tree-wide: remove Emacs lines from all files This should be handled fine now by .dir-locals.el, so need to carry that stuff in every file.

tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy GLIB has recently started to officially support the gcc cleanup attribute in its public API, hence let's do the same for our APIs. With this patch we'll define an xyz_unrefp() call for each public xyz_unref() call, to make it easy to use inside a __attribute__((cleanup())) expression. Then, all code is ported over to make use of this. The new calls are also documented in the man pages, with examples how to use them (well, I only added docs where the _unref() call itself already had docs, and the examples, only cover sd_bus_unrefp() and sd_event_unrefp()). This also renames sd_lldp_free() to sd_lldp_unref(), since that's how we tend to call our destructors these days. Note that this defines no public macro that wraps gcc's attribute and makes it easier to use. While I think it's our duty in the library to make our stuff easy to use, I figure it's not our duty to make gcc's own features easy to use on its own. Most likely, client code which wants to make use of this should define its own: #define _cleanup_(function) __attribute__((cleanup(function))) Or similar, to make the gcc feature easier to use. Making this logic public has the benefit that we can remove three header files whose only purpose was to define these functions internally. See #2008.

tree-wide: sort includes Sort the includes accoding to the new coding style.

logind: add a new UserTasksMax= setting to logind.conf This new setting configures the TasksMax= field for the slice objects we create for each user. This alters logind to create the slice unit as transient unit explicitly instead of relying on implicit generation of slice units by simply starting them. This also enables us to set a friendly description for slice units that way.

logind: don't assert if the slice is missing After all, we don't actually really need the slice to work, it's just nice to have it.

treewide: use the negative error codes returned by our functions Our functions return negative error codes. Do not rely on errno being set after calling our own functions.

util-lib: split out allocation calls into alloc-util.[ch]

src/basic: rename audit.[ch] → audit-util.[ch] and capability.[ch] → capability-util.[ch] The files are named too generically, so that they might conflict with the upstream project headers. Hence, let's add a "-util" suffix, to clarify that this are just our utility headers and not any official upstream headers.

util-lib: move string table stuff into its own string-table.[ch]

util-lib: split string parsing related calls from util.[ch] into parse-util.[ch]

util-lib: split out user/group/uid/gid calls into user-util.[ch]

util-lib: split out IO related calls to io-util.[ch]

util-lib: split out fd-related operations into fd-util.[ch] There are more than enough to deserve their own .c file, hence move them over.

util: split out escaping code into escape.[ch] This really deserves its own file, given how much code this is now.

logind: minor clean-ups

tree-wide: make use of log_error_errno() return value in more cases The previous coccinelle semantic patch that improved usage of log_error_errno()'s return value, only looked for log_error_errno() invocations with a single parameter after the error parameter. Update the patch to handle arbitrary numbers of additional arguments.

tree-wide: use coccinelle to patch a lot of code to use mfree() This replaces this: free(p); p = NULL; by this: p = mfree(p); Change generated using coccinelle. Semantic patch is added to the sources.

logind: get a fresh file descriptor to clean up a VT When the controlling process exits, any existing file descriptors for that FD will be marked as hung-up and ioctls on them will file with EIO. To work around this, open a new file descriptor for the VT we want to clean up. Thanks to Ray Strode for help in sorting out the problem and coming up with a fix! https://github.com/systemd/systemd/issues/989

logind: use open_terminal() instead of open() The open_terminal() function adds retries in case a terminal is in the process of being closed when we open it, and should generally be used to open a terminal. We especially need it for code that a subsequent commit adds that reopens the terminal at session shut-down time; such races would be more likely in that case. Found by Ray Strode.

logind,machined: various smaller cleanups Use mfree() where we can. Drop unnecessary {}. Drop unnecessary variable declarations. Cast syscall invocations where explicitly don't care for the return value to (void). Reword a comment.

logind: switch to sd_bus_track helper Let logind use the sd_bus_track helper object to track the controllers of sessions. This does not only remove quite some code but also kills the unconditional matches for all NameOwnerChanged signals. The latter is something we should never ever do, as it wakes up the daemon every time a client connects, which doesn't scale.

logind: release VT-positions when closing sessions Make sure we release VT-positions when a session is closed. Otherwise, lingering sessions will occupy VTs and prevent next logins from succeeding. Note that we already release session-devices when closing a session, so there cannot be anyone using the VT anymore.

tree-wide: port everything over to fflush_and_check() Some places invoked fflush() directly with their own manual error checking, let's unify all that by using fflush_and_check(). This also unifies the general error paths of fflush()+rename() file writers.

logind: rename 'pos' to 'position' Spell out the proper name. Use 'pos' over 'position', and also update the logind state file to do the same. Note that this breaks live updates. However, we only save 'POSITION' on non-seat0, so this shouldn't bother anyone for real. If you run multi-seat setups, you better restart a machine on updates, anyway.

shared: add terminal-util.[ch]

shared: add formats-util.h

logind: check return value of session_release It allocates memory, so it can fail. CID #1237527.

logind: explicitly ignore errors we can do nothing about CID #1237545.

tree-wide: there is no ENOTSUP on linux Replace ENOTSUP by EOPNOTSUPP as this is what linux actually uses.

remove unused includes This patch removes includes that are not used. The removals were found with include-what-you-use which checks if any of the symbols from a header is in use.

logind: handle closing sessions over daemon restarts It may happen that you have several sessions with the same VT: - Open a session c1 which leaves some processes around, and log out. The session will stay in State=closing and become Active=no. - Log back in on the same VT, get a new session "c2" which is State=active and Active=yes. When restarting logind after that, the first session that matches the current VT becomes Active=yes, which will be c1; c2 thus is Active=no and does not get the usual polkit/device ACL privileges. Restore the "closing" state in session_load(), to avoid treating all restored sessions as State=active. In seat_active_vt_changed(), prefer active sessions over closing ones if more than one session matches the current VT. Finally, fix the confusing comment in session_load() and explain it a bit better. https://launchpad.net/bugs/1415104

logind: unify how we cast between uid_t and pointers for hashmap keys

treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".

treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.

treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.

treewide: no need to negate errno for log_*_errno() It corrrectly handles both positive and negative errno values.

treewide: auto-convert the simple cases to log_*_errno() As a followup to 086891e5c1 "log: add an "error" parameter to all low-level logging calls and intrdouce log_error_errno() as log calls that take error numbers", use sed to convert the simple cases to use the new macros: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\("(.*)%s"(.*), strerror\(-([a-zA-Z_]+)\)\);/log_\1_errno(-\4, "\2%m"\3);/' Multi-line log_*() invocations are not covered. And we also should add log_unit_*_errno().

log: fix order of log_unit_struct() to match other logging calls Also, while we are at it, introduce some syntactic sugar for creating ERRNO= and MESSAGE= structured logging fields.

Silence some "unchecked return-value" warnings This adds some log-messages to ioctl() calls where we don't really care for the return value. It isn't strictly necessary to look for those, but lets be sure and print warnings. This silences gcc and coverity, and also makes sure we get reports in case something goes wrong and we didn't expect it to fail that way.

login: pause devices before acknowledging VT switches If a session controller does not need synchronous VT switches, we allow them to pass VT control to logind, which acknowledges all VT switches unconditionally. This works fine with all sessions using the dbus API, but causes out-of-sync device use if we switch to legacy sessions that are notified via VT signals. Those are processed before logind notices the session-switch via sysfs. Therefore, leaving the old session still active for a short amount of time. This, in fact, may cause the legacy session to prepare graphics devices before the old session was deactivated, and thus, maybe causing the old session to interfer with graphics device usage. Fix this by releasing devices immediately before acknowledging VT switches. This way, sessions without VT handlers are required to support async session switching (which they do in that case, anyway).

hashmap: introduce hash_ops to make struct Hashmap smaller It is redundant to store 'hash' and 'compare' function pointers in struct Hashmap separately. The functions always comprise a pair. Store a single pointer to struct hash_ops instead. systemd keeps hundreds of hashmaps, so this saves a little bit of memory.

login: simplify controller handling Simplify the way we handler session-controllers and fix several shortcomings: * send ReleaseDevice() signals on forced session takeover * fix mem-leaks for busnames in case VT preparation fails (non-critical) * avoid passing pre-allocated names to helpers

login: fix mem leak

login: fix memory-leak on DropController() Our bus-name watch helpers only remove a bus-name if it's not a controller, anymore. If we call manager_drop_busname() before unregistering the controller, the busname will not be dropped. Therefore, first drop the controller, then drop the bus-name.

hashmap: try to use the existing 64bit hash functions for dev_t if it is 64bit

logind: add new session type "web" for PAM web clients, such as cockpit On request of Stef Walter.

login: share VT-signal handler between sessions sd-event does not allow multiple handlers for a single signal. However, logind sets up signal handlers for each session with VT_PROCESS set (that is, it has an active controller). Therefore, registering multiple such controllers will fail. Lets make the VT-handler global, as it's mostly trivial, anyway. This way, the sessions don't have to take care of that and we can simply acknowledge all VT-switch requests as we always did.

login: set_controller should fail if prepare_vt fails If controllers can expect logind to have "prepared" the VT (e.g. set it to graphics mode, etc) then TakeControl() should fail if said preparation failed (and session_restore_vt() was called). (David: fixed up !CONFIG_VT case and errno-numbers)

logind: also escape external data when saving to /run Better be safe than sorry...

logind: fix Display property of user objects When we dropped support for creating a per-user to the "main" X11 display we stopped returning useful data in the "Display" user property. With this change this is fixed and we again expose an appropriate (graphical session) in the property that is useful as the "main" one, if one is needed.

Remove unnecessary casts in printfs No functional change expected :)

login: rename session_mute_vt() to session_prepare_vt() This function is no longer just about muteing the VT. We do all kinds of VT setup for sessions using the controller-API. Rename the function to something more appropriate.

login: give session ownership of VT The tty associated with a VT should be owned by the owner of the session running on the VT. This is important for supporting a socket activated X server, since the X server will open the tty itself. This commit makes sure to chown the tty any time a session is created and and chown it back to root any time the session is removed. This behavior is copied from /bin/login.

login: add 'mir' to the list of session types Add Mir to the list of session types. This is implemented for LightDM in lp:~robert-ancell/lightdm/xdg-session-desktop [1]. [1] https://code.launchpad.net/~robert-ancell/lightdm/xdg-session-desktop/+merge/214108 (david: adjusted commit-header and fixed whitespace issues)

sd-event: rework API to support CLOCK_REALTIME_ALARM and CLOCK_BOOTTIME_ALARM, too

util: replace close_nointr_nofail() by a more useful safe_close() safe_close() automatically becomes a NOP when a negative fd is passed, and returns -1 unconditionally. This makes it easy to write lines like this: fd = safe_close(fd); Which will close an fd if it is open, and reset the fd variable correctly. By making use of this new scheme we can drop a > 200 lines of code that was required to test for non-negative fds or to reset the closed fd variable afterwards.

Make tables for DEFINE_STRING_TABLE_LOOKUP consistent Bring some arrays that are used for DEFINE_STRING_TABLE_LOOKUP() in the same order than the enums they reference. Also, pass the corresponding _MAX value to the array initalizer where appropriate.

logind: fix reference to systemd-user-sessions.service

logind-session: Fix invalid free in the error case utf8 needs to be initialized to NULL for the free for the early return, otherwise we try to free invalid data.

api: in constructor function calls, always put the returned object pointer first (or second) Previously the returned object of constructor functions where sometimes returned as last, sometimes as first and sometimes as second parameter. Let's clean this up a bit. Here are the new rules: 1. The object the new object is derived from is put first, if there is any 2. The object we are creating will be returned in the next arguments 3. This is followed by any additional arguments Rationale: For functions that operate on an object we always put that object first. Constructors should probably not be too different in this regard. Also, if the additional parameters might want to use varargs which suggests to put them last. Note that this new scheme only applies to constructor functions, not to all other functions. We do give a lot of freedom for those. Note that this commit only changes the order of the new functions we added, for old ones we accept the wrong order and leave it like that.

make gcc shut up If -flto is used then gcc will generate a lot more warnings than before, among them a number of use-without-initialization warnings. Most of them without are false positives, but let's make them go away, because it doesn't really matter.

logind: close race on session state during logins At login there is a small race window where session_get_state() will return SESSION_ACTIVE instead of SESSION_OPENING. This must be fixed since during that time there are calls to session_save() to save session states and we want to write the correct state. When we queue the start scope and service jobs, we wait for both of them to finish before calling and continue processing in: "session_jobs_reply() => session_send_create_reply()" to create the session fifo and notify clients. However, in the match_job_removed() D-Bus signal, we may hit situations where the scope job has successfully finished and we are still waiting for the user service job to finish. During that time the "session->scope_job" will be freed and set to NULL, this makes session_get_state() return SESSION_ACTIVE before it is really active, it should return SESSION_OPENING since we are still waiting for the service job to finish in order to create the session fifo. To fix this, we also check if the session fifo fd was created, if so then the session has entered the SESSION_ACTIVE state, if not then it is still in the SESSION_OPENING state and it is waiting for the scope and service jobs to finish.

logind: always kill session when termination is requested KillUserProcesses=yes/no should be ignored when termination is explicitly requested.

logind: order all scopes after both systemd-logind.service and systemd-user-sessions.service This way at shutdown we can be sure that the sessions go away before the network.

logind: rework session shutdown logic Simplify the shutdown logic a bit: - Keep the session FIFO around in the PAM module, even after the session shutdown hook has been finished. This allows logind to track precisely when the PAM handler goes away. - In the ReleaseSession() call start a timer, that will stop terminate the session when elapsed. - Never fiddle with the KillMode of scopes to configure whether user processes should be killed or not. Instead, simply leave the scope units around when we terminate a session whose processes should not be killed. - When killing is enabled, stop the session scope on FIFO EOF or after the ReleaseSession() timeout. When killing is disabled, simply tell PID 1 to abandon the scope. Because the scopes stay around and hence all processes are always member of a scope, the system shutdown logic should be more robust, as the scopes can be shutdown as part of the usual shutdown logic.

Update some message formats Use PID_FMT/USEC_FMT/... in more places. Also update logind error messages to print the full path to a file that failed. This should make debugging easier for people who do not know off the top of their head where logind stores it state.

man: introduce new "Desktop" property for sessions This is initialized from XDG_SESSION_DESKTOP and is useful for GNOME to recognize its own sessions. It's supposed to be set to a short string identifying the session, such as "kde" or "gnome".

logind: add new "wayland" session type

logind: introduce session "positions" logind has no concept of session ordering. Sessions have a unique name, some attributes about the capabilities and that's already it. There is currently no stable+total order on sessions. If we use the logind API to switch between sessions, we are faced with an unordered list of sessions we have no clue of. This used to be no problem on seats with VTs or on seats with only a single active session. However, with the introduction of multi-session capability for seats without VTs, we need to find a way to order sessions in a stable way. This patch introduces session "positions". A position is a simple integer assigned to a session which is never changed implicitly (currently, we also don't change it explicitly, but that may be changed someday). For seats with VTs, we force the position to be the same as the VTnr. Without VTs, we simply find the lowest unassigned number and use it as position. If position-assignment fails or if, for any reason, we decide to not assign a position to a session, the position is set to 0 (which is treated as invalid position). During session_load() or if two sessions have the same VTnr, we may end up with two sessions with the same position (this shouldn't happen, but lets be fail-safe in case some other part of the stack fails). This case is dealt with gracefully by ignoring any session but the first session assigned to the position. Thus, session->pos is a hint, seat->positions[i] is the definite position-assignment. Always verify both match in case you need to modify them! Additionally, we introduce SwitchTo(unsigned int) on the seat-dbus-API. You can call it with any integer value != 0 and logind will try to switch to the request position. If you implement a compositor or any other session-controller, you simply watch for ctrl+alt+F1 to F12 and call SwitchTo(Fx). logind will figure a way out deal with this number. For convenience, we also introduce SwitchToNext/Previous(). It should be called on ctrl+alt+Left/Right (like the kernel-console used to support). Note that the public API (SwitchTo*()) is *not* bound to the underlying logic that is implemented now. We don't export "session-positions" on the dbus/C API! They are an implementation detail. Instead, the SwitchTo*() API is supposed to be a hint to let logind choose the session-switching logic. Any foreground session-controller is free to enumerate/order existing sessions according to their needs and call Session.Activate() manually. But the SwitchTo*() API provides a uniform behavior across session-controllers. Background: Session-switching keys depend on the active keymap. The XKB specification provides the XKB_KEY_XF86Switch_VT_1-12 key-symbols which have to be mapped by all keymaps to allow session-switching. It is usually bound to ctrl+alt+Fx but may be set differently. A compositor passes any keyboard input to XKB before passing it to clients. In case a key-press invokes the XKB_KEY_XF86Switch_VT_x action, the keypress is *not* forwarded to clients, but instead a session-switch is scheduled. This actually prevents us from handling these keys outside of the session. If an active compositor has a keymap with a different mapping of these keys, and logind itself tries to catch these combinations, we end up with the key-press sent to the compositor's clients *and* handled by logind. This is *bad* and we must avoid this. The only situation where a background process is allowed to handle key-presses is debugging and emergency-keys. In these cases, we don't care for keymap mismatches and accept the double-event. Another exception is unmapped keys like PowerOff/Suspend (even though this one is controversial).

logind: get rid of X11 display socket symlink X11 never made use of it anyway and it's probably better to just push $DISPLAY into the systemd daemon from gnome-session (or equivalent program) than to change libX11 to look for this socket. In particular since we won't need this for Wayland anyway and we shouldn't add infrastructure for stuff that's on its way out anyway.

shared: switch our hash table implementation over to SipHash SipHash appears to be the new gold standard for hashing smaller strings for hashtables these days, so let's make use of it.

Get rid of our reimplementation of basename The only problem is that libgen.h #defines basename to point to it's own broken implementation instead of the GNU one. This can be fixed by #undefining basename.

logind: remove unused session->closing field This field is always false, drop it. If you want a reliable way to get session state, call session_get_state(). Testing for any flags directly doesn't work currently so don't pretend it would.

logind: require VTs on seat0 and forbid elsewhere Sessions on seat0 must pass us a vtnr, otherwise, you shouldn't try attaching it to seat0. For seats without VTs, we do the exact opposite: we forbid VTs. There can be odd situations if the session-files contain invalid combinations. However, we try to keep sessions alive and restore state as good as possible.

logind: make VT numbers unsigned Fix the whole code to use "unsigned int" for vtnr. 0 is an invalid vtnr so we don't need negative numbers at all. Note that most code already assumes it's unsigned so in case there's a negative vtnr, our code may, under special circumstances, silently break. So this patch makes sure all sources of vtnrs verify the validity. Also note that the dbus api already uses unsigned ints.

logind: mute/restore VT on behalf of session controllers If a session process calls TakeControl(), we now put the VT into KD_GRAPHICS+K_OFF mode. This way, the new session controller can solely rely on the logind-dbus API to manage the session. Once the controller exits or calls ReleaseControl(), we restore the VT. We also restore it, if we lost a controller during crash/restart (but only if there really *was* a controller previously). Note that we also must put the VT into VT_PROCESS mode. We want VT_AUTO semantics, but VT_AUTO+KD_GRAPHICS actually disables *all* VT switches (who came up with that great idea?). Hence, we set VT_PROCESS for logind but acknowledge *all* requests immediately. If a compositor wants custom VT setups, they can still get this by *first* calling TakeControl() and afterwards setting up the VT. logind doesn't touch the VT during controller runtime, only during setup/teardown. This is actually what weston already does.

logind: restore session-controller after crash We now save the unique bus-name of a session-controller as CONTROLLER=%s in the session files. This allows us to restore the controller after a crash or restart. Note that we test whether the name is still valid (dbus guarantees that the name is unique as long as the machine is up and running). If it is, we know that the controller still exists and can safely restore it. Our dbus-name-tracking guarantees that we're notified once it exits. Also note that session-devices are *not* restored. We have no way to know which devices where used before the crash. We could store all these on disk, too, or mark them via udev. However, this seems to be rather cumbersome. Instead, we expect controllers to listen for NewSession signals for their own session. This is sent on session_load() and they can then re-request all devices. The only race I could find is if logind crashes, then the session controller tries calling ReleaseControl() (which will fail as logind is down) but keeps the bus-connection valid for other independent requests. If logind is restarted, it will restore the old controller and thus block the session. However, this seems unlikely for several reasons: - The ReleaseControl() call must occur exactly in the timespan where logind is dead. - A process which calls ReleaseControl() usually closes the bus-connection afterwards. Especially if ReleaseControl() fails, the process should notice that something is wrong and close the bus. - A process calling ReleaseControl() usually exits afterwards. There may be any cleanup pending, but other than that, usual compositors exit. - If a session-controller calls ReleaseControl(), a session is usually considered closing. There is no known use-case where we hand-over session-control in a single session. So we don't care whether the controller is locked afterwards. So this seems negligible.

core: convert PID 1 to libsystemd-bus This patch converts PID 1 to libsystemd-bus and thus drops the dependency on libdbus. The only remaining code using libdbus is a test case that validates our bus marshalling against libdbus' marshalling, and this dependency can be turned off. This patch also adds a couple of things to libsystem-bus, that are necessary to make the port work: - Synthesizing of "Disconnected" messages when bus connections are severed. - Support for attaching multiple vtables for the same interface on the same path. This patch also fixes the SetDefaultTarget() and GetDefaultTarget() bus calls which used an inappropriate signature. As a side effect we will now generate PropertiesChanged messages which carry property contents, rather than just invalidation information.

logind: port logind to libsystemd-bus

list: make our list macros a bit easier to use by not requring type spec on each invocation We can determine the list entry type via the typeof() gcc construct, and so we should to make the macros much shorter to use.

Remove six unused variables and add annotation clang FTW!

logind: fix build for ARM with sizeof(dev_t) > sizeof(void*) Unfortunately on ARM-32 systems dev_t can be 64bit and thus we cannot store it easily in void* keys for hashtables. Fix that by passing a pointer to the dev_t variable instead.

logind: implement generic multi-session This enables the multi-session capability for seats that don't have VTs. For legacy seats with VTs, everything stays the same. However, all other seats now also get the multi-session capability. The only feature that was missing was session-switching. As logind can force a session-switch and signal that via the "Active" property, we only need a way to allow synchronized/delayed session switches. Compositors need to cleanup some devices before acknowledging the session switch. Therefore, we use the session-devices to give compositors a chance to block a session-switch until they cleaned everything up. If you activate a session on a seat without VTs, we send a PauseDevice signal to the active session for every active device. Only once the session acknowledged all these with a PauseDeviceComplete() call, we perform the final session switch. One important note is that delayed session-switching is meant for backwards compatibility. New compositors or other sessions should really try to deal correctly with forced session switches! They only need to handle EACCES/EPERM from syscalls and treat them as "PauseDevice" signal. Following logind patches will add a timeout to session-switches which forces the switch if the active session does not react in a timely fashion. Moreover, explicit ForceActivate() calls might also be supported. Hence, sessions must not crash if their devices get paused.

logind: introduce session-devices A session-device is a device that is bound to a seat and used by a session-controller to run the session. This currently includes DRM, fbdev and evdev devices. A session-device can be created via RequestDevice() on the dbus API of the session. You can drop it via ReleaseDevice() again. Once the session is destroyed or you drop control of the session, all session-devices are automatically destroyed. Session devices follow the session "active" state. A device can be active/running or inactive/paused. Whenever a session is not the active session, no session-device of it can be active. That is, if a session is not in foreground, all session-devices are paused. Whenever a session becomes active, all devices are resumed/activated by logind. If it fails, a device may stay paused. With every session-device you request, you also get a file-descriptor back. logind keeps a copy of this fd and uses kernel specific calls to pause/resume the file-descriptors. For example, a DRM fd is muted by logind as long as a given session is not active. Hence, the fd of the application is also muted. Once the session gets active, logind unmutes the fd and the application will get DRM access again. This, however, requires kernel support. DRM devices provide DRM-Master for synchronization, evdev devices have EVIOCREVOKE (pending on linux-input-ML). fbdev devices do not provide such synchronization methods (and never will). Note that for evdev devices, we call EVIOCREVOKE once a session gets inactive. However, this cannot be undone (the fd is still valid but mostly unusable). So we reopen a new fd once the session is activated and send it together with the ResumeDevice() signal. With this infrastructure in place, compositors can now run without CAP_SYS_ADMIN (that is, without being root). They use RequestControl() to acquire a session and listen for devices via udev_monitor. For every device they want to open, they call RequestDevice() on logind. This returns a fd which they can use now. They no longer have to open the devices themselves or call any privileged ioctls. This is all done by logind. Session-switches are still bound to VTs. Hence, compositors will get notified via the usual VT mechanisms and can cleanup their state. Once the VT switch is acknowledged as usual, logind will get notified via sysfs and pause the old-session's devices and resume the devices of the new session. To allow using this infrastructure with systems without VTs, we provide notification signals. logind sends PauseDevice("force") dbus signals to the current session controller for every device that it pauses. And it sends ResumeDevice signals for every device that it resumes. For seats with VTs this is sent _after_ the VT switch is acknowledged. Because the compositor already acknowledged that it cleaned-up all devices. However, for seats without VTs, this is used to notify the active compositor that the session is about to be deactivated. That is, logind sends PauseDevice("force") for each active device and then performs the session-switch. The session-switch changes the "Active" property of the session which can be monitored by the compositor. The new session is activated and the ResumeDevice events are sent. For seats without VTs, this is a forced session-switch. As this is not backwards-compatible (xserver actually crashes, weston drops the related devices, ..) we also provide an acknowledged session-switch. Note that this is never used for sessions with VTs. You use the acknowledged VT-switch on these seats. An acknowledged session switch sends PauseDevice("pause") instead of PauseDevice("force") to the active session. It schedules a short timeout and waits for the session to acknowledge each of them with PauseDeviceComplete(). Once all are acknowledged, or the session ran out of time, a PauseDevice("force") is sent for all remaining active devices and the session switch is performed. Note that this is only partially implemented, yet, as we don't allow multi-session without VTs, yet. A follow up commit will hook it up and implemented the acknowledgements+timeout. The implementation is quite simple. We use major/minor exclusively to identify devices on the bus. On RequestDevice() we retrieve the udev_device from the major/minor and search for an existing "Device" object. If no exists, we create it. This guarantees us that we are notified whenever the device changes seats or is removed. We create a new SessionDevice object and link it to the related Session and Device. Session->devices is a hashtable to lookup SessionDevice objects via major/minor. Device->session_devices is a linked list so we can release all linked session-devices once a device vanishes. Now we only have to hook this up in seat_set_active() so we correctly change device states during session-switches. As mentioned earlier, these are forced state-changes as VTs are currently used exclusively for multi-session implementations. Everything else are hooks to release all session-devices once the controller changes or a session is closed or removed.

logind: extract has_vts() from can_multi_session() We currently use seat_can_multi_session() to test for two things: * whether the seat can handle session-switching * whether the seat has VTs As both are currently logically equivalent, we didn't care. However, we want to allow session-switching on seats without VTs, so split this helper into: * seat_can_multi_session(): whether session-switching is supported * seat_has_vts(): whether the seat has VTs Note that only one seat on a system can have VTs. There is only one set of them. We automatically assign them to seat0 as usual. With this patch in place, we can easily add new session-switching/tracking methods without breaking any VT code as it is now protected by has_vts(), no longer by can_multi_session().

logind: fix session_activate(vtnr = 0) VT numbers start with 1. If a session has vtnr == 0, we must not assume it is running on a VT. Note that this could trigger the assert() below as CreateSession() sets vtnr to 0, not <0.

logind: rename vtconsole to seat0 The seat->vtconsole member always points to the default seat seat0. Even if VTs are disabled, it's used as default seat. Therefore, rename it to seat0 to correctly state what it is. This also changes the seat files in /run from IS_VTCONSOLE to IS_SEAT0. It wasn't used by any code, yet, so this seems fine. While we are at it, we also remove every "if (s->vtconsole)" as this pointer is always valid!

logind: make Session.Activate() lazy Currently, Activate() calls chvt(), which does an ioctl(VT_ACTIVATE) and immediately calls seat_set_active(). However, VTs are allowed to prevent being deactivated. Therefore, logind cannot be sure the VT_ACTIVATE call was actually successful. Furthermore, compositors often need to clean up their devices before they acknowledge the VT switch. The immediate call to seat_set_active() may modify underlying ACLs, though. Thus, some compositors may fail cleaning up their stuff. Moreover, the compositor being switched to (if listening to logind instead of VTs) will not be able to activate its devices if the old VT still has them active. We could simply add an VT_WAITACTIVE call, which blocks until the given VT is active. However, this can block forever if the compositor hangs. So to fix this, we make Activate() lazy. That is, it only schedules a session-switch but does not wait for it to complete. The caller can no longer rely on it being immediate. Instead, a caller is required to wait for the PropertiesChanged signal and read the "Active" field. We could make Activate() wait asynchronously for the session-switch to complete and then send the return-message afterwards. However, this would add a lot of state-tracking with no real gain: 1) Sessions normally don't care whether Activate() was actually successful as they currently _must_ wait for the VT activation to do anything for real. 2) Error messages for failed session switches can be printed by logind instead of the session issuing Activate(). 3) Sessions that require synchronous Activate() calls can simply issue the call and then wait for "Active" properties to change. This also allows them to implement their own timeout. This change prepares for multi-session on seats without VTs. Forced VT switches are always bad as compositors cannot perform any cleanup. This isn't strictly required, but may lead to loss of information and ambiguous error messages. So for multi-session on seats without VTs, we must wait for the current session to clean-up before finalizing the session-switch. This requires Activate() to be lazy as we cannot block here. Note that we can always implement a timeout which allows us to guarantee the session switch to happen. Nevertheless, this calls for a lazy Activate().

logind: add session controllers A session usually has only a single compositor or other application that controls graphics and input devices on it. To avoid multiple applications from hijacking each other's devices or even using the devices in parallel, we add session controllers. A session controller is an application that manages a session. Specific API calls may be limited to controllers to avoid others from getting unprivileged access to restricted resources. A session becomes a controller by calling the RequestControl() dbus API call. It can drop it via ReleaseControl(). logind tracks bus-names to release the controller once an application closes the bus. We use the new bus-name tracking to do that. Note that during ReleaseControl() we need to check whether some other session also tracks the name before we remove it from the bus-name tracking list. Currently, we only allow one controller at a time. However, the public API does not enforce this restriction. So if it makes sense, we can allow multiple controllers in parallel later. Or we can add a "scope" parameter, which allows a different controller for graphics-devices, sound-devices and whatever you want. Note that currently you get -EBUSY if there is already a controller. You can force the RequestControl() call (root-only) to drop the current controller and recover the session during an emergency. To recover a seat, this is not needed, though. You can simply create a new session or force-activate it. To become a session controller, a dbus caller must either be root or the same user as the user of the session. This allows us to run a session compositor as user and we no longer need any CAP_SYS_ADMIN.

Verify validity of session name when received from outside Only ASCII letters and digits are allowed.

logind-session.c: use _cleanup_

logind: be more verbose on errors

logind: restore logic to kill user processes when session ends

user-sessions: rely on PID 1 to kill sessions As we want to centralized cgroup access we should stop killing the user sessions directly from the systemd-user-sessions service. Instead, rely on PID 1 doing this by adding the right ordering dependencies to the session scope units.

logind: when creating the scope job fails, return this immediately to the client that wants to register the session Otherwise we'll hanging for the job to finish without any job existing. Similar, for machined.

logind: after deserializatio readd systemd units to unit-to-object hashmap correctly

libsystemd-logind: fix detection of session/user/machine of a PID

logind: port over to use scopes+slices for all cgroup stuff In order to prepare things for the single-writer cgroup scheme, let's make logind use systemd's own primitives for cgroup management. Every login user now gets his own private slice unit, in which his sessions live in a scope unit each. Also, add user@$UID.service to the same slice, and implicitly start it on first login.

core: general cgroup rework Replace the very generic cgroup hookup with a much simpler one. With this change only the high-level cgroup settings remain, the ability to set arbitrary cgroup attributes is removed, so is support for adding units to arbitrary cgroup controllers or setting arbitrary paths for them (especially paths that are different for the various controllers). This also introduces a new -.slice root slice, that is the parent of system.slice and friends. This enables easy admin configuration of root-level cgrouo properties. This replaces DeviceDeny= by DevicePolicy=, and implicitly adds in /dev/null, /dev/zero and friends if DeviceAllow= is used (unless this is turned off by DevicePolicy=).

logind: add infrastructure to keep track of machines, and move to slices - This changes all logind cgroup objects to use slice objects rather than fixed croup locations. - logind can now collect minimal information about running VMs/containers. As fixed cgroup locations can no longer be used we need an entity that keeps track of machine cgroups in whatever slice they might be located. Since logind already keeps track of users, sessions and seats this is a trivial addition. - nspawn will now register with logind and pass various bits of metadata along. A new option "--slice=" has been added to place the container in a specific slice. - loginctl gained commands to list, introspect and terminate machines. - user.slice and machine.slice will now be pulled in by logind.service, since only logind.service requires this slice.

Use stdint.h macros instead of casts to print uint64_t values Casts are visually heavy, and can obscure unwanted truncations.

cgroup: make sure all our cgroup objects have a suffix and are properly escaped Session objects will now get the .session suffix, user objects the .user suffix, nspawn containers the .nspawn suffix. This also changes the user cgroups to be named after the numeric UID rather than the username, since this allows us the parse these paths standalone without requiring access to the cgroup file system. This also changes the mapping of instanced units to cgroups. Instead of mapping foo@bar.service to the cgroup path /user/foo@.service/bar we will now map it to /user/foo@.service/foo@bar.service, in order to ensure that all our objects are properly suffixed in the tree.

nspawn: introduce the new /machine/ tree in the cgroup tree and move containers there Containers will now carry a label (normally derived from the root directory name, but configurable by the user), and the container's root cgroup is /machine/<label>. This label is called "machine name", and can cover both containers and VMs (as soon as libvirt also makes use of /machine/). libsystemd-login can be used to query the machine name from a process. This patch also includes numerous clean-ups for the cgroup code.

core: always create /user and /machine top-level cgroup dirs This allows clients to put inotify watches on these trees to watch for state changes, without having to wait until these dirs are created. This introduces the new top-level /machine cgroup dir as canonical location where OS containers and VMs shall be located (as discussed with the libvirt folks).

logind: avoid creating stale session state files There were old session state files accumulating in /run/systemd/session. They confused e.g. "reboot", which thought there were still users logged in. The files got created like this: session_stop(Session *s) -> ... unlink(s->state_file); ... seat_set_active(s->seat, NULL) -> session_save(...); /* re-creates the state file we just unlinked */ Fix it simply by clearing the s->started flag earlier to prevent any further writes of the state file (session_save() checks the flag).

logind: introduce an explicit session class for cronjobs and similar cronjobs are neither interactive user session, nor lock screens, nor login screens, hence they should get their own class.

Use initalization instead of explicit zeroing Before, we would initialize many fields twice: first by filling the structure with zeros, and then a second time with the real values. We can let the compiler do the job for us, avoiding one copy. A downside of this patch is that text gets slightly bigger. This is because all zero() calls are effectively inlined: $ size build/.libs/systemd text data bss dec hex filename before 897737 107300 2560 1007597 f5fed build/.libs/systemd after 897873 107300 2560 1007733 f6075 build/.libs/systemd … actually less than 1‰. A few asserts that the parameter is not null had to be removed. I don't think this changes much, because first, it is quite unlikely for the assert to fail, and second, an immediate SEGV is almost as good as an assert.

honor SELinux labels, when creating and writing config files Also split out some fileio functions to fileio.c and provide a SELinux aware pendant in fileio-label.c see https://bugzilla.redhat.com/show_bug.cgi?id=881577

logind: remove unused variable

logind: add support for automatic suspend/hibernate/shutdown on idle

log: introduce a macro to format message id The MESSAGE_ID=... stanza will appear in countless number of places. It is just too long to write it out in full each time. Incidentally, this also fixes a typo of MESSSAGE is three places.

logind: check return value, log warning on error

logind: redefine idleness to start at last activity Before, after the timeout, a session would be timestamped as idle since 'last activity' + 'idle timeout'. Now, it is timestamped as idle since 'last activity'. Before, after all sessions were idle, the seat would be marked with as idle with the timestamp of the oldest idle session. Now it is marked with the timestamp of the youngest idle session. Both changes seem to me to be closer to natural understanding of idleness: the time since last activity counts.

logind: Ensure the user, seat and session files are updated when the session is closing.

journal: generate structured journal messages for a number of events

log.h: new log_oom() -> int -ENOMEM, use it also a number of minor fixups and bug fixes: spelling, oom errors that didn't print errors, not properly forwarding error codes, few more consistency issues, et cetera

use "Out of memory." consistantly (or with "\n") glibc/glib both use "out of memory" consistantly so maybe we should consider that instead of this. Eliminates one string out of a number of binaries. Also fixes extra newline in udev/scsi_id

logind: fix operation precedence mix-up Since + has higher precedence than ?:, and u+b is unlikely to be exactly zero, the timestamp would usually be set to IDLE_THRESHOLD_USEC. Fix it by returning either 'last activity', or 'last activity+IDLE_THRESHOLD_USEC'.

logind: introduce a state for session, being one of online, active, closing online = logged in active = logged in and session is in the fg closing = nominally logged out but some left-over processes still around Related to: https://bugzilla.gnome.org/show_bug.cgi?id=677556

logind: properly clean up user cgroups when they run empty

mkdir: append _label to all mkdir() calls that explicitly set the selinux context

logind: optionally handle power, sleep and lid switch events This takes handling of chassis power and sleep keys as well as the lid switch over from acpid. This logic is enabled by default for power and sleep keys, but not for the lid switch. If a graphical session is in the foreground no action is taken under the assumption that the graphical session does this.

login: minor typo fix

util: split-out path-util.[ch]

logind: fix memory leak

logind: add shutdown/suspend/idle inhibition framework

relicense to LGPLv2.1 (with exceptions) We finally got the OK from all contributors with non-trivial commits to relicense systemd from GPL2+ to LGPL2.1+. Some udev bits continue to be GPL2+ for now, but we are looking into relicensing them too, to allow free copy/paste of all code within systemd. The bits that used to be MIT continue to be MIT. The big benefit of the relicensing is that closed source code may now link against libsystemd-login.so and friends.

rename basic.la to shared.la and put selinux deps in shared-selinx.la Only 34 of 74 tools need libselinux linked, and libselinux is a pain with its unconditional library constructor.

logind: extend comment about X11 socket symlink

login: track login class (i.e. one of "user", "greeter", "lock-screen") for each session This introduces the new PAM environment variable XDG_SESSION_CLASS. If not set, defaults to "user". This is useful for apps that want to distuingish real user logins from "fake" ones which just exist to show a gdm login screen or a lock screen.

logind: if we have to stop a session, kill at least its leader

exec: introduce ControlGroupPersistant= to make cgroups persistant

logind: move X11 socket

logind: simplify session_activate() a bit

logind: if we can't open /dev/tty0, assume there is no VT subsystem and don't pretend we could do VT switching

logind: move logind into its own subdirectory