Systemd and ConsoleKit

Slightly scared about the talk of needing to write hal rules though...

I hope this does not bother anybody. Feel free to remove it if it does.

systemd work for the session

Goals:

Simplify our stack by removing CK
Automatic multi-seat support
Make systemd available in the session
Removal of XDG_SESSION_COOKIE and its security problems, emphasis on audit loginuid and cgroup names instead
On-Demand starting of VT gettys
Fix the 63 threads issue
Covering all of getty, SSH and X11 sessions
Make session exit of pam_systemd more robust
Introduce D-Bus user bus
allow systemd user services to be run outside of a session, for selected users, a la cron with cron.allow

Current ConsoleKit features:

Registration of user sessions and seats storing of meta data
fast user switching
shutdown/reboot handling
Logging of user logins/logouts
udev integration to do device node ACLs
PK integration to verify console access to certain functionality

Logging currently is done 6 times (neither are indexed, except for utmp and lastlog which are indexed by uid):

utmp
wtmp
syslog
audit
ConsoleKit logs
lastlog

Plans:

Introduce “seat” tags on video, input, audio, other devices in udev
Make X11 check those tags. This requires a simple patch, i.e. udev_monitor_filter_add_match_tag(), based on the tag name passed on the X command line; if no seat name is given on the command line, pick up all devices without seat tag, to mimic current behaviour
gdm will spawn one X server for each video card found as they pop up, X itself should discover matching input devices
plymouth should also make use of all video cards and input devices found, as they pop up, and and terminate as soon as gdm takes over, plymouth should ignore seat assignments however, and act on all display and input devices
A tiny udev rule will try to automatically assign seat tags for devices manufactured by Plugable. Other hardware in the beginning will require writing udev rules manually. Eventually a UI for this should be written which spits out and installs udev rules.
Most of the logic in pam_systemd will move into a tiny bus service, and which will hand out “leaking” pipe fds to detect when the session ends, the same way pam_consolekit_connector works right now, but built around dbus fd passing
This bus service will have a similar interface to CK, however do a few key things differently: no cookie management (rely on audit login uid instead), listening on /sys/class/tty/tty0/active, on-demand triggering of gettys (or any other service), when an allocated VC with no process is activated. VCs will be handed out strictly based on a first-come first-serve basis, no fixed mapping anymore -- except for tty1. We will pre-allocate 12 ttys by default, but not start anything on them. If X needs another tty it just takes the next free one. If a tty is activated (by keypress) which currently has no client we will start a getty on it. That means by default we run zero gettys on a graphical boot, but they become instantly available as soon as the user switches ttys.
There will be no public CK database. However we will provide a tiny library (drop-in or .so) which allows NM, PK and D-Bus query whether a PID or user is currently on an active sesssion without involving D-Bus, as fast path for auth checks
udev-acl will move into this dbus service
Separate bus service for shutting down/rebooting/suspending the system, with integration into PK and which checks whether sessions are left open
We’ll introduce the D-Bus user bus, as discussed with various folks at the GNOME Summit last year, and redirect the session bus to it
We will implicitly spawn a systemd instance for each user on first login, and remove it at last logout. Lifetime of XDG_RUNTIME_DIR, the user cgroup, the user bus and the systemd instance are bound together
Ideally, X would start to listen on $XDG_RUNTIME_DIR/display or a similar socket. Could be default for clients if no $DISPLAY is set. Alternatively symlink hackery
We will focus on Linux and Linux only
Introduction of PR_SET_ANCHOR and usage in g-s/systemd, to ensure that all user processes are children of systemd/g-s and not detached
gnome-session will mostly stay as it is for now, however will use the user bus if it exists
Most likely drop support for CK history log files. Only user appears to be gdm and accountsservice. option 1) move this into gdm itself, so that gdm shows its own most frequent users only; option 2) use wtmp for this, which while ugly to use offers mostly the same functionality. If we need more metadata than wtmp can provide, hijack the 20 unused bytes at the end of each utmp record. If eventually we reintroduce log files for this, then we should do this in a really convincing fashion, i.e. indexed, with live querying support and suchlike
Optionally start user session (without display) already on system bootup, to permit timer-based cron-like user-code to run, or to run network services independent of an actual login. This will be strictly optional and only permitted for users with a flag file in /var/lib/systemd/user/xxx. Flag files controllable via PK, yadda yadda
Note that there is no static configuration of seats. The tiny dbus service will provide a list of current seats only based on the udev database: if there’s a display device with a seat tag, then this seat exists, otherwise it doesn’t
Seats and seat names will automatically be generated for Plugable devices based on their udev path id. i.e. by plugging in a plugable device a dynamic seat “seat-pci-0000-00-1f-2-usb-4711-0815” (or something like that) is generated and exists exactly as long has it is plugged in.
No stored CK database as public API, instead store everything we need in memory, and export only very few things in the fs, for example to allow fast perm checks for dbus/NM/PK
Embedded folks can work without the bus service, to get old-style behaviour

Perspective for F17:

In F17, we might want to move user service/process handling from g-s to systemd, and get a definition of running application along the lines of the cgroups for them, which transcends all layers of our stack, from kernel to the UI; an application that isn’t running is simply a .desktop file, and when it runs it is the cgroup by the same name
keep in focus for later: support multi-session and session switching on secondary VGA cards, in userspace

Transition:

We will ensure CK and the new scheme can run side-by-side. Only the ACL management of CK will be disabled when the new scheme is enabled
Phase-out similar to HAL’s, leave things running side-by-side but port important things over quickly. Should be much easier than HAL, since less code uses it

External patches:

udev: disable udev-acl
X11: add seat support (check for tags)
X11: make x11 XDG_RUNTIME_DIR-aware
gdm: for libudev support and new seat registration
plymouth: for libudev support
dbus: for new active session detection
PK: for new active session detection
NM: for new activte session detection
accountsservice: for new login history logs
kernel: PR_SET_ANCHOR
kernel: xattr on cgroup
kdm, other dms: drop CK support. Quite possibly the PAM session hooks are sufficient for our needs, no need for patching in new support into dms

Questions left unanswered:

What about idle hint stuff?

Where is what?

CK’s seat management and session switching is pushed into new tiny bus service systemd-logind (or similarly named)
CK’s logging is removed, and utmp/wtmp used instead
CK’s shutdown/reboot handling moves into new tiny bus service systemd-rebootd (or similarly named)
udev-acl will move into systemd-logind
most of pam_systemd will move into systemd-logind

Effective new features by doing this:

Automatic Multi-Seat
Running user services outside of session
gettys only spawned on demand
synchronization on VGA discovery can be dropped → faster bootup
Cleaner PS tree
D-Bus/systemd available for user logins

Is fork/exec now considered harmful?