gdm should use systemd-userdbd

[jtojnar]

In GNOME 49, GDM started to default to using systemd-userdbd to dynamically create users for each greeter instance. Unfortunately, I did not manage to make it work in time so I had to resort to hardcoding the greeter users:

nixpkgs/nixos/modules/services/display-managers/gdm.nix

Lines 189 to 222 in 4639179

	users.users.gdm-greeter = {
	isSystemUser = true;
	uid = 60578;
	group = "gdm";
	home = "/run/gdm";
	};
	users.users.gdm-greeter-1 = {
	isSystemUser = true;
	uid = 60579;
	group = "gdm";
	home = "/run/gdm-1";
	};
	users.users.gdm-greeter-2 = {
	isSystemUser = true;
	uid = 60580;
	group = "gdm";
	home = "/run/gdm-2";
	};
	users.users.gdm-greeter-3 = {
	isSystemUser = true;
	uid = 60581;
	group = "gdm";
	home = "/run/gdm-3";
	};
	users.users.gdm-greeter-4 = {
	isSystemUser = true;
	uid = 60582;
	group = "gdm";
	home = "/run/gdm-4";
	};

Tested with systemd 257.9 and #205121 but it always failed on various PAM issues.

[gepbird]

Maybe this is responsible for gdm-greeter running user services, can that be avoided somehow?

systemd.user.services.sleep = {
  wantedBy = [ "graphical-session.target" ];
  serviceConfig = {
    Type = "simple";
    ExecStart = "${pkgs.coreutils}/bin/sleep 1000";
  };
};

Start a gnome machine with the above config, when you get to the display manager, go into a tty and check ps aux | grep sleep. On GNOME 49 there's a sleep process owned by gdm-greeter, while previously there was no process created.

(If this issue is unrelated, then definitely something else from #440720 causes it.)

[nikamarisa]

The root cause is that queries of the shadow database bypass nsncd/nscd. On NixOS this means such queries are not aware of the NSS modules defined in config.system.nssModules.path, which includes nss_systemd.

This means pam_unix's helper binary unix_chkpwd can't find the dynamic greeter users.

To solve this, one can

• point /run/wrappers/bin/unix_chkpwd to a wrapped version which adds config.system.nssModules.path to LD_LIBRARY_PATH
• or add a PAM module which talks directly to systemd-userdbd, such as pam_sduserdb.

I have been using the both approaches on 25.11, the first from early December until mid February, and the second one since then.

There might be minor parts missing in these examples, since i've extracted them from my configuration but they should work as is.

with wrapped unix_chkpwd

{
  config,
  pkgs,
  lib,
  ...
}:
{
  nixpkgs.overlays = [
    (final: prev: {
      # build gdm with userdb-support
      gdm = prev.gdm.overrideAttrs (
        finalAttrs: prevAttrs: {
          postPatch = final.lib.strings.concatLines (
            final.lib.lists.dropEnd 5 (final.lib.strings.splitString "\n" prevAttrs.postPatch)
          );
        }
      );
    })
  ];

  # enable GDM / Gnome
  services.displayManager.gdm.enable = true;
  services.desktopManager.gnome.enable = true;

  # disable the hardcoded greeter users
  users.users.gdm-greeter.enable = false;
  users.users.gdm-greeter-1.enable = false;
  users.users.gdm-greeter-2.enable = false;
  users.users.gdm-greeter-3.enable = false;
  users.users.gdm-greeter-4.enable = false;

  services.userdbd.enable = true;

  # this is where the magic happens: pam_unix needs its helper binary unix_chkpwd to be aware of nss_systemd
  security.wrappers.unix_chkpwd.source =
    let
      unix_chkpwd = pkgs.stdenvNoCC.mkDerivation {
        name = "${config.security.pam.package.name}-unix_chkpwd-with-nssModules";
        dontUnpack = true;
        buildInputs = [
          pkgs.makeBinaryWrapper
          config.security.pam.package
        ];
        buildPhase = ''
          mkdir -p $out/bin
          makeWrapper ${config.security.pam.package}/bin/unix_chkpwd $out/bin/unix_chkpwd \
            --prefix LD_LIBRARY_PATH : ${config.system.nssModules.path}
        '';
      };
    in
    lib.mkForce "${unix_chkpwd}/bin/unix_chkpwd";
}

with a PAM module

(Using this patch pam_sduserdb-no-passwd-log.patch)

{
  config,
  pkgs,
  lib,
  ...
}:
let
  pam-sduserdb = pkgs.callPackage (
    {
      lib,
      stdenv,
      fetchFromGitHub,
      meson,
      ninja,
      pkg-config,
      pam,
      libvarlink,
      libxcrypt,
    }:
    stdenv.mkDerivation (finalAttrs: {
      pname = "pam_sduserdb";
      version = "0-unstable-2024-03-24";

      src = fetchFromGitHub {
        owner = "erincandescent";
        repo = "pam_sduserdb";
        rev = "babf7a88caac817ffbef7f7da3893fc96ea03a38";
        hash = "sha256-PU8VsYri6DiIniWaVCQj8ACBYHLnA10NeRN0N2SMCHc=";
      };

      __structuredAttrs = true;

      # not required for it to work, but if it's used without this in a pam auth context,
      # it will write the entered password to the system journal, which is a bit undesirable
      patches = [ ./pam_sduserdb-no-passwd-log.patch ];

      nativeBuildInputs = [
        meson
        ninja
        pkg-config
      ];

      buildInputs = [
        pam
        libvarlink
        libxcrypt
      ];

      postInstall = "install -D -m 444 -t $out/share/licenses/${finalAttrs.pname} $src/COPYING";

      meta = {
        license = lib.licenses.isc;
        homepage = "https://github.com/erincandescent/pam_sduserdb/";
        description = "PAM module backed by systemd's JSON user lookup API";
        platforms = lib.platforms.linux;
      };
    })
  ) { };
in
{
  nixpkgs.overlays = [
    (final: prev: {
      # build gdm with userdb-support
      gdm = prev.gdm.overrideAttrs (
        finalAttrs: prevAttrs: {
          postPatch = final.lib.strings.concatLines (
            final.lib.lists.dropEnd 5 (final.lib.strings.splitString "\n" prevAttrs.postPatch)
          );
        }
      );
    })
  ];
  
  # enable GDM / Gnome
  services.displayManager.gdm.enable = true;
  services.desktopManager.gnome.enable = true;


  # disable hardcoded greeter users
  users.users.gdm-greeter.enable = false;
  users.users.gdm-greeter-1.enable = false;
  users.users.gdm-greeter-2.enable = false;
  users.users.gdm-greeter-3.enable = false;
  users.users.gdm-greeter-4.enable = false;

  services.userdbd.enable = true;

  # minimal pam rules to make gdm work
  security.pam.services.gdm-launch-environment.rules.account.sduserdb = {
    control = "sufficient";
    enable = true;
    modulePath = "${pam-sduserdb}/lib/security/pam_sduserdb.so";
    order = config.security.pam.services.gdm-launch-environment.rules.account.unix.order - 1;
  };
  security.pam.services.systemd-user.rules.account.sduserdb = {
    control = "sufficient";
    enable = true;
    modulePath = "${pam-sduserdb}/lib/security/pam_sduserdb.so";
    order = config.security.pam.services.systemd-user.rules.account.unix.order - 1;
  };
}

on 25.11

In case of NixOS 25.11, where #420889 isn't available, it's necessary override security.pam.services.gdm-launch-environment.text directly with

auth     required       pam_succeed_if.so audit quiet_success user ingroup gdm
auth     optional       pam_permit.so

account  required       pam_succeed_if.so audit quiet_success user ingroup gdm
account  sufficient     ${pam-sduserdb}/lib/security/pam_sduserdb.so
account  sufficient     pam_unix.so

password required       pam_deny.so

session  required       pam_succeed_if.so audit quiet_success user ingroup gdm
session  required       pam_env.so conffile=/etc/pam/environment readenv=0
session  optional       ${config.systemd.package}/lib/security/pam_systemd.so
session  optional       pam_keyinit.so force revoke
session  optional       pam_permit.so

Regarding the patch

Strictly speaking pam_sduserdb-no-passwd-log.patch isn't required for GDM, but if someone was to use the unpatched PAM module in an auth rule instead of an account rule, it would log the entered password into the system journal.

[nekowinston]

Quick update for 26.05, summarizing a chat I had with @emilazy and @ElvishJerricco on Matrix:
I think we figured out a path forward to enable systemd-userdbd by default after 26.05. We'd have to address a couple of issues (e.g. nixbld users being classified as regular users rather than system users), and doing that in a rush could cause more problems (how would those changes interact with userborn/systemd-homed/etc); so we'll go ahead with the workaround in #517777 for 26.05.

I'm currently running staging-next+#517777 on my system and haven't encountered any issues from that, but I honestly also don't quite understand why it's needed. 🤔 Strange, but if it helps us ship gnome 50 in time, I guess it'll work.

---

Also thanks again to @nikamarisa for the super helpful comment above. For a bit of context of why I went with the PAM security wrapper in my PR:

nixpkgs/pkgs/README.md

Line 65 in 8eff708

* Applications in the Unix authentication stack such as PAM/D-Bus modules or SUID binaries should be considered carefully, and should have a maintained and responsible upstream.

I'm sure pam_sduserdb is fine, but the more conservative solution to me seemed to be to make unix_chkpwd work like it does on other distributions.

[nikamarisa]

I'm currently running staging-next+#517777 on my system and haven't encountered any issues from that, but I honestly also don't quite understand why it's needed. 🤔 Strange, but if it helps us ship gnome 50 in time, I guess it'll work.

That might be because when GDM creates greeter users on demand, it will create their home directory as /run/gdm/home/gdm-greeter{,-2,-3,-4,-5} and so on. It also create a gdm.conf in .config/environment.d/ in the users home.

So it might be worth a try to just change our greeter users home directories to be in the same place.

nixbld users being classified as regular users rather than system users

Since this is only an issue if systemd-userdb is used, one could omit the nixbld users from /etc/passwd and instead create drop-in files as describes in nss-systemd(8).
Such JSON user records can be explicitly marked as system users via their disposition field.

[nekowinston]

So it might be worth a try to just change our greeter users home directories to be in the same place.

wow that also works, but hadn't occurred to me. thanks. 😄

and what you said about migrating from /etc/passwd to nss-systemd is what we'll do long-term, as i understand it, it'd just be too rushed before the release.