On Tue, Nov 26, 2019 at 09:53:49AM -0600, Michael Catanzaro wrote:
On Tue, Nov 26, 2019 at 9:35 am, Chris Adams
<linux(a)cmadams.net> wrote:
>That should be considered a bug IMHO...
At least for rescue mode, probably yes, but I don't know what to do
about it. Can we make systemd's rescue prompt ask for username and
allow logging in with any user account (goal being to log in to
admin account then 'sudo -i')? Or would there be problems with that?
Clearly it's not designed for that purpose, and it seems
intentional.
systemd does not implement user authentication by itself: it just spawns
getty/gdm/etc during normal runtime, and sulogin for emergency logins.
We generally do not want to re-implement this functionality in systemd.
selinux has some special permissions for sulogin, etc.
Ideally, sulogin would get the capability to pick an alternative user.
util-linux already has the code to select and authenticate users, so
it'd be just a question of some design work and rearranging the code.
On Tue, Nov 26, 2019 at 09:39:59AM -0700, Chris Murphy wrote:
Mayyyybee systemd-homed is in
a position to solve this by having early enough authentication
capability by rescue.target time that any admin user can login?
Actually, it may. Things are confusing here, because systemd-homed is
implemented together with changes to how user metadata querying is done:
instead of using dbus, a brokerless and much simpler varlink query is used.
That last part is what would be relevant to early-boot logins, because
less services need to be up to bring up the user session.
Zbyszek