Currently all PAM modules are executed in the session runner as root. This has some nontrivial consequences:
- pam_setcred() runs as root, as a consequence the session keyring is owned by root, and applications cannot add new keys.
- The runner's proc/self/loginuid is changed to the user's UID, so cleanup actions are attributed to the user instead of the daemon.
- The runner's PID is used as the session leader, instead of the compositor PID.
Each of those needs to be thought through carefully. The root-owned session keyring probably has the highest user-visible impact - a possible fix is to call pam_setcred() after the fork and privilege drop.
Currently all PAM modules are executed in the session runner as root. This has some nontrivial consequences:
Each of those needs to be thought through carefully. The root-owned session keyring probably has the highest user-visible impact - a possible fix is to call pam_setcred() after the fork and privilege drop.