From: Arnaud Ferraris <arnaud.ferraris@collabora.com>
Date: Sat, 14 Mar 2020 01:08:50 +0000 (+0100)
Subject: login: allow non-console sessions to change vt
X-Git-Tag: v246-rc1~724
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=19bb87fbfa;p=thirdparty%2Fsystemd.git

login: allow non-console sessions to change vt

When starting a wayland session through a systemd service for a non-root
user, the compositor (based on wlroots) is denied the authorization to
change vt.
Once the user logs in, either through a local console or via ssh, the
compositor can work properly.

This is related to the login polkit policy:
- `allow_inactive` has value `auth_admin_keep`, denying any non-root
  user session the authorization to change vt
- `allow_active` has value `yes`, which explains why the vt change
  becomes possible once the user logs in through another channel

By changing the `allow_inactive` value to `yes`, any user session setup
in a service file can switch vt, allowing wayland sessions for non-root
users.
---

diff --git a/src/login/org.freedesktop.login1.policy b/src/login/org.freedesktop.login1.policy
index b726634cbf3..1b6d85e5f9f 100644
--- a/src/login/org.freedesktop.login1.policy
+++ b/src/login/org.freedesktop.login1.policy
@@ -396,7 +396,7 @@
                 <message gettext-domain="systemd">Authentication is required to change the virtual terminal.</message>
                 <defaults>
                         <allow_any>auth_admin_keep</allow_any>
-                        <allow_inactive>auth_admin_keep</allow_inactive>
+                        <allow_inactive>yes</allow_inactive>
                         <allow_active>yes</allow_active>
                 </defaults>
         </action>