systemd: Restore access to TTYs for reboot delay#21
Merged
pothos merged 1 commit intoflatcar-masterfrom May 10, 2023
Merged
Conversation
When sessions are active, locksmith write a message to the TTYs of the sessions and then delays the reboot for 5 minutes to give the user time to stop the reboot or finish the work. The commit for cgroup memory and CPU limits also brought in a change to disallow /dev/tty* access which broke the delay for console users except SSH sessions which are under /dev/pts/*. Allow device access to have a delay of 5 minutes when sessions are active. This includes the autologin session even if no interaction was done there recently. Still, the reboot delay doesn't hurt and since update-engine has a random delay for pulling updates, there is no big difference in the end.
pothos
added a commit
to flatcar/scripts
that referenced
this pull request
May 4, 2023
This pulls in flatcar/locksmith#21 to have working reboot warnings and delays for non-SSH sessions. This seems to have been broken for a longer time.
2 tasks
jepio
approved these changes
May 4, 2023
Member
jepio
left a comment
jepio
left a comment
There was a problem hiding this comment.
Could also be (gpt generated suggestion):
DevicePolicy=closed
DeviceAllow=/dev/tty*
DeviceAllow=/dev/pts/*
Member
Author
|
I thought about keeping the block devices unavailable but the commit introducing it wasn't really aimed at providing a security benefit and if we want to go this route we should also not leave the whole root partition writable. |
Member
Author
The suggestion doesn't work yet, |
dongsupark
approved these changes
May 5, 2023
pothos
added a commit
to flatcar/scripts
that referenced
this pull request
May 10, 2023
This pulls in flatcar/locksmith#21 to have working reboot warnings and delays for non-SSH sessions. This seems to have been broken for a longer time.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When sessions are active, locksmith write a message to the TTYs of the sessions and then delays the reboot for 5 minutes to give the user time to stop the reboot or finish the work.
The commit for cgroup memory and CPU limits also brought in a change to disallow /dev/tty* access which broke the delay for console users except SSH sessions which are under /dev/pts/*.
Allow device access to have a delay of 5 minutes when sessions are active. This includes the autologin session even if no interaction was done there recently. Still, the reboot delay doesn't hurt and since update-engine has a random delay for pulling updates, there is no big difference in the end.
How to use
Update ref in ebuild
Testing done
In the demo @tormath1 prepared, locksmith didn't wait. We looked at the possible issue and found this.
I just tried
echo A >> /dev/tty1withsudo systemd-run -S -P --property=PrivateDevices=true -Gand it failed while it works withPrivateDevices=false, so I think this will fix the issue. @tormath1 did a test withPrivateDevices=trueremoved and the delay worked.changelog/directory (user-facing change, bug fix, security fix, update)/bootand/usrsize, packages, list files for any missing binaries, kernel modules, config files, kernel modules, etc.