URL:
https://github.com/freeipa/freeipa/pull/2751
Author: tiran
Title: #2751: [Backport][ipa-4-6] Create systemd-user HBAC service and rule
Action: opened
PR body:
"""
Manual backport of PR #2746
authselect changed pam_systemd session from optional to required. When
the HBAC rule allow_all is disabled and replaced with more fine grained
rules, loginsi now to fail, because systemd's user@.service is able to
create a systemd session.
Add systemd-user HBAC service and a HBAC rule that allows systemd-user
to run on all hosts for all users by default. ipa-server-upgrade creates
the service and rule, too. In case the service already exists, no
attempt is made to create the rule. This allows admins to delete the
rule permanently.
See:
https://bugzilla.redhat.com/show_bug.cgi?id=1643928
Fixes:
https://pagure.io/freeipa/issue/7831
Signed-off-by: Christian Heimes <cheimes(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa
https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/2751/head:pr2751
git checkout pr2751