]>
Commit | Line | Data |
---|---|---|
160cd5c9 LP |
1 | <?xml version='1.0'?> <!--*-nxml-*--> |
2 | <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" | |
12b42c76 | 3 | "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"> |
160cd5c9 LP |
4 | |
5 | <!-- | |
572eb058 | 6 | SPDX-License-Identifier: LGPL-2.1+ |
160cd5c9 LP |
7 | --> |
8 | ||
47c49034 | 9 | <refentry id="pam_systemd" conditional='HAVE_PAM'> |
160cd5c9 | 10 | |
798d3a52 ZJS |
11 | <refentryinfo> |
12 | <title>pam_systemd</title> | |
13 | <productname>systemd</productname> | |
798d3a52 ZJS |
14 | </refentryinfo> |
15 | ||
16 | <refmeta> | |
17 | <refentrytitle>pam_systemd</refentrytitle> | |
18 | <manvolnum>8</manvolnum> | |
19 | </refmeta> | |
20 | ||
21 | <refnamediv> | |
22 | <refname>pam_systemd</refname> | |
23 | <refpurpose>Register user sessions in the systemd login manager</refpurpose> | |
24 | </refnamediv> | |
25 | ||
26 | <refsynopsisdiv> | |
27 | <para><filename>pam_systemd.so</filename></para> | |
28 | </refsynopsisdiv> | |
29 | ||
30 | <refsect1> | |
31 | <title>Description</title> | |
32 | ||
33 | <para><command>pam_systemd</command> registers user sessions with | |
34 | the systemd login manager | |
35 | <citerefentry><refentrytitle>systemd-logind.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>, | |
36 | and hence the systemd control group hierarchy.</para> | |
37 | ||
66a5b902 LP |
38 | <para>On login, this module — in conjunction with <filename>systemd-logind.service</filename> — ensures the |
39 | following:</para> | |
798d3a52 ZJS |
40 | |
41 | <orderedlist> | |
66a5b902 LP |
42 | <listitem><para>If it does not exist yet, the user runtime directory <filename>/run/user/$UID</filename> is |
43 | either created or mounted as new <literal>tmpfs</literal> file system with quota applied, and its ownership | |
44 | changed to the user that is logging in.</para></listitem> | |
45 | ||
46 | <listitem><para>The <varname>$XDG_SESSION_ID</varname> environment variable is initialized. If auditing is | |
47 | available and <command>pam_loginuid.so</command> was run before this module (which is highly recommended), the | |
48 | variable is initialized from the auditing session id (<filename>/proc/self/sessionid</filename>). Otherwise, an | |
798d3a52 ZJS |
49 | independent session counter is used.</para></listitem> |
50 | ||
66a5b902 LP |
51 | <listitem><para>A new systemd scope unit is created for the session. If this is the first concurrent session of |
52 | the user, an implicit per-user slice unit below <filename>user.slice</filename> is automatically created and the | |
53 | scope placed into it. An instance of the system service <filename>user@.service</filename>, which runs the | |
54 | systemd user manager instance, is started. </para></listitem> | |
798d3a52 ZJS |
55 | </orderedlist> |
56 | ||
57 | <para>On logout, this module ensures the following:</para> | |
58 | ||
59 | <orderedlist> | |
60 | <listitem><para>If enabled in | |
61 | <citerefentry><refentrytitle>logind.conf</refentrytitle> | |
66a5b902 LP |
62 | <manvolnum>5</manvolnum></citerefentry> (<varname>KillUserProcesses=</varname>), all processes of the session are |
63 | terminated. If the last concurrent session of a user ends, the user's systemd instance will be terminated too, | |
64 | and so will the user's slice unit.</para></listitem> | |
798d3a52 ZJS |
65 | |
66 | <listitem><para>If the last concurrent session of a user ends, | |
5c50321c | 67 | the user runtime directory <filename>/run/user/$UID</filename> and all its |
798d3a52 ZJS |
68 | contents are removed, too.</para></listitem> |
69 | </orderedlist> | |
70 | ||
71 | <para>If the system was not booted up with systemd as init system, | |
72 | this module does nothing and immediately returns | |
73 | <constant>PAM_SUCCESS</constant>.</para> | |
74 | ||
75 | </refsect1> | |
76 | ||
77 | <refsect1> | |
78 | <title>Options</title> | |
79 | ||
80 | <para>The following options are understood:</para> | |
81 | ||
82 | <variablelist class='pam-directives'> | |
83 | ||
84 | <varlistentry> | |
85 | <term><option>class=</option></term> | |
86 | ||
b115f33c LP |
87 | <listitem><para>Takes a string argument which sets the session class. The <varname>XDG_SESSION_CLASS</varname> |
88 | environment variable (see below) takes precedence. One of <literal>user</literal>, <literal>greeter</literal>, | |
89 | <literal>lock-screen</literal> or <literal>background</literal>. See | |
90 | <citerefentry><refentrytitle>sd_session_get_class</refentrytitle><manvolnum>3</manvolnum></citerefentry> for | |
91 | details about the session class.</para></listitem> | |
798d3a52 ZJS |
92 | </varlistentry> |
93 | ||
94 | <varlistentry> | |
95 | <term><option>type=</option></term> | |
96 | ||
b115f33c LP |
97 | <listitem><para>Takes a string argument which sets the session type. The <varname>XDG_SESSION_TYPE</varname> |
98 | environment variable (see below) takes precedence. One of <literal>unspecified</literal>, | |
99 | <literal>tty</literal>, <literal>x11</literal>, <literal>wayland</literal> or <literal>mir</literal>. See | |
100 | <citerefentry><refentrytitle>sd_session_get_type</refentrytitle><manvolnum>3</manvolnum></citerefentry> for | |
101 | details about the session type.</para></listitem> | |
102 | </varlistentry> | |
103 | ||
104 | <varlistentry> | |
105 | <term><option>desktop=</option></term> | |
106 | ||
107 | <listitem><para>Takes a single, short identifier string for the desktop environment. The | |
108 | <varname>XDG_SESSION_DESKTOP</varname> environment variable (see below) takes precedence. This may be used to | |
109 | indicate the session desktop used, where this applies and if this information is available. For example: | |
110 | <literal>GNOME</literal>, or <literal>KDE</literal>. It is recommended to use the same identifiers and | |
111 | capitalization as for <varname>$XDG_CURRENT_DESKTOP</varname>, as defined by the <ulink | |
112 | url="http://standards.freedesktop.org/desktop-entry-spec/latest/">Desktop Entry | |
113 | Specification</ulink>. (However, note that the option only takes a single item, and not a colon-separated list | |
114 | like <varname>$XDG_CURRENT_DESKTOP</varname>.) See | |
115 | <citerefentry><refentrytitle>sd_session_get_desktop</refentrytitle><manvolnum>3</manvolnum></citerefentry> for | |
116 | further details.</para></listitem> | |
798d3a52 ZJS |
117 | </varlistentry> |
118 | ||
119 | <varlistentry> | |
120 | <term><option>debug<optional>=</optional></option></term> | |
121 | ||
b115f33c LP |
122 | <listitem><para>Takes an optional boolean argument. If yes or without the argument, the module will log |
123 | debugging information as it operates.</para></listitem> | |
798d3a52 ZJS |
124 | </varlistentry> |
125 | </variablelist> | |
126 | </refsect1> | |
127 | ||
128 | <refsect1> | |
129 | <title>Module Types Provided</title> | |
130 | ||
131 | <para>Only <option>session</option> is provided.</para> | |
132 | </refsect1> | |
133 | ||
134 | <refsect1> | |
135 | <title>Environment</title> | |
136 | ||
b115f33c LP |
137 | <para>The following environment variables are initialized by the module and available to the processes of the |
138 | user's session:</para> | |
798d3a52 ZJS |
139 | |
140 | <variablelist class='environment-variables'> | |
141 | <varlistentry> | |
142 | <term><varname>$XDG_SESSION_ID</varname></term> | |
143 | ||
b115f33c LP |
144 | <listitem><para>A short session identifier, suitable to be used in filenames. The string itself should be |
145 | considered opaque, although often it is just the audit session ID as reported by | |
146 | <filename>/proc/self/sessionid</filename>. Each ID will be assigned only once during machine uptime. It may | |
147 | hence be used to uniquely label files or other resources of this session. Combine this ID with the boot | |
148 | identifier, as returned by | |
149 | <citerefentry><refentrytitle>sd_id128_get_boot</refentrytitle><manvolnum>3</manvolnum></citerefentry>, for a | |
150 | globally unique identifier for the current session.</para></listitem> | |
798d3a52 ZJS |
151 | </varlistentry> |
152 | ||
153 | <varlistentry> | |
154 | <term><varname>$XDG_RUNTIME_DIR</varname></term> | |
155 | ||
156 | <listitem><para>Path to a user-private user-writable directory | |
157 | that is bound to the user login time on the machine. It is | |
158 | automatically created the first time a user logs in and | |
159 | removed on the user's final logout. If a user logs in twice at | |
160 | the same time, both sessions will see the same | |
161 | <varname>$XDG_RUNTIME_DIR</varname> and the same contents. If | |
162 | a user logs in once, then logs out again, and logs in again, | |
163 | the directory contents will have been lost in between, but | |
164 | applications should not rely on this behavior and must be able | |
165 | to deal with stale files. To store session-private data in | |
166 | this directory, the user should include the value of | |
167 | <varname>$XDG_SESSION_ID</varname> in the filename. This | |
168 | directory shall be used for runtime file system objects such | |
169 | as <constant>AF_UNIX</constant> sockets, FIFOs, PID files and | |
170 | similar. It is guaranteed that this directory is local and | |
171 | offers the greatest possible file system feature set the | |
b938cb90 | 172 | operating system provides. For further details, see the <ulink |
798d3a52 | 173 | url="http://standards.freedesktop.org/basedir-spec/basedir-spec-latest.html">XDG |
5c50321c AHL |
174 | Base Directory Specification</ulink>. <varname>$XDG_RUNTIME_DIR</varname> |
175 | is not set if the current user is not the original user of the session.</para></listitem> | |
798d3a52 ZJS |
176 | </varlistentry> |
177 | ||
178 | </variablelist> | |
179 | ||
b115f33c LP |
180 | <para>The following environment variables are read by the module and may be used by the PAM service to pass |
181 | metadata to the module. If these variables are not set when the PAM module is invoked but can be determined | |
182 | otherwise they are set by the module, so that these variables are initialized for the session and applications if | |
183 | known at all.</para> | |
798d3a52 ZJS |
184 | |
185 | <variablelist class='environment-variables'> | |
186 | <varlistentry> | |
187 | <term><varname>$XDG_SESSION_TYPE</varname></term> | |
188 | ||
b115f33c LP |
189 | <listitem><para>The session type. This may be used instead of <option>session=</option> on the module parameter |
190 | line, and is usually preferred.</para></listitem> | |
798d3a52 ZJS |
191 | </varlistentry> |
192 | ||
193 | <varlistentry> | |
194 | <term><varname>$XDG_SESSION_CLASS</varname></term> | |
195 | ||
b115f33c LP |
196 | <listitem><para>The session class. This may be used instead of <option>class=</option> on the module parameter |
197 | line, and is usually preferred.</para></listitem> | |
798d3a52 ZJS |
198 | </varlistentry> |
199 | ||
200 | <varlistentry> | |
201 | <term><varname>$XDG_SESSION_DESKTOP</varname></term> | |
202 | ||
b115f33c LP |
203 | <listitem><para>The desktop identifier. This may be used instead of <option>desktop=</option> on the module |
204 | parameter line, and is usually preferred.</para></listitem> | |
798d3a52 ZJS |
205 | </varlistentry> |
206 | ||
207 | <varlistentry> | |
208 | <term><varname>$XDG_SEAT</varname></term> | |
209 | ||
210 | <listitem><para>The seat name the session shall be registered | |
211 | for, if any.</para></listitem> | |
212 | </varlistentry> | |
213 | ||
214 | <varlistentry> | |
215 | <term><varname>$XDG_VTNR</varname></term> | |
216 | ||
217 | <listitem><para>The VT number the session shall be registered | |
218 | for, if any. (Only applies to seats with a VT available, such | |
219 | as <literal>seat0</literal>)</para></listitem> | |
220 | </varlistentry> | |
798d3a52 | 221 | </variablelist> |
2230a290 | 222 | |
1acfbbff LP |
223 | <para>If not set, <command>pam_systemd</command> will initialize |
224 | <varname>$XDG_SEAT</varname> and <varname>$XDG_VTNR</varname> | |
225 | based on the <varname>$DISPLAY</varname> variable (if the latter is set).</para> | |
798d3a52 ZJS |
226 | </refsect1> |
227 | ||
22f93314 JS |
228 | <refsect1> |
229 | <title>Session limits</title> | |
230 | ||
231 | <para>PAM modules earlier in the stack, that is those that come before <command>pam_systemd.so</command>, | |
232 | can set session scope limits using the PAM context objects. The data for these objects is provided as NUL-terminated C strings | |
233 | and maps directly to the respective unit resource control directives. Note that these limits apply to individual sessions of the user, | |
234 | they do not apply to all user processes as a combined whole. In particular, the per-user <command>user@.service</command> unit instance, | |
235 | which runs the <command>systemd --user</command> manager process and its children, and is tracked outside of any session, being shared | |
236 | by all the user's sessions, is not covered by these limits. | |
237 | </para> | |
238 | ||
239 | <para> See | |
240 | <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry> for more information about the resources. | |
241 | Also, see <citerefentry><refentrytitle>pam_set_data</refentrytitle><manvolnum>3</manvolnum></citerefentry> for additional information about how to set | |
242 | the context objects. | |
243 | </para> | |
244 | ||
245 | <variablelist> | |
246 | <varlistentry> | |
247 | <term><varname>systemd.memory_max</varname></term> | |
248 | ||
249 | <listitem><para>Sets unit <varname>MemoryMax=</varname>.</para></listitem> | |
250 | </varlistentry> | |
251 | ||
252 | <varlistentry> | |
253 | <term><varname>systemd.tasks_max</varname></term> | |
254 | ||
255 | <listitem><para>Sets unit <varname>TasksMax=</varname>.</para></listitem> | |
256 | </varlistentry> | |
257 | ||
258 | <varlistentry> | |
259 | <term><varname>systemd.cpu_weight</varname></term> | |
260 | ||
261 | <listitem><para>Sets unit <varname>CPUWeight=</varname>.</para></listitem> | |
262 | </varlistentry> | |
263 | ||
264 | <varlistentry> | |
265 | <term><varname>systemd.io_weight</varname></term> | |
266 | ||
267 | <listitem><para>Sets unit <varname>IOWeight=</varname>.</para></listitem> | |
268 | </varlistentry> | |
269 | </variablelist> | |
270 | ||
271 | <para>Example data as can be provided from an another PAM module: | |
272 | <programlisting> | |
273 | pam_set_data(handle, "systemd.memory_max", (void *)"200M", cleanup); | |
274 | pam_set_data(handle, "systemd.tasks_max", (void *)"50", cleanup); | |
275 | pam_set_data(handle, "systemd.cpu_weight", (void *)"100", cleanup); | |
276 | pam_set_data(handle, "systemd.io_weight", (void *)"340", cleanup); | |
277 | </programlisting> | |
278 | </para> | |
279 | ||
280 | </refsect1> | |
281 | ||
798d3a52 ZJS |
282 | <refsect1> |
283 | <title>Example</title> | |
284 | ||
285 | <programlisting>#%PAM-1.0 | |
160cd5c9 LP |
286 | auth required pam_unix.so |
287 | auth required pam_nologin.so | |
288 | account required pam_unix.so | |
289 | password required pam_unix.so | |
290 | session required pam_unix.so | |
291 | session required pam_loginuid.so | |
3e2f69b7 | 292 | session required pam_systemd.so</programlisting> |
798d3a52 ZJS |
293 | </refsect1> |
294 | ||
295 | <refsect1> | |
296 | <title>See Also</title> | |
297 | <para> | |
298 | <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>, | |
299 | <citerefentry><refentrytitle>systemd-logind.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>, | |
300 | <citerefentry><refentrytitle>logind.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>, | |
301 | <citerefentry><refentrytitle>loginctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>, | |
302 | <citerefentry project='man-pages'><refentrytitle>pam.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>, | |
303 | <citerefentry project='man-pages'><refentrytitle>pam.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>, | |
304 | <citerefentry project='man-pages'><refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum></citerefentry>, | |
305 | <citerefentry project='man-pages'><refentrytitle>pam_loginuid</refentrytitle><manvolnum>8</manvolnum></citerefentry>, | |
306 | <citerefentry><refentrytitle>systemd.scope</refentrytitle><manvolnum>5</manvolnum></citerefentry>, | |
307 | <citerefentry><refentrytitle>systemd.slice</refentrytitle><manvolnum>5</manvolnum></citerefentry>, | |
308 | <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry> | |
309 | </para> | |
310 | </refsect1> | |
160cd5c9 LP |
311 | |
312 | </refentry> |