On Tue, Nov 26, 2019 at 09:53:49AM -0600, Michael Catanzaro wrote: > On Tue, Nov 26, 2019 at 9:35 am, Chris Adams <li...@cmadams.net> wrote: > >That should be considered a bug IMHO... > > At least for rescue mode, probably yes, but I don't know what to do > about it. Can we make systemd's rescue prompt ask for username and > allow logging in with any user account (goal being to log in to > admin account then 'sudo -i')? Or would there be problems with that? > Clearly it's not designed for that purpose, and it seems > intentional.
systemd does not implement user authentication by itself: it just spawns getty/gdm/etc during normal runtime, and sulogin for emergency logins. We generally do not want to re-implement this functionality in systemd. selinux has some special permissions for sulogin, etc. Ideally, sulogin would get the capability to pick an alternative user. util-linux already has the code to select and authenticate users, so it'd be just a question of some design work and rearranging the code. On Tue, Nov 26, 2019 at 09:39:59AM -0700, Chris Murphy wrote: > Mayyyybee systemd-homed is in > a position to solve this by having early enough authentication > capability by rescue.target time that any admin user can login? Actually, it may. Things are confusing here, because systemd-homed is implemented together with changes to how user metadata querying is done: instead of using dbus, a brokerless and much simpler varlink query is used. That last part is what would be relevant to early-boot logins, because less services need to be up to bring up the user session. Zbyszek _______________________________________________ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
