avoid race between systemd-logind and systemd-udevd in setting ACLs by yuwata · Pull Request #36444 · systemd/systemd

yuwata · 2025-02-19T17:16:34Z

Follow-up for #36408.
Hopefully fixes #24026, #28512, and/or #23547.

yuwata · 2025-02-19T17:18:32Z

Follow-up for #36408.
Not sure, but may fix #24026, #28512, and/or #23547.

src/login/logind-seat.c

wxphaha · 2025-02-20T05:31:34Z

If access to the stat file is locked, is it possible that udev reads the old state file first, but then sets the acl after logind?

poettering · 2025-02-20T16:27:39Z

hmm, i wonder if it wouldn't be nicer to just drop the acl mgmt from logind and only do it in udev, and simple trigger the devices again when the session changes? seems much nicer to me as there would be a single owner for ACLs adjustments, not two which fight.

yuwata · 2025-02-25T17:33:51Z

hmm, i wonder if it wouldn't be nicer to just drop the acl mgmt from logind and only do it in udev, and simple trigger the devices again when the session changes? seems much nicer to me as there would be a single owner for ACLs adjustments, not two which fight.

Hmmmm, that potentially causes infinite loop...

logind triggers uevent in seat_set_active(),
udev processes the uevent, and broadcasts the result,
logind receives the result, manager_dispatch_device_udev() -> manager_process_seat_device() -> seat_start() -> seat_read_active_vt() -> seat_active_vt_changed() -> seat_set_active() OUCH!

yuwata · 2025-02-25T18:44:45Z

Maybe, the potential loop can be avoided by using SYNTH_UUID= property in uevent. I will try later.

yuwata · 2025-02-28T12:21:34Z

@poettering Updated. PTAL.

This also makes device_in_subsystem() and device_is_devtype() return negative error on critical error

…vent When udevd broadcasts an event for e.g. a graphics device with master-of-seat tag, then previously manager_process_seat_device() was called twice for the event. With this commit, the function is called only once even for an event for such device.

…tting ACLs Previously, both udevd and logind modifies ACLs of a device node. Hence, there exists a race something like the following: 1. udevd reads an old state file, 2. logind updates the state file, and apply new ACLs, 3. udevd applies ACLs based on the old state file. This makes logind not update ACLs but trigger uevents for relevant devices to make ACLs updated by udevd.

As it is now only used by udev-builtin-uaccess.c. This also makes devnode_acl() use fd rather than path to device node.

yuwata · 2025-05-13T18:41:55Z

@poettering Thank you for the review. All requests are addressed. PTAL.

bluca · 2025-05-23T01:56:59Z

Commit 'login,udev: avoid race between systemd-logind and systemd-udevd in setting ACLs' introduced a regression, and permission checks for users owning a session no longer works. Eg: in GNOME, when already logged in clicking on suspend/reboot/poweroff in the menu asks the user for authentication, while it didn't before

Follow-up for c960ca2 (systemd#36444). Prompted by https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1112660.

Follow-up for c960ca2 (#36444). Prompted by https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1112660.

Fixes regression caused by #36444. Fixes #39043.

This PR systemd/systemd#36444 caused this bug systemd/systemd#39043, which is fixed in this PR systemd/systemd#39071. In short, `uaccess` doesn't work with `OPTIONS+="static_node=..."` udev rules, and `/dev/snd/timer` is a static node. 258.1 needs to wait for the next staging cycle, so for now let's just use a non-static node.

bendlas · 2025-11-24T19:15:43Z

I've recently gotten a regression on one of my machines, which I've bisected to c960ca2

Run startx on a tty
Switch to a different tty
Switch back
- REGRESSION screen stays blank
When trying to to switch to another tty again, chvt blocks until the startx process is killed

This only happens on one of my machines (AMD EPYC 7642, Supermicro H12SSL-i, Radeon RX 6700XT), not on any of my other AMD machines; on various 6.17 kernels.

I'd be happy to help with tracing this, if somebody tells me what to look at. For now, I'll keep using v257

github-actions bot added udev login please-review PR is ready for (re-)review by a maintainer labels Feb 19, 2025

yuwata mentioned this pull request Feb 19, 2025

logind: save seat before applying acl #36408

Merged

yuwata added this to the v258 milestone Feb 19, 2025

yuwata force-pushed the login-udev-lock-seat branch from e70fded to b66f6d2 Compare February 19, 2025 17:22

YHNdnzj reviewed Feb 19, 2025

View reviewed changes

src/login/logind-seat.c Outdated Show resolved Hide resolved

yuwata added ci-fails/needs-rework 🔥 Please rework this, the CI noticed an issue with the PR and removed please-review PR is ready for (re-)review by a maintainer labels Feb 19, 2025

yuwata force-pushed the login-udev-lock-seat branch from b66f6d2 to bcfa6da Compare February 27, 2025 03:36

github-actions bot added build-system util-lib sd-device meson please-review PR is ready for (re-)review by a maintainer and removed ci-fails/needs-rework 🔥 Please rework this, the CI noticed an issue with the PR labels Feb 27, 2025

yuwata marked this pull request as draft February 27, 2025 03:45

yuwata removed the please-review PR is ready for (re-)review by a maintainer label Feb 27, 2025

yuwata force-pushed the login-udev-lock-seat branch 2 times, most recently from 61af723 to df9d025 Compare February 27, 2025 04:23

github-actions bot added the tests label Feb 27, 2025

yuwata marked this pull request as ready for review February 27, 2025 09:59

github-actions bot added the please-review PR is ready for (re-)review by a maintainer label Feb 27, 2025

yuwata force-pushed the login-udev-lock-seat branch from df9d025 to 06b2e0d Compare March 4, 2025 10:31

yuwata force-pushed the login-udev-lock-seat branch from 13285c2 to 2303cb9 Compare May 13, 2025 16:16

yuwata added 9 commits May 14, 2025 02:06

backlight: use device_get_sysattr_unsigned() at one more place

25151ca

backlight: replace recursion with for loop

b7d60b2

device-util: introduce several more helper functions

ab1bd9d

This also makes device_in_subsystem() and device_is_devtype() return negative error on critical error

device-util: introduce device_get_seat() helper function

2012d6d

login: use FOREACH_STRING() at one more place

3400abf

udev: move devnoce_acl() to udev-builtin-uaccess.c

1abb592

As it is now only used by udev-builtin-uaccess.c. This also makes devnode_acl() use fd rather than path to device node.

acl-util: make acl_find_uid() static

003c6fa

yuwata force-pushed the login-udev-lock-seat branch from 2303cb9 to 003c6fa Compare May 13, 2025 17:06

poettering added good-to-merge/waiting-for-ci 👍 PR is good to merge, but CI hasn't passed at time of review. Please merge if you see CI has passed and removed please-review PR is ready for (re-)review by a maintainer labels May 14, 2025

poettering merged commit 798d140 into systemd:main May 14, 2025
36 of 43 checks passed

github-actions bot removed the good-to-merge/waiting-for-ci 👍 PR is good to merge, but CI hasn't passed at time of review. Please merge if you see CI has passed label May 14, 2025

yuwata deleted the login-udev-lock-seat branch May 14, 2025 16:11

bluca mentioned this pull request May 23, 2025

logind: permission tracking regression (suspend/poweroff/reboot from GUI) #37579

Closed

yuwata added merged-but-needs-fixing and removed merged-but-needs-fixing labels Jun 9, 2025

yuwata mentioned this pull request Sep 1, 2025

NEWS: mention ACLs by "uaccess" is always set by udevd #38779

Merged

yuwata mentioned this pull request Sep 22, 2025

udev,login: update ACL on static device nodes #39071

Merged

poettering added a commit that referenced this pull request Sep 23, 2025

udev,login: update ACL on static device nodes (#39071)

daf99b0

Fixes regression caused by #36444. Fixes #39043.

ElvishJerricco mentioned this pull request Oct 19, 2025

nixos/test/login: Fix uaccess test. NixOS/nixpkgs#453603

Merged

13 tasks

aafeijoo-suse mentioned this pull request Jan 5, 2026

logind/udev: desktop environment asking for authentication to mount /dev/sr0 after switching VTs #40223

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

avoid race between systemd-logind and systemd-udevd in setting ACLs#36444

avoid race between systemd-logind and systemd-udevd in setting ACLs#36444
poettering merged 9 commits intosystemd:mainfrom
yuwata:login-udev-lock-seat

yuwata commented Feb 19, 2025 •

edited

Loading

Uh oh!

yuwata commented Feb 19, 2025

Uh oh!

Uh oh!

wxphaha commented Feb 20, 2025

Uh oh!

poettering commented Feb 20, 2025

Uh oh!

yuwata commented Feb 25, 2025

Uh oh!

yuwata commented Feb 25, 2025

Uh oh!

yuwata commented Feb 28, 2025

Uh oh!

yuwata commented May 13, 2025

Uh oh!

Uh oh!

bluca commented May 23, 2025

Uh oh!

bendlas commented Nov 24, 2025

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

7 participants

Uh oh!

Conversation

yuwata commented Feb 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yuwata commented Feb 19, 2025

Uh oh!

Uh oh!

wxphaha commented Feb 20, 2025

Uh oh!

poettering commented Feb 20, 2025

Uh oh!

yuwata commented Feb 25, 2025

Uh oh!

yuwata commented Feb 25, 2025

Uh oh!

yuwata commented Feb 28, 2025

Uh oh!

yuwata commented May 13, 2025

Uh oh!

Uh oh!

bluca commented May 23, 2025

Uh oh!

bendlas commented Nov 24, 2025

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

7 participants

yuwata commented Feb 19, 2025 •

edited

Loading