I've built an application that emulates a HID device via /dev/uhid on linux. My application is broken into two programs. First, a very simple setuid root binary that opens /dev/uhid and emulates just the one device, passing messages back and forth to the program that invoked it. Second, an application that actually contains all of the device logic, and uses the other binary just to encapsulate uhid_event messages and talk to the kernel. Anyone with console access can plug in a hardware USB device anyway, but for security, I would like the setuid program to refuse to run on behalf of non-console users. My question: What's the simplest, most robust way for a setuid root application to check if it was invoked by a console user and bail if not, or to restrict execution of the program to console users in the first place?

some time ago I moved from Systemd to OpenRC. It was very different, to be able to use audio and webcam I had to add my user to the audio, optical and video group. As some software uses pkexec to be run as superuser, when I opened them (Because I use XFCE) nothing happened. When I used Systemd this didn´t happened, and it´s configured to use /usr/lib/polkit-gnome/polkit-gnome-authentication-agent-1 (which I have it installed). When I write pkexec in a terminal this is the output $ pkexec ==== AUTHENTICATING FOR org.freedesktop.policykit.exec === Authentication is required to modify fingerprint authentication data Authenticating as: (MY USERNAME) Password: polkit-agent-helper-1: error response to PolicyKit daemon: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: No session for cookie ==== AUTHENTICATION FAILED === Error executing command as another user: Not authorized This incident has been reported. I don´t know how to enable the polkit daemon/service in OpenRC, in Systemd the service it´s named "polkit". But there is ConsoleKit (what´s the difference?) which is seems to fail $ service consolekit status * status: stopped # service consolekit restart * starting consolekit . . $ service consolekit status * status: crashed My distro is Parabola (Arch Based, with the difference that is removes all the nonfree packages from the repo & Arch itself, as Arch uses Systemd, Parabola too) and I changed to OpenRC in a virtual machine, and I am testing it. Thanks in advance Other outputs $ groups wheel network video audio storage polkitd $USERNAME

I have seen that recent GNU/Linux are using ConsoleKit and PolicyKit. What are they for? How do they work? The best answer should explain what kind of problem each one tries to solve, and how they manage to solve it. I am a long-time GNU/Linux user, from a time when such things did not exist. I have been using Slackware and recently Gentoo. I am an advanced user/admin/developer, so the answer can (and should!) be as detailed and as accurate as possible. I want to understand how these things work, so I can use them (as a user or as a developer) the best possible way.

We have a system that's been a bit sluggish. top reports that console-kit-daemon takes anywhere from 18-30% CPU and about 50% memory. There are only two users logged in, one on X and one via ssh. Any ideas how to resolve this? Running Debian. uname reports: Linux bulls5 2.6.32-5-686 #1 SMP Sun Sep 23 09:49:36 UTC 2012 i686 GNU/Linux First few lines of top: 9456 root 20 0 2006m 1.8g 2020 S 19 50.2 1788:50 console-kit-dae 1501 messageb 20 0 425m 397m 796 S 0 10.6 230:20.64 dbus-daemon 3799 tomcat6 20 0 932m 450m 7208 S 0 12.0 106:36.35 java 24383 postgres 20 0 48312 7956 5640 S 0 0.2 0:00.44 postgres 27239 root 20 0 8672 3092 2544 S 0 0.1 0:00.01 sshd 27304 root 20 0 8672 3092 2544 S 0 0.1 0:00.01 sshd

ConsloeKit is the traditional mechanism for tracking user sessions on Linux. eLogind has similar functionality, but is based on systemd and "independentized". What are the differences in their functionality/feature set? What are their pros and cons?

When consolekit starts on my system, polkitd also starts and during that startup, I see an error message complaining that polkitd cannot find files that exist. I checked the permissions and they seem fine, so I'm wondering if it is a configuration issue for the content inside of the files.

OS: Linux Mint 18.2 Cinnamon 64-bit (which is based on Ubuntu 16.04) In an effort to disable hibernation, I did the following with a consequence. After I have moved the following polkit file to root directory with command: sudo mv /etc/polkit-1/localauthority/50-local.d/com.ubuntu.enable-hibernate.pkla / and rebooted, the shutdown menu looks as follows: As you can see for yourself, there is no actual useful button. It starts to be annoying as I started shutting down my computer at night, which I do with logout menu button and from the login screen I click on shutdown. Strange is, that after I re-created the file (I deleted it before I actually rebooted) makes no difference. A few information... ll /etc/polkit-1/localauthority/50-local.d/com.ubuntu.enable-hibernate.pkla shows: -rw-r--r-- 1 root root 233 Oct 24 20:09 /etc/polkit-1/localauthority/50-local.d/com.ubuntu.enable-hibernate.pkla and cat /etc/polkit-1/localauthority/50-local.d/com.ubuntu.enable-hibernate.pkla outputs: [Re-enable hibernate by default] Identity=unix-user:* Action=org.freedesktop.upower.hibernate ResultActive=yes [Re-enable hibernate by default in logind] Identity=unix-user:* Action=org.freedesktop.login1.hibernate ResultActive=yes I checked with another machine with the same OS, and there is absolutely the same file. I looked at the history and I am unaware, that I would do any other change than removing that one file. I am confused as to what destroyed my shutdown menu. I am unsure, what went wrong, and what should I do now to get the standard shutdown menu back? **EDIT1:** sudo tail -f /var/log/syslog revealed something: Oct 24 20:56:56 vb-nb-mint cinnamon-session: WARNING: t+2496.50307s: Could not connect to ConsoleKit: Could not get owner of name 'org.freedesktop.ConsoleKit': no such name Oct 24 20:56:56 vb-nb-mint cinnamon-session: WARNING: t+2496.50368s: Could not connect to ConsoleKit: Could not get owner of name 'org.freedesktop.ConsoleKit': no such name Oct 24 20:59:50 vb-nb-mint cinnamon-session: WARNING: t+2670.11358s: Could not connect to ConsoleKit: Could not get owner of name 'org.freedesktop.ConsoleKit': no such name Oct 24 20:59:50 vb-nb-mint cinnamon-session: WARNING: t+2670.11426s: Could not connect to ConsoleKit: Could not get owner of name 'org.freedesktop.ConsoleKit': no such name The package consolekit is installed. Maybe corrupted? apt-cache policy consolekit shows: consolekit: Installed: 0.4.6-5 Candidate: 0.4.6-5 Version table: *** 0.4.6-5 500 500 http://archive.ubuntu.com/ubuntu xenial/universe amd64 Packages 100 /var/lib/dpkg/status **EDIT2:** I found out, that if I run: ck-launch-session dbus-launch the standard shutdown menu appears !!! How do I make that command to run automatically with each boot? **EDIT3:** It is strange, though, that **Sleep** and Hibernate menu items are missing there. I highlight Sleep, because I would like to use it.

I have a user that I use to run untrusted programs (more specifically, Skype). I would like to give that user access to the webcam. I am using Debian, where the standard way to do this is to put users in the video group. However, it seems like this allows them to do more than just access the webcam, more specifically they can "write to video memory" https://www.debian-administration.org/article/109/How_Debian_controls_hardware_access . I am not sure about the security implications of this. What is the proper way to give a user access specifically to the webcam? I could change the ownership of /dev/video0 to a specific group that I would put the restricted user and my regular user in, but is this the correct way, and is there a proper way to make it persist across reboots? Alternatively, I have heard that this was doable with PolicyKit or ConsoleKit, but I have been unable to find examples online. How can this be done then? To give more details: the unprivileged user will never use a TTY or a GDM to log in. It runs its applications using sudo launched by my regular user, and accesses my regular user's pulseaudio daemon and my regular user's X server (via xpra). Thanks a lot in advance for your help!

I found the following command line to shut down a Debian/GNU Linux system dbus-send \ --system \ --dest=org.freedesktop.ConsoleKit \ --type=method_call \ --print-reply \ --reply-timeout=2000 \ /org/freedesktop/ConsoleKit/Manager \ org.freedesktop.ConsoleKit.Manager.Stop It works if I execute the command as superuser, but as a non-privileged user it says: Error org.freedesktop.ConsoleKit.Manager.NotPrivileged: Not Authorized I would like to know if it is possible to modify such a command in such a way that, interacting with PolicyKit, it can grant the privilege to shut down the system to a normal user.

Running KDE Frameworks 5, Plasma 5, using sddm as a display manager. ConsoleKit and PAM-linux are both installed. Upon login (using the sddm login screen), ck-list-sessions returns FALSE for both is-local and active. Only one session is present. If I log out, then back in, the two fields are both TRUE, as expected. sddm is not a console-kit supporting dm. Therefore, I am using the pam_ck_connector.so module to attach a consolekit session. The sddm startup file (/usr/share/sddm/scripts/Xsession) is modified to launch using the line: eval exec "ck-launch-session dbus-lauch --exit-with-session $session" The (I think relevant) pam files are as follows: /etc/pam.d/sddm: auth include system-auth account include system-account password include system-password session include system-session session optional pam_loginuid.so session optional pam_ck_connector.so nox11 session optional pam_warn.so /etc/pam.d/sddm-greeter: # Load environment from /etc/environment and ~/.pam_environment auth required pam_env.so # Always let the greeter start without authentication auth required pam_permit.so # No action required for account management account required pam_permit.so # Can't change password password required pam_deny.so # Setup session session required pam_unix.so #session optional pam_loginuid.so session optional pam_ck_connector.so session optional pam_warn.so pam_warn.so lines have been added to force logging to the /var/log/auth.log file. A typical login looks something like: sddm-helper: pam_unix(sddm-greeter:session): session opened for user sddm by (uid=0) sddm-helper: pam_warn(sddm-greeter:session): function=[pam_sm_open_session] flags=0 service=[sddm-greeter] terminal=[:0] user=[sddm] ruser=[] rhost=[] sddm-helper: pam_unix(sddm:session): session opened for user by (uid=0) sddm-helper: pam_ck_connector(sddm:session): nox11 mode, ignoring PAM_TTY :0 sddm-helper: pam_warn(sddm:session): function= [pam_sm_open_session] flags=0 service= [sddm] terminal=[:0] user=[] ruser=[] rhost=[] polkitd: Registered Authentication Agent for unix-session:/org/freedesktop/ConsoleKit/Session4 (system bus name :1.38 [/opt/kde/lib64/libexec/polkit-kde-authentication-agent-1], object path /org/kde/PolicyKit1/AuthenticationAgent, locale en_GB.ISO-8859-1) How can I make my system start normally the first time?

When i launch xfce on normla user: with consolekit and dbus i have all shutdown,reboo,suspend etc buttons but the are grey inactive. Without consolekit and dbus I can shutdown but ther are no susupend and hibernation buttons. To launch xfce by script in .bashrc How to enable shutdown and suspen options for normal user?

I was doing some maintenance via root account over ssh after several months of inattention. I shutdown, after startup I **can't log in to root account** at tty or via ssh. Fortunately, **sudo works** to perform root actions through my user account. There's **nothing special about the install**. Its out-of-the-box, so to speak. root uses local authentication. I first tried changing the root password. The password change was successful, because I was also able to **authenticate against the root account** with: authconfig --test, which asks for root password outside of sudo/su. **Reset permissions** and owner/groups with rpm -a --setperms coreutils **PAM debug** on pam_succeed_if.so. Here is the last borked session using pam debug flag: Jul 27 18:29:18 mrwizard sshd: Server listening on 0.0.0.0 port 22. Jul 27 18:29:18 mrwizard sshd: Server listening on :: port 22. Jul 27 18:32:51 mrwizard login: pam_succeed_if(login:session): 'service' resolves to 'login' Jul 27 18:32:51 mrwizard login: pam_succeed_if(login:session): requirement "service in crond" not met by user "root" Jul 27 18:32:51 mrwizard login: pam_unix(login:session): session opened for user root by LOGIN(uid=0) Jul 27 18:32:51 mrwizard login: ROOT LOGIN ON tty1 Jul 27 18:32:52 mrwizard login: pam_succeed_if(login:session): 'service' resolves to 'login' Jul 27 18:32:52 mrwizard login: pam_succeed_if(login:session): requirement "service in crond" not met by user "root" Jul 27 18:32:52 mrwizard login: pam_unix(login:session): session closed for user root Jul 27 18:32:56 mrwizard login: pam_succeed_if(login:session): 'service' resolves to 'login' Jul 27 18:32:56 mrwizard login: pam_succeed_if(login:session): requirement "service in crond" not met by user "root" requirement "service in crond" [seems normal TMI](https://bugzilla.redhat.com/show_bug.cgi?id=205067) // As requested: Jul 27 18:29:27 mrwizard crond: (CRON) STARTUP (1.4.4) Jul 27 18:29:27 mrwizard crond: (CRON) INFO (RANDOM_DELAY will be scaled with factor 34% if used.) Jul 27 18:29:27 mrwizard crond: (CRON) INFO (running with inotify support) Jul 27 18:30:01 mrwizard CROND: (root) CMD (/usr/lib/sa/sa1 1 1) Jul 27 18:40:01 mrwizard CROND: (root) CMD (/usr/lib/sa/sa1 1 1) Jul 27 18:50:01 mrwizard CROND: (root) CMD (/usr/lib/sa/sa1 1 1) Jul 27 19:00:01 mrwizard CROND: (root) CMD (/usr/lib/sa/sa1 1 1) Jul 27 19:01:01 mrwizard CROND: (root) CMD (run-parts /etc/cron.hourly) Jul 27 19:01:01 mrwizard run-parts(/etc/cron.hourly): starting 0anacron Jul 27 19:01:01 mrwizard run-parts(/etc/cron.hourly): finished 0anacron Jul 27 19:10:01 mrwizard CROND: (root) CMD (/usr/lib/sa/sa1 1 1) Jul 27 19:20:01 mrwizard CROND: (root) CMD (/usr/lib/sa/sa1 1 1) Jul 27 19:30:01 mrwizard CROND: (root) CMD (/usr/lib/sa/sa1 1 1) Jul 27 19:40:01 mrwizard CROND: (root) CMD (/usr/lib/sa/sa1 1 1) Jul 28 18:14:45 mrwizard crond: (CRON) STARTUP (1.4.4) Jul 28 18:14:45 mrwizard crond: (CRON) INFO (RANDOM_DELAY will be scaled with factor 45% if used.) Jul 28 18:14:45 mrwizard crond: (CRON) INFO (running with inotify support) $ cat /etc/pam.d/crond # The PAM configuration file for the cron daemon # No PAM authentication called, auth modules not needed account required pam_access.so account include password-auth session required pam_loginuid.so session include password-auth auth include password-auth

My X login manager (slim) has brought with it a dependency on a package consolekit I don't know what consolekit is good for, other login managers such as wdm do not need it. But anyway, the problem I am having is that consolekit is logging lots of garbage in /var/log/ConsoleKit/history. I am not interested in those logs. Is it possible to disable logging? I have tried removing the log file and creating a symlink to /dev/null ln -s /dev/null /var/log/ConsoleKit/history But that does not work, because consolekit now complains that there are too many levels of symbolic links.

First of all, I'm using Debian testing system with standalone Openbox. I don't have systemd, just sysvinit, and I certainly won't use systemd . Yesterday my Debian box started returning messages like the ones below: Jun 14 18:08:10 morfikownia login: pam_unix(login:session): session opened for user morfik by LOGIN(uid=0) Jun 14 18:08:10 morfikownia dbus: [system] Activating service name='org.freedesktop.ConsoleKit' (using servicehelper) Jun 14 18:08:10 morfikownia dbus: [system] Activated service 'org.freedesktop.ConsoleKit' failed: Failed to execute program org.freedesktop.ConsoleKit: Success ... Jun 14 18:08:19 morfikownia pulseaudio: [pulseaudio] sink.c: Default and alternate sample rates are the same. Jun 14 18:08:19 morfikownia pulseaudio: [pulseaudio] source.c: Default and alternate sample rates are the same. Jun 14 18:08:20 morfikownia dbus: [system] Activating service name='org.freedesktop.ConsoleKit' (using servicehelper) Jun 14 18:08:20 morfikownia dbus: [system] Activated service 'org.freedesktop.ConsoleKit' failed: Failed to execute program org.freedesktop.ConsoleKit: Success Jun 14 18:08:20 morfikownia pulseaudio: [pulseaudio] module-console-kit.c: GetSessionsForUnixUser() call failed: org.freedesktop.DBus.Error.Spawn.ExecFailed: Failed to execute program org.freedesktop.ConsoleKit: Success Jun 14 18:08:20 morfikownia pulseaudio: [pulseaudio] module.c: Failed to load module "module-console-kit" (argument: ""): initialization failed. Jun 14 18:08:20 morfikownia pulseaudio: [pulseaudio] main.c: Module load failed. Jun 14 18:08:20 morfikownia pulseaudio: [pulseaudio] main.c: Failed to initialize daemon. Moreover, each su command generates the following log: Jun 14 18:08:50 morfikownia su: Successful su for root by morfik Jun 14 18:08:50 morfikownia su: + /dev/pts/2 morfik:root Jun 14 18:08:50 morfikownia su: pam_unix(su:session): session opened for user root by (uid=1000) Jun 14 18:08:50 morfikownia dbus: [system] Activating service name='org.freedesktop.ConsoleKit' (using servicehelper) Jun 14 18:08:50 morfikownia dbus: [system] Activated service 'org.freedesktop.ConsoleKit' failed: Failed to execute program org.freedesktop.ConsoleKit: Success I managed to fix these issues. In the case of PulseAudio, I just commented out these lines from the /etc/pulse/default.pa file: ### If autoexit on idle is enabled we want to make sure we only quit ### when no local session needs us anymore. #.ifexists module-console-kit.so #load-module module-console-kit #.endif #.ifexists module-systemd-login.so #load-module module-systemd-login #.endif In the case of everything else, I had to run pam-auth-update and unchecked ConsoleKit Session Management: PAM profiles to enable [ ] encfs encrypted home directories [*] Unix authentication [ ] Mount volumes for user [*] GNOME Keyring Daemon - Login keyring management [ ] ConsoleKit Session Management [ ] Inheritable Capabilities Management And a small change was needed to the ~/.xinitrc file: #exec ck-launch-session dbus-launch --sh-syntax --exit-with-session openbox-session exec openbox-session because when I was trying to check a session list, I got the following error: $ ck-list-sessions ** (ck-list-sessions:15584): WARNING **: Failed to get list of seats: Failed to execute program org.freedesktop.ConsoleKit: Success There's no errors now, but I have no idea what changes these steps can cause. I know the consolekit is dead one way or another, so this ultimately would happen anyway. Meanwhile, I'm reading this question in order to understand what will happen after this change, but I don't get many things. > It allows switching users without logging out [many user can be logged > in on the same hardware at the same time with one user active]. I can do su user, and it changes without a problem: Jun 15 10:36:57 morfikownia su: Successful su for morfik2 by morfik Jun 15 10:36:57 morfikownia su: + /dev/pts/5 morfik:morfik2 Jun 15 10:36:57 morfikownia su: pam_unix(su:session): session opened for user morfik2 by (uid=1000) I can also log many users in via ssh. So where's the advantage of using consolekit? Could you tell me if deleting it can cause any security problems, and how can I see the change? Because it looks like nothing has changed.

I have a live Debian Squeeze system on a USB drive, containing a script I use to image another drive. This script uses udisks to mount a drive by label, but it doesn't work over a serial console. The reason is that the session associated with the serial console does not appear to be "active", which means that udisks fails with: user@my-live-usb:~$ udisks --mount /dev/disk/by-label/image-data --mount-options ro Mount failed: Not Authorized Changing the allow_any key in /usr/share/polkit-1/actions/org.freedesktop.udisks.policy doesn't help, so I'd like to know how to tell ConsoleKit that the serial console is "active". Trying to do this via the DBUS interface fails: user@my-live-usb:~$ dbus-send --system --print-reply --dest="org.freedesktop.ConsoleKit" /org/freedesktop/ConsoleKit/Session7 org.freedesktop.ConsoleKit.Session.Activate Error org.freedesktop.DBus.GLib.UnmappedError.CkSeatError.Code0: Unable to activate session Session7 is the one listed as being on /dev/ttyS0. So how can I get ConsoleKit to recognise the serial console as an active session? (In my case, udisks version is 1.0.1+git20100614-3, consolekit is 0.4.1-4.) It's also probably worth noting the the Debian live system automatically logs the live user in on all 6 video consoles and the serial console.

I need to restrict the client of a D-Bus service to only the user logged into the system locally, via ConsoleKit or systemd. How must I configure or write the D-Bus service to do so?

I have been playing with Dbus (versions 1.4.0, in Ubuntu 10.10 and 1.4.14) and ConsoleKit (versions 0.4.1 and 0.4.5) to reboot or halt my computer without being a superuser. Everything works fine in both versions. If I execute the commands detailed in this page , the systems halts or reboots without troubles. Now, what I'd like to know is whether I can schedule that halt/reboot at a certain time (still using Dbus/ConsoleKit). Something like the shutdown command can do (shutdown -h 10:56) Is that possible? I can always use an at or cron, but if I can do it straight with dbus, that'd be perfect.

Okay, first off, this is not a problem I am facing, but I would like to understand this better. If I wish to shutdown / reboot my machine from the command line I need to call: $ sudo poweroff $ sudo reboot That is, I need root privileges to make these ACPI calls. However, I start my DE, (I use XFCE) without granting it root privileges: $ startxfce4 --with-ck-launch Now, I know that the --with-ck-launch parameter helps allows XFCE to shutdown / reboot my system, but I do not understand how. What allows ConsoleKit to shutdown without root privileges? How can it change the runlevel without super-user privileges? And since it is possible, how can I shutdown my machine from the console without root privileges?

Can it hurt if I shut down my machine without closing all programs? I normally close all of them by hand, but have heard from others that this is really not necessary anymore (i.e. Linux will take care of proper closing of programs before shutting down the computer). I normally run applications like Thunderbird, VIM (with no unsaved files opened), and browser windows when I shut down my pc. And I would make sure not to be writing anything to USB when shutting down. Running Arch Linux and shutting down using ConsoleKit .

I have systemd (and no sysvinit) installed on a Arch Linux box. However, I cannot shutdown/reboot with consolekit (dbus interface). # systemctl {shutdown,reboot} work just fine, so I guess it's because consolekit doesn't know how to contact the pid 1 process.