#1072930 libpam-wtmpdb: sessions not closed after systemd-run --user --machine …@.host

Package:
libpam-wtmpdb
Source:
libpam-wtmpdb
Description:
wtmp database PAM module
Submitter:
Tomas Janousek
Date:
2024-07-27 15:45:03 UTC
Severity:
normal
#1072930#5
Date:
2024-06-10 14:26:24 UTC
From:
To:
If I do the following:

	$ sudo systemd-run --user -M "$USER"@.host --quiet --wait --collect --pipe echo foo

then I get an error in the journal:

	Jun 10 14:15:08 deb1-wtmpdb systemd[657]: Started run-u7.service - echo foo.
	Jun 10 14:15:08 deb1-wtmpdb (sd-pam)[1297]: pam_unix(login:session): session closed for user debian
	Jun 10 14:15:08 deb1-wtmpdb (sd-pam)[1297]: pam_wtmpdb(login:session): update_logout: Updating logout time did not return SQLITE_DONE: 8

and the session stays open:

	$ last
	debian                                 Mon Jun 10 14:15 - still logged in
	debian                                 Mon Jun 10 14:15 - still logged in
	debian                                 Mon Jun 10 14:15 - still logged in
	debian                                 Mon Jun 10 14:15 - still logged in

Trying this with an older snapshot of unstable, the output of last looks like this instead:

	$ last
	debian                                 Mon Jun 10 14:13    gone - no logout
	debian                                 Mon Jun 10 14:13    gone - no logout
	debian                                 Mon Jun 10 14:13    gone - no logout

With that older unstable snapshot, there is, however, an error from pam_systemd:

	Jun 10 14:13:56 deb2-wtmpdb (sd-pam)[582]: pam_systemd(login:session): Failed to release session: Access denied

That one was fixed by
https://github.com/keszybz/systemd/commit/fc0bb7ccc763ec79efe7a8a58220e9bc80f34f81
and perhaps exploring the discussions linked there might be useful when
figuring out how to fix this in libpam-wtmpdb.
#1072930#10
Date:
2024-07-27 14:50:55 UTC
From:
To:
Luca,


I'll need your help/insight here. ISTM systemd is restricting what
PAM is allowed to do, but the libpam-wtmpdb cannot really function
without writing to its file.

How is this supposed to work?
Was there a discussion with wtmpdb upstream?

Chris
#1072930#21
Date:
2024-07-27 15:41:57 UTC
From:
To:
On Sat, 27 Jul 2024 16:50:55 +0200 Chris Hofstaedtler <zeha@debian.org> wrote:
collect --pipe echo foo
u7.service - echo foo.
pam_unix(login:session): session closed for user debian
pam_wtmpdb(login:session): update_logout: Updating logout time did not
return SQLITE_DONE: 8
logged in

Sorry I am completely clueless about pam, please ask upstream on the
mailing list or on a ticket