Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
xorg user can reboot despite root logged in console
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
CaptainBlood
Veteran
Veteran


Joined: 24 Jan 2010
Posts: 1428

PostPosted: Tue Feb 04, 2020 6:35 pm    Post subject: xorg user can reboot despite root logged in console Reply with quote

consolekit installed here for a long time.
I've quit for elogind.

Prior to such changes, rebooting from xorg (LXDE) was refrained if root was logged in somewhere, e.g. in console.
A GUI prompt was requesting root password to confirm execution.

It's no longer the case, which bothers me as a bad twist to unix principles.

I really need some help there to bring this logic back.
the polkit rules seems quite empty, may be that's the reason why....

Thks 4 ur attention.
Back to top
View user's profile Send private message
dmpogo
Advocate
Advocate


Joined: 02 Sep 2004
Posts: 2648
Location: Canada

PostPosted: Wed Feb 05, 2020 4:20 am    Post subject: Re: xorg user can reboot despite root logged in console Reply with quote

CaptainBlood wrote:
consolekit installed here for a long time.
I've quit for elogind.

Prior to such changes, rebooting from xorg (LXDE) was refrained if root was logged in somewhere, e.g. in console.
A GUI prompt was requesting root password to confirm execution.

It's no longer the case, which bothers me as a bad twist to unix principles.

I really need some help there to bring this logic back.
the polkit rules seems quite empty, may be that's the reason why....

Thks 4 ur attention.



Is just forbidding non-root reboot an overkill in your situation ?
Back to top
View user's profile Send private message
Yamakuzure
Advocate
Advocate


Joined: 21 Jun 2006
Posts: 2277
Location: Bardowick, Germany

PostPosted: Wed Feb 05, 2020 6:57 am    Post subject: Re: xorg user can reboot despite root logged in console Reply with quote

CaptainBlood wrote:
Prior to such changes, rebooting from xorg (LXDE) was refrained if root was logged in somewhere, e.g. in console.
A GUI prompt was requesting root password to confirm execution.

It's no longer the case, which bothers me as a bad twist to unix principles.

I really need some help there to bring this logic back.
the polkit rules seems quite empty, may be that's the reason why....
I am using Plasma, but that should make no difference.

When I try to reboot via konsole while root is logged in somewher, I get:
Code:
 ~ $ loginctl reboot
User root is logged in on tty3.
Please retry operation after closing inhibitors and logging out other users.
Alternatively, ignore inhibitors and users with 'loginctl reboot -i'.


So the default polkit rules do apply. Both loginctl from elogind and systemctl from systemd allow to ignore inhibitors, but the poweroff system of a DE shouldn't really do that by default.

I'll see what Plasma does when I use the regular shutdown button of the start menu...

Edit: Wow. I just tried and Plasma simply shut down despite root being logged in. 8O
_________________
Important German:
  1. "Aha" - German reaction to pretend that you are really interested while giving no f*ck.
  2. "Tja" - German reaction to the apocalypse, nuclear war, an alien invasion or no bread in the house.
Back to top
View user's profile Send private message
CaptainBlood
Veteran
Veteran


Joined: 24 Jan 2010
Posts: 1428

PostPosted: Wed Feb 05, 2020 9:35 am    Post subject: Reply with quote

Guess it's time to revisit authentication/security stack here.
Although I feel quite ignorant thus very unconfortable about it.
Thks 4 ur attention, interest & support.
Back to top
View user's profile Send private message
CaptainBlood
Veteran
Veteran


Joined: 24 Jan 2010
Posts: 1428

PostPosted: Sat Feb 22, 2020 1:29 am    Post subject: Reply with quote

Here's
Code:
luc@amd64 ~ $ loginctl
SESSION  UID USER SEAT  TTY
      4 1000 luc  seat0     
      5    0 root seat0 tty1

2 sessions listed.
luc@amd64 ~ $ loginctl reboot
User root is logged in on tty1.
Please retry operation after closing inhibitors and logging out other users.
Alternatively, ignore inhibitors and users with 'loginctl reboot -i'.
However reboot request from LXDE menu is honored.
Any idea what I'm missing?
Thks 4 ur attention.
Back to top
View user's profile Send private message
CaptainBlood
Veteran
Veteran


Joined: 24 Jan 2010
Posts: 1428

PostPosted: Sun Feb 23, 2020 7:30 am    Post subject: Reply with quote

Code:
x11-base/xorg-server
     Installed versions:  1.20.7(0/1.20.7)(11:53:00 17/02/2020)(elogind udev wayland xorg xvfb -debug -dmx -doc -ipv6 -kdrive -libglvnd -libressl -minimal -selinux -static-libs -suid -systemd -unwind -xcsecurity -xephyr -xnest)

Could the issue be related to
Code:
grep keeptty /var/log/Xorg.0.log
[    34.453] (II) systemd-logind: logind integration requires -keeptty and -keeptty was not provided, disabling logind integration
Thks 4 ur attention, interest & support.
Back to top
View user's profile Send private message
CaptainBlood
Veteran
Veteran


Joined: 24 Jan 2010
Posts: 1428

PostPosted: Sun Feb 23, 2020 8:08 am    Post subject: Re: xorg user can reboot despite root logged in console Reply with quote

dmpogo wrote:
Is just forbidding non-root reboot an overkill in your situation ?

Yes it is, somehow.
Thks 4 ur attention, interest & support
Back to top
View user's profile Send private message
CaptainBlood
Veteran
Veteran


Joined: 24 Jan 2010
Posts: 1428

PostPosted: Wed Feb 26, 2020 10:50 am    Post subject: Re: xorg user can reboot despite root logged in console Reply with quote

dmpogo wrote:
Is just forbidding non-root reboot an overkill in your situation ?
To be more precise, yes in an ideal world, as consolekit like behavior is expected.
I'm still interested in any proposal, as it might help my understanding.

Trying gdm instead of sddm enables -keeptty for xorg-server, which didn't help though.

Thks 4 ur attention, interest & support.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum