Gaming Linux® From Scratch (System V Edition) - Version #22b3a

Chapter 5. Security

elogind-257.14

Introduction to elogind

The elogind package is an extracted "logind" from Systemd, including the daemon and some other Systemd projects like UserDB. It integrates with Linux-PAM-1.7.2 to track all the users logged in to a system, and whether they are logged in graphically, on the console, or remotely. It exposes this information via the standard org.freedesktop.login1 D-Bus interface, and also through the file system using Systemd's standard /run/systemd layout.

Important

For the lib32 installation instructions, they require new Meson cross files from MLFS, as --libdir=/usr/lib32 has been moved to the cross files and no longer appear in the instructions. Install the new cross files so that 32-bit libraries don't get installed in /usr/lib.

elogind Dependencies

Recommended
D-Bus-1.16.2 - Pass 1 (runtime), Linux-PAM-1.7.2, and Polkit-127 (runtime)

Kernel Configuration

Enable the following options in the kernel configuration and recompile the kernel if necessary: 

File systems --->
  [*] Inotify support for userspace                               [INOTIFY_USER]
  Pseudo filesystems --->
    [*] Tmpfs virtual memory file system support (former shm fs)         [TMPFS]
    [*]   Tmpfs POSIX Access Control Lists                     [TMPFS_POSIX_ACL]

Installation of elogind

Install elogind by running the following commands: 

mkdir build &&
cd    build &&

meson setup --prefix=/usr                          \
            --buildtype=release                    \
            -D docdir=/usr/share/doc/elogind-257.14 \
            -D cgroup-controller=elogind           \
            -D dev-kvm-mode=0660                   \
            -D dbuspolicydir=/etc/dbus-1/system.d  \
            .. &&
ninja

Now, as the root user: 

ninja install                                           &&
ln -sfv  libelogind.pc /usr/lib/pkgconfig/libsystemd.pc &&
ln -sfvn elogind /usr/include/systemd

lib32 Installation of elogind

Install lib32-elogind by running the following commands: 

rm -rf * &&
meson setup --prefix=/usr                         \
            --buildtype=release                   \
            --cross-file=lib32                    \
            -D cgroup-controller=elogind          \
            -D dev-kvm-mode=0660                  \
            -D dbuspolicydir=/etc/dbus-1/system.d \
            .. &&
ninja

Now, as the root user: 

DESTDIR=$PWD/DESTDIR ninja install                       &&
cp -vR DESTDIR/usr/lib32/* /usr/lib32                    &&
rm -rf DESTDIR                                           &&
ln -sfv libelogind.pc /usr/lib32/pkgconfig/libsystemd.pc &&
ldconfig

Command Explanations

Note

Inspect meson_options.txt or meson.options for a full list of options.

-D docdir=/usr/share/doc/elogind-257.14: This is needed to install documentation in a versioned directory.

-D cgroup-controller=elogind: This switch is necessary to build this package when the kernel is not built with CONFIG_CGROUPS enabled. Note that elogind strictly needs a kernel with CONFIG_CGROUPS enabled at runtime, but this switch will allow building the package first.

-D dbuspolicydir=/etc/dbus-1/system.d: This switch sets the location of the D-Bus policy directory.

-D dev-kvm-mode=0660: The LFS udev rule sets the mode of /dev/kvm to 0660. This option ensures the elogind udev rules consistent with the LFS configuration.

-D default-kill-user-processes=false: Determines whether the processes of a user should be killed when the user logs out. The default is true, but this defeats the traditional use of screen or tmux. This can also be changed in the configuration file (see below).

ln -s ...: These commands install symlinks so that software packages can find the systemd-compatible library and headers.

Configuring elogind

Config File

/etc/elogind/logind.conf

Configuration Information

The installed file /etc/elogind/logind.conf contains all the possible options with their defaults, commented out. You may wish to disable automatically killing user processes when the user logs out. You can do so as the root user: 

sed -e '/\[Login\]/a KillUserProcesses=no' \
    -i /etc/elogind/logind.conf

Each user will need to register a user session using Linux-PAM at login. The /etc/pam.d/system-session file needs to be modified and a new file must be created in order for elogind to work correctly. Run the following commands as the root user: 

cat >> /etc/pam.d/system-session << "EOF" &&
# Begin elogind addition

session  required    pam_loginuid.so
session  optional    pam_elogind.so

# End elogind addition
EOF
cat > /etc/pam.d/elogind-user << "EOF"
# Begin /etc/pam.d/elogind-user

account  required    pam_access.so
account  include     system-account

session  required    pam_env.so
session  required    pam_limits.so
session  required    pam_unix.so
session  required    pam_loginuid.so
session  optional    pam_keyinit.so force revoke
session  optional    pam_elogind.so

auth     required    pam_deny.so
password required    pam_deny.so

# End /etc/pam.d/elogind-user
EOF

This package provides a Name Service Switch (NSS) module. Previously, a Systemd-less system didn't have a dedicated NSS module used for better name resolution, while Systemd systems have one that is tightly ingrained with that software suite. Now, such a module is provided. In order to use it, the /etc/nsswitch.conf file that was installed in LFS must be altered. Overwrite the file as the root user: 

cat > /etc/nsswitch.conf << "EOF" &&
# Begin /etc/nsswitch.conf

passwd: files elogind
group: files elogind
shadow: files elogind

hosts: files dns
networks: files

protocols: files
services: files
ethers: files
rpc: files

# End /etc/nsswitch.conf
EOF

Note

The myhostname, mymachines, and resolve NSS modules are still not provided (they come from Systemd). The installed file cannot use them yet.

Note

Now continue on until you reach D-Bus-1.16.2, install it, and follow the configuration instructions on that page to see if elogind is working properly.

Contents

Installed Programs: busctl, elogind-inhibit, loginctl, userdbctl, and varlinkctl
Installed Library: libelogind and libnss_elogind
Installed Directories: /usr/lib/elogind, /etc/elogind, /usr/include/elogind, and /usr/share/doc/elogind-257.14

Short Descriptions

busctl

is used to introspect and monitor the D-Bus bus

elogind-inhibit

is used to execute a program with a shutdown, sleep or idle inhibitor lock taken

loginctl

is used to introspect and control the state of the elogind Login Manager

userdbctl

is used to inspect users, groups, and group memberships

varlinkctl

is used to interact with and invoke Varlink services

libelogind

is the main elogind utility library

libnss_elogind

is the Name Service Switch (NSS) module for elogind