#952450 user-setup: set SYSTEMD_SULOGIN_FORCE=1 in env for rescue/emergency.service when root account is locked

#952450#5
Date:
2020-02-24 16:38:53 UTC
From:
To:
Following https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211
the systemd-sulogin-shell binary run by rescue.service and
emergency.service now adds the --force flag for the sulogin call
when SYSTEMD_SULOGIN_FORCE is set to 1 in the environment.

https://github.com/systemd/systemd/commit/33eb44fe4a8d7971b5614bc4c2d90f8d91cce66c
explains that the expectation is that distributions should now
put service override files to set this environment variable.

Thus user-setup should create the appropriate configuration file when
the root account is not configured. Maybe this should be controlled
by some low priority debconf question as the password-less login through
the rescue boot entry can be seen as a security issue by some.

Cheers,

#952450#10
Date:
2021-04-11 11:33:10 UTC
From:
To:
https://github.com/systemd/systemd/commit/33eb44fe4a8d7971b5614bc4c2d90f8d91cce66c

There is https://salsa.debian.org/ah/user-setup/commits/wip/rootpassword
thanks to Andreas.

I'd suggest that people caring about that issue submit this as proper MR.

Regards,
Michael

#952450#15
Date:
2023-06-03 10:58:42 UTC
From:
To:
As an experiment, I recently updated a functional Debian bookworm system to
boot into the systemd 'rescue.target' by default, to test the single-user /
recovery experience as part of #1035543 bug assessment.

My understanding from the relevant manual[1] is that 'emergency.target' is a
similar, albeit even more basic systemd state that is automatically selected
if early boot preconditions fail and/or when serious errors occur.

The system used for testing has a locked root user account, but is essentially
a single-user environment, as I think is typical for many individually-operated
laptops, smartphones and other consumer computing devices.

There are various considerations to balance here, and because some of those
are context/usage-specific, I agree with Raphaël that a debconf question to
figure out the intended behaviour would make sense.  My understanding of it is
something like: "when your system breaks for some reason, are you ok with the
next person who reboots it -- yourself or anyone else -- being able to access
the contents and potentially attempt recovery?"

Most of my experience with that scenario has been that either I or some other
process has broken my computer, and I'd generally much prefer to be able to get
to a recovery prompt without having to use other more time-consuming methods
like removing the disk or finding other ways to get back into the system; but I
can understand that those kind of choices vary person-to-person and over time.

[1] - https://manpages.debian.org/bullseye/systemd/systemd.special.7.en.html