Distributors ponder a systemd change

Posted Jun 8, 2016 8:31 UTC (Wed) by matthias (subscriber, #94967)
In reply to: Distributors ponder a systemd change by dd9jn
Parent article: Distributors ponder a systemd change

crontab -e, batch and at are only possible, if the administrator allows for them. The same should hold true for user processes lingering around after the user session is closed.

Distributors ponder a systemd change

Posted Jun 8, 2016 10:46 UTC (Wed) by hmh (subscriber, #3838) [Link] (1 responses)

It is possible to do that, and it has been possible to do that since day one: you pkill/killall after logout. There are a number of ways to hook a script to session end/logout.

I should add that pkill/killall can actually implement the "no user processes left" behavior, unlike the new systemd functionality, which is about "no processers started by this session are left when the session ends". Two very different things, but people seem to want to claim the new systemd behavior is actually useful for security, when it is *completely useless* for that, so it looks like we need to point out the utterly obvious...

The new behavior is a best-effort house cleanup thing, nothing more. And an unwelcome one *as implemented right now* at that, because it causes too much collateral damage for very little gain. The old behavior, where one would explicitly enable the functionality where useful, was a lot better.

Distributors ponder a systemd change

Posted Jun 8, 2016 11:30 UTC (Wed) by matthias (subscriber, #94967) [Link]

As far as I understand, the systemd functionality should ensure that no user processes are left after the last user session has exited, unless the administrator allows otherwise (systemd linger functionality, allowing at, batch or cron jobs for the user).

Having really no processes survive when a session ends makes no sense at all. If I open two sessions and log out of one of them, the second session would be killed. If every session takes care to kill its own processes, no process should survive.

For myself, I like the new behaviour. Not because of security, but because I think that it is the job of session management to do some clean-up. Of course this means that screen/tmux/nohup should get changed to work again. Once these few programs are fixed, there should not be much collateral damage. Before that, I do not expect this change to hit stable distributions, anyway.