209"/></listitem> | |
798d3a52 ZJS |
234 | </varlistentry> |
235 | ||
236 | <varlistentry> | |
237 | <term><varname>$XDG_SESSION_CLASS</varname></term> | |
238 | ||
2691d65c | 239 | <listitem><para>The session class. This may be used instead of <varname>class=</varname> on the module parameter |
ec07c3c8 AK |
240 | line, and is usually preferred.</para> |
241 | ||
242 | <xi:include href="version-info.xml" xpointer="v209"/></listitem> | |
798d3a52 ZJS |
243 | </varlistentry> |
244 | ||
245 | <varlistentry> | |
246 | <term><varname>$XDG_SESSION_DESKTOP</varname></term> | |
247 | ||
2691d65c | 248 | <listitem><para>The desktop identifier. This may be used instead of <varname>desktop=</varname> on the module |
ec07c3c8 AK |
249 | parameter line, and is usually preferred.</para> |
250 | ||
251 | <xi:include href="version-info.xml" xpointer="v209"/></listitem> | |
798d3a52 ZJS |
252 | </varlistentry> |
253 | ||
254 | <varlistentry> | |
255 | <term><varname>$XDG_SEAT</varname></term> | |
256 | ||
257 | <listitem><para>The seat name the session shall be registered | |
ec07c3c8 AK |
258 | for, if any.</para> |
259 | ||
260 | <xi:include href="version-info.xml" xpointer="v209"/></listitem> | |
798d3a52 ZJS |
261 | </varlistentry> |
262 | ||
263 | <varlistentry> | |
264 | <term><varname>$XDG_VTNR</varname></term> | |
265 | ||
266 | <listitem><para>The VT number the session shall be registered | |
267 | for, if any. (Only applies to seats with a VT available, such | |
ec07c3c8 AK |
268 | as <literal>seat0</literal>)</para> |
269 | ||
270 | <xi:include href="version-info.xml" xpointer="v209"/></listitem> | |
798d3a52 | 271 | </varlistentry> |
798d3a52 | 272 | </variablelist> |
2230a290 | 273 | |
1acfbbff LP |
274 | <para>If not set, <command>pam_systemd</command> will initialize |
275 | <varname>$XDG_SEAT</varname> and <varname>$XDG_VTNR</varname> | |
276 | based on the <varname>$DISPLAY</varname> variable (if the latter is set).</para> | |
798d3a52 ZJS |
277 | </refsect1> |
278 | ||
22f93314 JS |
279 | <refsect1> |
280 | <title>Session limits</title> | |
281 | ||
282 | <para>PAM modules earlier in the stack, that is those that come before <command>pam_systemd.so</command>, | |
6b44ad0b | 283 | can set session scope limits using the PAM context objects. The data for these objects is provided as <constant>NUL</constant>-terminated C strings |
22f93314 JS |
284 | and maps directly to the respective unit resource control directives. Note that these limits apply to individual sessions of the user, |
285 | they do not apply to all user processes as a combined whole. In particular, the per-user <command>user@.service</command> unit instance, | |
286 | which runs the <command>systemd --user</command> manager process and its children, and is tracked outside of any session, being shared | |
287 | by all the user's sessions, is not covered by these limits. | |
288 | </para> | |
289 | ||
290 | <para> See | |
291 | <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry> for more information about the resources. | |
b7a47345 | 292 | Also, see <citerefentry project='man-pages'><refentrytitle>pam_set_data</refentrytitle><manvolnum>3</manvolnum></citerefentry> for additional information about how to set |
22f93314 JS |
293 | the context objects. |
294 | </para> | |
295 | ||
2691d65c | 296 | <variablelist class='pam-directives'> |
22f93314 | 297 | <varlistentry> |
1f63c72d | 298 | <term><varname>systemd.memory_max=</varname></term> |
22f93314 | 299 | |
ec07c3c8 AK |
300 | <listitem><para>Sets unit <varname>MemoryMax=</varname>.</para> |
301 | ||
aefdc112 | 302 | <xi:include href="version-info.xml" xpointer="v239"/></listitem> |
22f93314 JS |
303 | </varlistentry> |
304 | ||
305 | <varlistentry> | |
1f63c72d | 306 | <term><varname>systemd.tasks_max=</varname></term> |
22f93314 | 307 | |
ec07c3c8 AK |
308 | <listitem><para>Sets unit <varname>TasksMax=</varname>.</para> |
309 | ||
aefdc112 | 310 | <xi:include href="version-info.xml" xpointer="v239"/></listitem> |
22f93314 JS |
311 | </varlistentry> |
312 | ||
313 | <varlistentry> | |
1f63c72d | 314 | <term><varname>systemd.cpu_weight=</varname></term> |
22f93314 | 315 | |
ec07c3c8 AK |
316 | <listitem><para>Sets unit <varname>CPUWeight=</varname>.</para> |
317 | ||
aefdc112 | 318 | <xi:include href="version-info.xml" xpointer="v239"/></listitem> |
22f93314 JS |
319 | </varlistentry> |
320 | ||
321 | <varlistentry> | |
1f63c72d | 322 | <term><varname>systemd.io_weight=</varname></term> |
22f93314 | 323 | |
ec07c3c8 AK |
324 | <listitem><para>Sets unit <varname>IOWeight=</varname>.</para> |
325 | ||
aefdc112 | 326 | <xi:include href="version-info.xml" xpointer="v239"/></listitem> |
22f93314 | 327 | </varlistentry> |
adc09af2 PW |
328 | |
329 | <varlistentry> | |
1f63c72d | 330 | <term><varname>systemd.runtime_max_sec=</varname></term> |
adc09af2 | 331 | |
ec07c3c8 AK |
332 | <listitem><para>Sets unit <varname>RuntimeMaxSec=</varname>.</para> |
333 | ||
aefdc112 | 334 | <xi:include href="version-info.xml" xpointer="v244"/></listitem> |
adc09af2 | 335 | </varlistentry> |
22f93314 JS |
336 | </variablelist> |
337 | ||
338 | <para>Example data as can be provided from an another PAM module: | |
339 | <programlisting> | |
340 | pam_set_data(handle, "systemd.memory_max", (void *)"200M", cleanup); | |
341 | pam_set_data(handle, "systemd.tasks_max", (void *)"50", cleanup); | |
342 | pam_set_data(handle, "systemd.cpu_weight", (void *)"100", cleanup); | |
343 | pam_set_data(handle, "systemd.io_weight", (void *)"340", cleanup); | |
adc09af2 | 344 | pam_set_data(handle, "systemd.runtime_max_sec", (void *)"3600", cleanup); |
22f93314 JS |
345 | </programlisting> |
346 | </para> | |
347 | ||
348 | </refsect1> | |
349 | ||
798d3a52 ZJS |
350 | <refsect1> |
351 | <title>Example</title> | |
352 | ||
fc89f88e LP |
353 | <para>Here's an example PAM configuration fragment that allows users sessions to be managed by |
354 | <filename>systemd-logind.service</filename>:</para> | |
355 | ||
798d3a52 | 356 | <programlisting>#%PAM-1.0 |
4ad5bf78 LP |
357 | auth sufficient pam_unix.so |
358 | -auth sufficient pam_systemd_home.so | |
359 | auth required pam_deny.so | |
360 | ||
361 | account required pam_nologin.so | |
362 | -account sufficient pam_systemd_home.so | |
363 | account sufficient pam_unix.so | |
364 | account required pam_permit.so | |
365 | ||
366 | -password sufficient pam_systemd_home.so | |
971c07fc LP |
367 | password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok |
368 | ||
4ad5bf78 LP |
369 | password required pam_deny.so |
370 | ||
371 | -session optional pam_keyinit.so revoke | |
372 | -session optional pam_loginuid.so | |
373 | -session optional pam_systemd_home.so | |
374 | <command>-session optional pam_systemd.so</command> | |
375 | session required pam_unix.so</programlisting> | |
798d3a52 ZJS |
376 | </refsect1> |
377 | ||
378 | <refsect1> | |
379 | <title>See Also</title> | |
380 | <para> | |
381 | <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>, | |
382 | <citerefentry><refentrytitle>systemd-logind.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>, | |
383 | <citerefentry><refentrytitle>logind.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>, | |
384 | <citerefentry><refentrytitle>loginctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>, | |
fc89f88e | 385 | <citerefentry><refentrytitle>pam_systemd_home</refentrytitle><manvolnum>8</manvolnum></citerefentry>, |
798d3a52 ZJS |
386 | <citerefentry project='man-pages'><refentrytitle>pam.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>, |
387 | <citerefentry project='man-pages'><refentrytitle>pam.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>, | |
388 | <citerefentry project='man-pages'><refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum></citerefentry>, | |
389 | <citerefentry project='man-pages'><refentrytitle>pam_loginuid</refentrytitle><manvolnum>8</manvolnum></citerefentry>, | |
390 | <citerefentry><refentrytitle>systemd.scope</refentrytitle><manvolnum>5</manvolnum></citerefentry>, | |
391 | <citerefentry><refentrytitle>systemd.slice</refentrytitle><manvolnum>5</manvolnum></citerefentry>, | |
392 | <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry> | |
393 | </para> | |
394 | </refsect1> | |
160cd5c9 LP |
395 | |
396 | </refentry> |