From bc99092@sac.sfbay.sun.com Tue Aug 11 14:20:28 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7BLKRr8025083 for ; Tue, 11 Aug 2009 14:20:27 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n7BLKME6021934; Tue, 11 Aug 2009 22:20:26 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO800701DY10100@nwk-avmta-1.sfbay.Sun.COM>; Tue, 11 Aug 2009 14:20:25 -0700 (PDT) Received: from dm-sfbay-01.sfbay.sun.com ([129.145.155.118]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO800B0QDY0C7E0@nwk-avmta-1.sfbay.Sun.COM>; Tue, 11 Aug 2009 14:20:24 -0700 (PDT) Received: from sac.sfbay.sun.com (sac.SFBay.Sun.COM [129.146.226.132]) by dm-sfbay-01.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n7BLKO7c037525; Tue, 11 Aug 2009 14:20:24 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7BLKNTS025078; Tue, 11 Aug 2009 14:20:23 -0700 (PDT) Received: (from bc99092@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id n7BLKNwO025074; Tue, 11 Aug 2009 14:20:23 -0700 (PDT) Date: Tue, 11 Aug 2009 14:20:23 -0700 (PDT) From: Brian Cameron Subject: ConsoleKit [LSARC/2009/432 OnePager] To: LSARC-ext@sun.com Cc: desktop-discuss@opensolaris.org Message-id: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 28358 Template Version: @(#)sac_nextcase 1.68 02/23/09 SMI This information is Copyright 2009 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: ConsoleKit 1.2. Name of Document Author/Supplier: Author: Brian Cameron 1.3 Date of This Document: 11 August, 2009 4. Technical Description 1. Introduction 1.1. Project/Component Working Name: ConsoleKit 1.2. Name of Document Author/Supplier: Brian Cameron 1.3. Date of This Document: 08/11/2009 1.4. Name of Major Document Customer(s)/Consumer(s): 1.4.1. The PAC or CPT you expect to review your project: Solaris PAC 1.4.2. The ARC(s) you expect to review your project: LSARC 1.4.3. The Director/VP who is "Sponsoring" this project: Robert O'Dea 1.4.4. The name of your business unit: Software - OPG 1.5. Email Aliases: 1.5.1. Responsible Manager: leo.binchy@sun.com 1.5.2. Responsible Engineer: brian.cameron@sun.com 1.5.3 Marketing Manager: dan.robert@sun.com 1.5.4. Interest List: desktop-discuss@opensolaris.org 2. Project Summary 2.1. Project Description: ConsoleKit is a FreeDesktop framework for defining and tracking users, login sessions and seats. ConsoleKit has two main purposes: - To maintain a database of information about each running session which the display manager (GDM) uses. The old GDM keeps track of this information internally, but new versions of GDM (2.21 and later) use ConsoleKit. - To support switching sessions and session migration when using mechanisms such as VT. Note that Sun Ray uses its own separate session migration techniques. While there may be some value in Sun Ray making use of ConsoleKit in the future to avoid replicating functionality, there are no immediate plans for Sun Ray to use ConsoleKit directly for this. Today, Solaris does not support graphical VT sessions. However, the virtual console team is currently targeting build 124 to add this feature. Refer to PSARC 2006/591 Virtual Console. VT support is not needed to use ConsoleKit, but will support it as soon as it is available. 4. Technical Description: 4.1. Details: ConsoleKit maintains a database of which users are logged into the system. ConsoleKit groups sessions by seats which represent a set of hardware (usually a keyboard and mouse). Other process communicate with ConsoleKit via D-Bus. One session leader process is responsible for asking ConsoleKit to open a new session. In the typical case, the session leader would be a ConsoleKit enabled display manager, such as GDM. This leader makes a connection to the D-Bus system bus and asks ConsoleKit to open a session when needed. If the operation succeeds, ConsoleKit will return a cookie to the session leader. The session leader should store this variable in the environment as XDG_SESSION_COOKIE so that it may be shared with its child processes. The environment variable contains the UUID used to tie processes to a session. Note that the XDG_SESSION_COOKIE variable is only meaningful to help manage session switching and migration, which currently only works with graphical VT sessions running on the console. Although ConsoleKit will assign the variable for all sessions, it is ignored if the session does not support migration via ConsoleKit. Note Sun Ray uses its own mechanisms for user switching, and is not affected by ConsoleKit. At this point the session will be registered with ConsoleKit and a particular set of information about the session will be stored along with it. The Session will remain open until the Session Leader disconnects from the D-Bus system bus. The session will be removed from its seat, and deregistered. Various other programs need to know information about running user sessions, such as the Fast User Switch Applet and other mechanisms for switching the console to use a different VT display. Such programs make use of ConsoleKit interfaces to determine if user switching is supported and to manage the switching of different sessions on the same seat. On some Linux systems, the pam_ck_connector is used to ensure that non-graphical logins (e.g. telnet, ssh, etc.) are registered with ConsoleKit. Thus ConsoleKit can be used as a utmp/wtmp replacement since it stores a superset of the information as in the utmp/wtmp database. However, this is not an appropriate use of PAM and there are no plans to support this feature on Solaris since there is no immediate need to replace utmp/wtmp at this point in time. Instead, GDM will make use of ConsoleKit to manage its displays. ConsoleKit source code contains the programs /usr/sbin/ck-log-system-start, /usr/sbin/ck-log-system-restart, and /usr/sbin/ck-log-system-stop. These are intended to be helper tools to log system start, restart, and stop events. These are intended to make ConsoleKit more like utmp/wtmp which also logs these events. Since there are no plans to support ConsoleKit as a utmp/wtmp replacement, these programs are not included with the Solaris ConsoleKit packages. The ConsoleKit database is stored in /var/run/ConsoleKit/database. It stores information about active Seats, Sessions, and the current SessionLeader. The following is an example of what this file contains. Comments (lines beginning with "#" are comments added to explain the purpose of each line: 4.1.1 Detail About ConsoleKit Database # Seat configuration section. [Seat /org/freedesktop/ConsoleKit/Seat1] # Kind value=0 indicates a static seat, value=1 indicates a dynamic # seat. kind=0 # Sessions running on the display. sessions=/org/freedesktop/ConsoleKit/SessionSeat1Local # Devices associated with the display. Currently not used. devices= # Active session on the display. active_session=/org/freedesktop/ConsoleKit/SessionSeat1Local # Session configuration section. [Session /org/freedesktop/ConsoleKit/SessionSeat1Local] # UID of user running the session. uid=50 # Seat associated with the session seat=/org/freedesktop/ConsoleKit/Seat1 # Session cookie value. Note XDG_SESSION_COOKIE environment variable. cookie=4008fb789ce5f1a7f346407e4a669cfe-1249973209.172145-1566549659 # Session type. type=LoginWindow # Device associated with session (if any). display_device=/dev/console # Device associated with Xserver running session (if any). x11_display_device=/dev/console # Display value associated with session (if any). x11_display=:0 # Remote hostname if a remote connection, e.g. XDMCP. remote_host_name= # Boolean. Set to "true" if the active session, "false otherwise" is_active=false # Boolean. Set to "true" if a local session, "false" if remote. is_local=true # Timestamp of when the session started. creation_time=2009-08-11T06:46:42.941134Z # Session leader configuration section. [SessionLeader /org/freedesktop/ConsoleKit/SessionSeat1Local] # Session associated with the leader. session=/org/freedesktop/ConsoleKit/SessionSeat1Local # UID and PID of session leader process uid=0 pid=24768 # Session leader cookie value. cookie=4008fb789ce5f1a7f346407e4a669cfe-1249973209.172145-1566549659 # Session leader service name service_name=:1.203 4.1.2 Detail About ConsoleKit Program And Library Interfaces + /usr/sbin/console-kit-daemon [--debug] [--no-daemon] [--timed-exit] The main consoleKit daemon. Supports --debug, --no-daemon, and --timed-exit arguments for debugging purposes. + /usr/bin/ck-history [--frequent] [--last] [--last-compat] [--log] [--seat=SEAT] [--session-type=TYPE] [--user=USER] A program that shows historical information about which users have logged in most recently (--last) or most frequently (--frequent). A 'last' compatible listing of last logged in users can be specified with the --last-compat argument. The entire log can be viewed with the --log argument. Users can specify to show entries for a specific seat, session type, or user via the --seat, --session-type, and --user arguments. This is used in GDM when showing the face browser. When GDM is configured to use the face browser, users who have logged in most frequently are displayed first. + /usr/bin/ck-launch-session COMMAND A program used for starting a command in its own ConsoleKit session. This would be useful if a user wanted to start their own session via a startx script and have it registered with ConsoleKit, for example. + /usr/bin/ck-list-sessions [--format=VAR1,VAR2...] Program that displays information from the ConsoleKit database about active sessions on the system. It returns information about each ConsoleKit session. Users can specify what properties to show via --format arguments. Example 1: output for a login single session without --format follows: SessionSeat1Local: unix-user = '50' realname = 'GDM Reserved UID' seat = 'Seat1' session-type = 'LoginWindow' display-type = 'Local' open = 'TRUE' active = 'TRUE' x11-display = ':0' x11-display-device = '/dev/console' display-device = '/dev/console' remote-host-name = '' is-local = 'TRUE' on-since = '2009-08-11T06:46:42.941134Z' login-session-id = '' idle-since-hint = '' Example 2: output for a login single session with argument "--format=session-id,unix-user,display-type" SessionSeat1Local 50 Local + /usr/bin/ck-seat-tool [--add --session-type=SESSION_TYPE --display-type=DISPLAY_TYPE [--seat-id=SEAT_ID] [variables...] | --delete --session-id=SESSION_ID] This program tells ConsoleKit to add or delete a session on a given parameters. This interface will be used by Sun Ray for starting and stopping sessions on Sun Ray devices, but could also be used for dynamically managing other kinds of displays. To use ck-seat-tool, it must be run as the same user which is running the main ConsoleKit daemon, which is normally root. Otherwise the request is ignored. Currently this program is added by a Solaris-specific patch to support the gdmdynamic program, needed for backwards compatibility. The Sun GNOME team is working with the external community to upstream this feature. + /usr/lib/ck-collect-session-info --uid UID --pid PID This program is passed the UID and PID of a process, and it returns the following information from the ConsoleKit database about that process. This is useful for determining which Xserver is associated with a given process. Example output for a process running in a session: unix-user = 100 x11-display = :0.0 x11-display-device = /dev/console display-device = /dev/pts/1 is-local = true This program is a private interface used by the console-kit-daemon when opening a session. + /usr/lib/ck-get-x11-display-device [--display=DISPLAY] Returns the display device associated with an Xserver. GDM uses this program to determine the TTY value associated with an Xserver process, and this value is passed into PAM_TTY, logindevperm, and the audit interfaces. If no --display argument is provided, the current $DISPLAY environment value is used. + /usr/lib/ck-get-x11-server-pid Returns the PID of the Xserver process running on the current $DISPLAY environment variable. + /usr/lib/libck-connector.so Library used by GDM and other programs which access ConsoleKit interfaces. 4.1.3 TTY Settings And Use Of proc Interfaces ConsoleKit keeps track of the device associated with the Xserver. The display manager, such as GDM, will use this value when calling logindevperm, when setting PAM_TTY, and when interacting with Sun audit interfaces. This device is called the x11-display-device by ConsoleKit. When using graphical VT displays, the x11-display-device device is named "/dev/vt/#" where "#" is the number of the VT display. On Solaris, "attached" non-console displays use the value "/dev/dtlocal" and remote displays use the value "/dev/dtremote". The "/dev/dtlocal" and "/dev/dtremote" are considered pseudo-devices and are symlinks to /dev/null. It is necessary to set up the symlinks before they are used by the display manager. When VT support is not enabled or available, then the value "/dev/console" is used for the main console display. ConsoleKit is responsible for making sure that the value is set properly in all these situations. Note that the ConsoleKit ck-collect-session-info program is used privately by ConsoleKit to access information about a running session including the x11-display-device. It makes use of the ck-get-x11-server-pid program to access the x11-display-device value. GDM uses the ck-get-x11-display-device application to get the x11-display-device value. When a display is running via graphical VT, ConsoleKit uses the following mechanism to get the TTY value. This mechanism works on other operating systems, such as Linux, and also works on Solaris when VT is being used. When VT is used, these programs make use of proc interfaces to collect some of this information, as follows: The ConsoleKit ck-get-x11-display-device, ck-get-x11-server-pid, and ck-collect-session-info programs call XOpenDisplay on a given $DISPLAY, and then calls ConnectionNumber to get the socket associated with that display. getpeerucred is used to get the UID and PID of the process. The ck-get-x11-display-device and ck-collect-session-info programs then open /proc//psinfo on the Xserver process in order to access environment values associated with that process. The tty_text value from the psinfo structure is then used to determine the TTY device associated with the Xserver. These interfaces are highlighted because this is a somewhat roundabout way to get the TTY value associated with a given display. That said, this mechanism works well when VT is enabled in the Xserver. Note that the intent of ConsoleKit is that the daemon should be able to determine this information without needing to be informed by the display manager. Obviously, when VT is not used, the above mechanism does not work, so ConsoleKit will heuristically set the value in the non-VT case depending on whether the display is the console display, a local non-console display, or a remote display. 4.1.4 Script Directories ConsoleKit provides two directories which may contain scripts that get run when a ConsoleKit session starts. By default these directories are empty on Solaris. - /usr/lib/ConsoleKit/run-session.d - For scripts shipped by the distro. - /etc/ConsoleKit/run-session.d - For scripts installed by the system administrator. 4.1.5 Environment Variables ConsoleKit makes use of the following environment variables: XDG_SESSION_COOKIE - Environment variable that ConsoleKit provides to the session leader. The session leader is expected to ensure this is set for the session process started. It contains a UUID used to tie the processes to the session. This is used to support user switching on displays that support it (currently only graphical VT displays on the console). The following environment variables are set when running scripts in the script directories described in section 4.1.4. This way the scripts can support conditional logic based on the settings of the session. CK_SESSION_SEAT_ID - Seat ID associated with the session. CK_SESSION_USER_UID - UID associated with the session. CK_SESSION_DISPLAY_DEVICE - The device associated with the CK_SESSION_X11_DISPLAY_DEVICE - The device associated with the Xserver. CK_SESSION_X11_DISPLAY - Display value, such as ":0" CK_SESSION_REMOTE_HOST_NAME - Set to the remote host name if the session is not local (e.g. XDMCP). CK_SESSION_IS_ACTIVE - Set to "true" or "false". Is "true" if the session is active. For example, VT displays not running on the display would be "false" CK_SESSION_IS_LOCAL - Set to "true" or "false". Is "true" if the session is local. Is "false" if the session is remote (e.g. XDMCP). CK_SESSION_IS_DYNAMIC - Set to "true" or "false". Is "true" if the session was started via ck-dynamic, "false" otherwise. 4.1.6 Stop/Restart Scripts ConsoleKit manages stopping and restarting the system. On Solaris, when the display manager informs ConsoleKit that such an action is requested, the chkauthattr function is called to see if the calling user has RBAC permissions for the "solaris.system.shutdown" key. If yes, then the /usr/lib/ConsoleKit/scripts/ck-system-restart script is run if a restart action was requested. If a shutdown action was requested, then the /usr/lib/ConsoleKit/scripts/ck-system-stop script is run. On Solaris, the ck-system-stop script runs "/sbin/init 5" and the ck-system-restart script runs "/sbin/init 6". 4.1.7. D-Bus Interfaces The ConsoleKit D-Bus interfaces are documented here: http://people.freedesktop.org/~mccann/doc/ConsoleKit/ConsoleKit.html A copy of the above interface documentation is included with the case materials. 4.1.8 Usage of /var/run The /var/run interfaces are not installed with the ConsoleKit packages. They are created at runtime when the /usr/sbin/console-kit-daemon starts. 4.1.9 SMF integration ConsoleKit includes SMF integration files to start and stop the /usr/sbin/console-kit-daemon program as a service. 4.2. Interfaces: Exported Interfaces Stability Comments --------------------------------------- ----------- ------------- SUNWconsolekit Uncommitted Package name. SUNWconsolekit-devel Uncommitted Package name. SUNWconsolekit-root Uncommitted Package name. /usr/lib/pkgconfig/ck-connector.pc Uncommitted pkg-config file. /var/svc/manifest/system/consolekit.xml Uncommitted SMF integration file. /usr/bin/ck-history Volatile See 4.1.2. /usr/bin/ck-launch-session Volatile See 4.1.2. /usr/bin/ck-list-sessions Volatile See 4.1.2. /usr/sbin/ck-seat-tool Volatile See 4.1.2. /usr/sbin/console-kit-daemon Volatile See 4.1.2. /usr/lib/ck-collect-session-info Private See 4.1.2. /usr/lib/ck-get-x11-display-device Volatile See 4.1.2. /usr/lib/ck-get-x11-server-pid Private See 4.1.2. /usr/lib/ConsoleKit/scripts/ck-system-restart Private See 4.1.6. /usr/lib/ConsoleKit/scripts/ck-system-stop Private See 4.1.6. /usr/lib/libck-connector.so Volatile ConsoleKit library. /usr/include/ConsoleKit Volatile Header files. /usr/lib/ConsoleKit/run-session.d Volatile See 4.1.4. /etc/ConsoleKit/run-session.d Volatile See 4.1.4. /etc/ConsoleKit/seats.d/ Volatile Directory for Seat configuration files /etc/ConsoleKit/seats.d/00-primary.seat Volatile Configuration for default seat, DISPLAY ":0". /etc/ConsoleKit/displays.d/ Volatile Directory for display template configuration files /etc/ConsoleKit/displays.d/Local.display Volatile Configuration for local display X11 command /etc/ConsoleKit/sessions.d/ Volatile Directory for session variables configuration files /etc/ConsoleKit/sessions.d/Local.session Volatile Configuration for local display X11 variables /etc/dbus-1/system.d/ConsoleKit.conf Volatile D-Bus Integration. [1] /var/log/ConsoleKit/history Volatile History database. /var/run/ConsoleKit/database Volatile Session database. See 4.1.8. /var/run/ConsoleKit/pid Volatile ConsoleKit daemon PID. See 4.1.8. /usr/share/dbus-1/interfaces/*ConsoleKit* Volatile D-Bus integration. /usr/share/dbus-1/system-services/*ConsoleKit* Volatile D-Bus integration. XDG_SESSION_COOKIE Volatile See 4.1.5. CK_SESSION_SEAT_ID Volatile See 4.1.5. CK_SESSION_USER_UID Volatile See 4.1.5. CK_SESSION_DISPLAY_DEVICE Volatile See 4.1.5. CK_SESSION_X11_DISPLAY_DEVICE Volatile See 4.1.5. CK_SESSION_X11_DISPLAY Volatile See 4.1.5. CK_SESSION_REMOTE_HOST_NAME Volatile See 4.1.5. CK_SESSION_IS_ACTIVE Volatile See 4.1.5. CK_SESSION_IS_LOCAL Volatile See 4.1.5. CK_SESSION_IS_DYNAMIC Volatile See 4.1.5. Imported Interfaces Stability Comments ----------------------- --------------- ----------------------- GObject & GThread (GLib) Committed LSARC 2006/202 D-Bus & dbus-glib Volatile LSARC 2006/368 /proc & /proc/pid Public PSARC 1992/073 chkauthattr Stable PSARC 1997/332 X11 Standard PSARC 1998/299 Virtual Console Committed PSARC 2006/591 /sbin/init ? 4.3. Doc Impact: Man page is needed. 4.4. Packaging & Delivery: SUNWconsolekit, SUNWconsolekit-root, SUNWconsolekit-devel - packages for ConsoleKit. 4.5. Dependencies: For VT features to work, the following case will need to integrate: PSARC 2006/591 Virtual Console 4.6. L10N Impact: The Desktop team and the G11N team are working together to evaluate and provide I18N/L10N support. 4.7. Security Impact: ConsoleKit makes use of RBAC so that the Shutdown and Reboot options are only available if the requesting user has solaris.system.shutdown authority. The /var/run/ConsoleKit/database file contains all information about each user's session. This is owned by root:root with 600 permissions to prevent snooping or tampering. 5. Reference Documents: [1] The ./ConsoleKit.conf file is also included with the case materials for reference. The ConsoleKit documentation from the ConsoleKit website is also included with the case materials as the file ./ConsoleKit.html ConsoleKit Website: http://www.freedesktop.org/wiki/Software/ConsoleKit ConsoleKit Documentation: http://people.freedesktop.org/~mccann/doc/ConsoleKit/ConsoleKit.html 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: Desktop 6.5. ARC review type: OnePager 6.6. ARC Exposure: open From Alan.Coopersmith@Sun.COM Tue Aug 11 14:57:19 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7BLvIrW026905 for ; Tue, 11 Aug 2009 14:57:19 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n7BLvHBC001764 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Tue, 11 Aug 2009 22:57:18 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO800C0DFNH7W00@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.Com); Tue, 11 Aug 2009 14:57:17 -0700 (PDT) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO800C1CFNG7S00@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.Com); Tue, 11 Aug 2009 14:57:16 -0700 (PDT) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n7BLvGGX000897 for ; Tue, 11 Aug 2009 14:57:16 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KO800300FKQ1W00@fe-sfbay-10.sun.com> for LSARC-ext@Sun.Com (ORCPT LSARC-ext@Sun.Com); Tue, 11 Aug 2009 14:57:16 -0700 (PDT) Received: from [10.6.102.27] ([unknown] [10.6.102.27]) by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KO800DK3FNE3VB0@fe-sfbay-10.sun.com> for LSARC-ext@Sun.Com (ORCPT LSARC-ext@Sun.Com); Tue, 11 Aug 2009 14:57:14 -0700 (PDT) Date: Tue, 11 Aug 2009 14:57:14 -0700 From: Alan Coopersmith Subject: Re: ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> Sender: Alan.Coopersmith@Sun.COM To: Brian Cameron Cc: LSARC-ext@Sun.COM, desktop-discuss@opensolaris.org Message-id: <4A81E93A.7040803@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Enigmail-Version: 0.95.1 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.21 (X11/20090323) Status: RO Content-Length: 4533 Brian Cameron wrote: > 4.1.1 Detail About ConsoleKit Database > # Device associated with Xserver running session (if any). > x11_display_device=/dev/console > 4.1.5 Environment Variables > CK_SESSION_X11_DISPLAY_DEVICE - The device associated with the Xserver. As previously explained to the project team before ARC, in our current X server implementations, there may be anywhere from 0 to 16 device files in /dev representing the display devices on which X is displaying - and there is no guarantee of uniqueness, nor that the same device file represents the same physical device. It seems highly unlikely that any client is going to be able to do anything useful with this string, so I still don't understand what the point of reporting it is. > # Boolean. Set to "true" if the active session, "false otherwise" > is_active=false "the" active session? On a multi-seat or Sun Ray system, is it okay that there are multiple active sessions? > /var/svc/manifest/system/consolekit.xml Uncommitted SMF > integration > file. The SMF manifest (*.xml file) should be a Project Private implementation detail. The public interface you're missing here is the FMRI - that's the interface the rest of the system needs to use to control your service, and thus the one you need to include in your interface table. > /usr/lib/ck-collect-session-info Private See 4.1.2. > /usr/lib/ck-get-x11-display-device Volatile See 4.1.2. > /usr/lib/ck-get-x11-server-pid Private See 4.1.2. > /usr/lib/ConsoleKit/scripts/ck-system-restart Private See 4.1.6. > /usr/lib/ConsoleKit/scripts/ck-system-stop Private See 4.1.6. Why are the first three not in /usr/lib/ConsoleKit with the rest? > + /usr/lib/ck-collect-session-info --uid UID --pid PID > > This program is passed the UID and PID of a process, and it returns > the following information from the ConsoleKit database about that > process. > > + /usr/lib/ck-get-x11-server-pid > > Returns the PID of the Xserver process running on the current > $DISPLAY environment variable. What happens if the X server is running in a different zone/label than the client? (For instance, on a Trusted Extensions system, the X server runs in the global zone, labeled clients in non-global, per-label zones.) Is there a ConsoleKit daemon per zone? > GDM uses the ck-get-x11-display-device application to get the > x11-display-device value. When a display is running via graphical VT, > ConsoleKit uses the following mechanism to get the TTY value. This > mechanism works on other operating systems, such as Linux, and also > works on Solaris when VT is being used. When VT is used, these > programs make use of proc interfaces to collect some of this > information, as follows: > > The ConsoleKit ck-get-x11-display-device, ck-get-x11-server-pid, and > ck-collect-session-info programs call XOpenDisplay on a given $DISPLAY, > and then calls ConnectionNumber to get the socket associated with > that display. getpeerucred is used to get the UID and PID of the > process. This still seems highly silly, given that gdm can get the pid of the Xserver by simply checking the variable into which it put the return value from the fork() call it made to start the X server. > ConsoleKit manages stopping and restarting the system. On Solaris, when > the display manager informs ConsoleKit that such an action is requested, > the chkauthattr function is called to see if the calling user has RBAC > permissions for the "solaris.system.shutdown" key. If yes, then the > /usr/lib/ConsoleKit/scripts/ck-system-restart script is run if a restart > action was requested. If a shutdown action was requested, then the > /usr/lib/ConsoleKit/scripts/ck-system-stop script is run. > > On Solaris, the ck-system-stop script runs "/sbin/init 5" and the > ck-system-restart script runs "/sbin/init 6". Do provisions need to be made for choosing between fast reboot & slow reboot? -- -Alan Coopersmith- alan.coopersmith@sun.com Sun Microsystems, Inc. - X Window System Engineering From Brian.Cameron@sun.com Tue Aug 11 16:17:09 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7BNH8pp003331 for ; Tue, 11 Aug 2009 16:17:09 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n7BNH3aJ017823 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Wed, 12 Aug 2009 00:17:08 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO800223JCJ0G00@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Tue, 11 Aug 2009 16:17:07 -0700 (PDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO8009LWJCHYWC0@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Tue, 11 Aug 2009 16:17:05 -0700 (PDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7BNH57f029241 for ; Tue, 11 Aug 2009 23:17:05 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KO800900J9UN100@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Tue, 11 Aug 2009 17:17:05 -0600 (MDT) Received: from [129.153.250.100] ([unknown] [129.153.250.100]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KO800LIOJCFQIA0@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Tue, 11 Aug 2009 17:17:05 -0600 (MDT) Date: Tue, 11 Aug 2009 18:17:25 -0500 From: Brian Cameron Subject: Re: ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <4A81E93A.7040803@sun.com> Sender: Brian.Cameron@sun.com To: Alan Coopersmith Cc: LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A81FC05.7050209@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> <4A81E93A.7040803@sun.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090804 Thunderbird/3.0b3 Status: RO Content-Length: 7080 Alan: > Brian Cameron wrote: >> 4.1.1 Detail About ConsoleKit Database >> # Device associated with Xserver running session (if any). >> x11_display_device=/dev/console >> 4.1.5 Environment Variables >> CK_SESSION_X11_DISPLAY_DEVICE - The device associated with the Xserver. > > As previously explained to the project team before ARC, in our current X server > implementations, there may be anywhere from 0 to 16 device files in /dev > representing the display devices on which X is displaying - and there is no > guarantee of uniqueness, nor that the same device file represents the same > physical device. It seems highly unlikely that any client is going to be able > to do anything useful with this string, so I still don't understand what the > point of reporting it is. The onepager explains that these environment variables are only used by the scripts described in section 4.1.4. In other words, the scripts that ConsoleKit runs when a session starts. These environment variables simply pass along the information associated with the session. Since the display device indicates what VT is being used on the console, this could be useful for the session startup script to do special work based on which VT is being used, if desired. >> # Boolean. Set to "true" if the active session, "false otherwise" >> is_active=false > > "the" active session? On a multi-seat or Sun Ray system, is it okay that > there are multiple active sessions? The description of this field is not very good. I need to update the onepager tomorrow anyway when Halton provides some updates to better highlight how multi-seat works with the new ConsoleKit (e.g. details on how the /etc/ConsoleKit/displays.d and /etc/ConsoleKit/sessions.d files work). I will improve this comment when I make those changes. Anyway, this field specifies the "active" session for a given seat. On a Sun Ray display you can only have a single session on a seat, and it would always be active. This field is more useful on a seat that supports VT where you can have multiple sessions, but where only one is active at a time. That said, if Sun Ray wanted to integrate more tightly with ConsoleKit, they could use this field to indicate whether a given session is actually mapped to a display or not. With the current Sun Ray implementation, ConsoleKit would not be aware of displays that are not actually running on a display (or seat). >> /var/svc/manifest/system/consolekit.xml Uncommitted SMF >> integration >> file. > > The SMF manifest (*.xml file) should be a Project Private implementation detail. > The public interface you're missing here is the FMRI - that's the interface the > rest of the system needs to use to control your service, and thus the one you > need to include in your interface table. Okay, I will also make this change to the onepager tomorrow. >> /usr/lib/ck-collect-session-info Private See 4.1.2. >> /usr/lib/ck-get-x11-display-device Volatile See 4.1.2. >> /usr/lib/ck-get-x11-server-pid Private See 4.1.2. >> /usr/lib/ConsoleKit/scripts/ck-system-restart Private See 4.1.6. >> /usr/lib/ConsoleKit/scripts/ck-system-stop Private See 4.1.6. > > Why are the first three not in /usr/lib/ConsoleKit with the rest? The first three are libexec programs, but since Solaris doesn't support libexec, they get installed to /usr/lib. If you think it would be cleaner, we could set libexecdir to /usr/lib/ConsoleKit when building ConsoleKit to move the libexec programs into /usr/lib/ConsoleKit. >> + /usr/lib/ck-collect-session-info --uid UID --pid PID >> >> This program is passed the UID and PID of a process, and it returns >> the following information from the ConsoleKit database about that >> process. >> >> + /usr/lib/ck-get-x11-server-pid >> >> Returns the PID of the Xserver process running on the current >> $DISPLAY environment variable. > > What happens if the X server is running in a different zone/label than the > client? (For instance, on a Trusted Extensions system, the X server runs > in the global zone, labeled clients in non-global, per-label zones.) > Is there a ConsoleKit daemon per zone? In this case, parts of the ConsoleKit framework would not work, including this program. However, since the parts of the ConsoleKit framework which would break are only used to support VT switching on the console, I do not believe this would be a problem. Clients in a trusted environment would not be using VT switching, or using the console. >> GDM uses the ck-get-x11-display-device application to get the >> x11-display-device value. When a display is running via graphical VT, >> ConsoleKit uses the following mechanism to get the TTY value. This >> mechanism works on other operating systems, such as Linux, and also >> works on Solaris when VT is being used. When VT is used, these >> programs make use of proc interfaces to collect some of this >> information, as follows: >> >> The ConsoleKit ck-get-x11-display-device, ck-get-x11-server-pid, and >> ck-collect-session-info programs call XOpenDisplay on a given $DISPLAY, >> and then calls ConnectionNumber to get the socket associated with >> that display. getpeerucred is used to get the UID and PID of the >> process. > > This still seems highly silly, given that gdm can get the pid of the Xserver > by simply checking the variable into which it put the return value from the > fork() call it made to start the X server. I will touch base with the upstream ConsoleKit maintainers and get a more official response to this design choice before responding. >> ConsoleKit manages stopping and restarting the system. On Solaris, when >> the display manager informs ConsoleKit that such an action is requested, >> the chkauthattr function is called to see if the calling user has RBAC >> permissions for the "solaris.system.shutdown" key. If yes, then the >> /usr/lib/ConsoleKit/scripts/ck-system-restart script is run if a restart >> action was requested. If a shutdown action was requested, then the >> /usr/lib/ConsoleKit/scripts/ck-system-stop script is run. >> >> On Solaris, the ck-system-stop script runs "/sbin/init 5" and the >> ck-system-restart script runs "/sbin/init 6". > > Do provisions need to be made for choosing between fast reboot& slow reboot? That could be a useful enhancement to ConsoleKit. As long as only GDM uses ConsoleKit for these features, and as long as the GDM "Shutdown" and "Reboot" options are turned off by default (as Glenn said is a requirement), I am not sure it is needed, though. Brian From Jedy.Wang@sun.com Tue Aug 11 21:04:30 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7C44TWx012736 for ; Tue, 11 Aug 2009 21:04:29 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n7C44RTH026207 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Wed, 12 Aug 2009 05:04:28 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO800H01WNFCS00@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Tue, 11 Aug 2009 21:04:27 -0700 (PDT) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO800CPEWNDC4A0@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Tue, 11 Aug 2009 21:04:27 -0700 (PDT) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7C44PMG020776 for ; Wed, 12 Aug 2009 04:04:25 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KO800J00WIBU900@mail-apac.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 12 Aug 2009 12:04:25 +0800 (SGT) Received: from [129.158.217.16] ([unknown] [129.158.217.16]) by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KO800EZCWNAWED0@mail-apac.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 12 Aug 2009 12:04:25 +0800 (SGT) Date: Wed, 12 Aug 2009 12:03:31 +0800 From: Jedy Wang Subject: Re: [desktop-discuss] ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <4A81FC05.7050209@sun.com> Sender: Jedy.Wang@sun.com To: Brian Cameron Cc: Alan Coopersmith , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <1250049811.26256.3.camel@pampas> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> <4A81E93A.7040803@sun.com> <4A81FC05.7050209@sun.com> Status: RO Content-Length: 515 Fast reboot support will be covered in another ARC case for the update of reboot dialog. Regards, Jedy On Tue, 2009-08-11 at 18:17 -0500, Brian Cameron wrote: > > Do provisions need to be made for choosing between fast reboot& > slow reboot? > > That could be a useful enhancement to ConsoleKit. As long as only GDM > uses ConsoleKit for these features, and as long as the GDM "Shutdown" > and "Reboot" options are turned off by default (as Glenn said is a > requirement), I am not sure it is needed, though. From Darren.Moffat@Sun.COM Wed Aug 12 02:04:50 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7C94nRQ022381 for ; Wed, 12 Aug 2009 02:04:50 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n7C94dvl013070 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Wed, 12 Aug 2009 17:04:49 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO900M0VAJYJC00@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 12 Aug 2009 02:04:46 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO900F9MAJWUB80@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 12 Aug 2009 02:04:45 -0700 (PDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-1-fe1.eu.sun.com [192.18.6.7] (may be forged)) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n7C94itA012080 for ; Wed, 12 Aug 2009 09:04:44 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KO900I009ORA600@fe-emea-10.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 12 Aug 2009 10:04:29 +0100 (BST) Received: from [192.168.1.105] (cpc2-rdng20-2-0-cust917.15-3.cable.virginmedia.com [86.28.167.150]) by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KO900JCWAJDI470@fe-emea-10.sun.com>; Wed, 12 Aug 2009 10:04:26 +0100 (BST) Date: Wed, 12 Aug 2009 10:04:17 +0100 From: Darren J Moffat Subject: Re: ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> Sender: Darren.Moffat@Sun.COM To: Brian Cameron Cc: LSARC-ext@Sun.COM, desktop-discuss@opensolaris.org Message-id: <4A828591.2010207@Sun.COM> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.21 (X11/20090623) Status: RO Content-Length: 4232 Brian Cameron wrote: > On some Linux systems, the pam_ck_connector is used to ensure that > non-graphical logins (e.g. telnet, ssh, etc.) are registered with > ConsoleKit. Thus ConsoleKit can be used as a utmp/wtmp replacement > since it stores a superset of the information as in the utmp/wtmp > database. However, this is not an appropriate use of PAM and there are > no plans to support this feature on Solaris since there is no > immediate need to replace utmp/wtmp at this point in time. Instead, > GDM will make use of ConsoleKit to manage its displays. I don't understand why you think this isn't appropriate use of PAM. It sounds perfectly reasonable use of a PAM session module. The fact that we don't currently update utmpx/wtmpx/lastlog properly from pam_unix_session is a bug (ironically we used to do it in 2.5.1 before PAM became public in 2.6). pam_ck_connector looks like a nicely written and very useful PAM module. I don't think this should replace utmpx/wtmpx on OpenSolaris systems but I have no problem with it augmenting them. I highly recommend that we ship pam_ck_connector. It is quite a different issue of wither or not we choose to have it configured in any of the default PAM stacks we provide in /etc/pam.conf. > ConsoleKit source code contains the programs > /usr/sbin/ck-log-system-start, /usr/sbin/ck-log-system-restart, and > /usr/sbin/ck-log-system-stop. These are intended to be helper tools to > log system start, restart, and stop events. These are intended to make > ConsoleKit more like utmp/wtmp which also logs these events. Since > there are no plans to support ConsoleKit as a utmp/wtmp replacement, > these programs are not included with the Solaris ConsoleKit packages. I think they should be delivered. > 4.1.6 Stop/Restart Scripts > > ConsoleKit manages stopping and restarting the system. On Solaris, when > the display manager informs ConsoleKit that such an action is requested, > the chkauthattr function is called to see if the calling user has RBAC > permissions for the "solaris.system.shutdown" key. If yes, then the > /usr/lib/ConsoleKit/scripts/ck-system-restart script is run if a restart > action was requested. If a shutdown action was requested, then the > /usr/lib/ConsoleKit/scripts/ck-system-stop script is run. > > On Solaris, the ck-system-stop script runs "/sbin/init 5" and the > ck-system-restart script runs "/sbin/init 6". Why does it use init rather than shutdown which is uses on Linux and FreeBSD ? > 4.1.9 SMF integration > > ConsoleKit includes SMF integration files to start and stop the > /usr/sbin/console-kit-daemon program as a service. > > 4.2. Interfaces: > > Exported Interfaces Stability Comments > --------------------------------------- ----------- ------------- > SUNWconsolekit Uncommitted Package name. > SUNWconsolekit-devel Uncommitted Package name. > SUNWconsolekit-root Uncommitted Package name. > /usr/lib/pkgconfig/ck-connector.pc Uncommitted pkg-config > file. > /var/svc/manifest/system/consolekit.xml Uncommitted SMF > integration > file. What is the FMRI that is the important interface not the filesystem location of the manifest file. What is the method_credential section in the manifest for starting consolekit ? > 4.4. Packaging & Delivery: > > SUNWconsolekit, SUNWconsolekit-root, SUNWconsolekit-devel - packages > for ConsoleKit. Does this project intent to integrate before or after the SXCE demise ? If after then I see no reason to have SUNWconsolekit and SUNWconsolekit-root split apart since whey will just get recombined. -- Darren J Moffat From Edward.Shu@sun.com Wed Aug 12 02:21:19 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7C9LIdo022469 for ; Wed, 12 Aug 2009 02:21:19 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n7C9LHeY026943 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Wed, 12 Aug 2009 10:21:18 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO900301BBHF100@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 12 Aug 2009 03:21:17 -0600 (MDT) Received: from sineb-mail-2.sun.com ([192.18.19.7]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO900MEBBBFGF60@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 12 Aug 2009 03:21:17 -0600 (MDT) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7C9LFHw028694 for ; Wed, 12 Aug 2009 09:21:15 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KO900600B6SAV00@mail-apac.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 12 Aug 2009 17:21:15 +0800 (SGT) Received: from [129.158.218.35] ([unknown] [129.158.218.35]) by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KO900HX3B9L2UK0@mail-apac.sun.com>; Wed, 12 Aug 2009 17:21:15 +0800 (SGT) Date: Wed, 12 Aug 2009 17:18:00 +0800 From: Edward Shu Subject: Re: ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> Sender: Edward.Shu@sun.com To: Brian Cameron Cc: LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A8288C8.1000206@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=GB2312 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.9 (X11/20080213) Status: RO Content-Length: 1535 Brian Cameron: > 2. Project Summary > 2.1. Project Description: > > ConsoleKit is a FreeDesktop framework for defining and tracking users, > login sessions and seats. ConsoleKit has two main purposes: > > - To maintain a database of information about each running session > which the display manager (GDM) uses. The old GDM keeps track of > this information internally, but new versions of GDM (2.21 and > later) use ConsoleKit. > - To support switching sessions and session migration when using > What is "session migration" here? Does it mean the session can be migrated from one VT to another VT? With VT, will ConsoleKit be noticed the session switch? Session switch may automatically cause the keyboard and mouse migration between sessions. Currently in Solaris, graphics session will grab the mouse and keyboard input from the text session in the session switch. > > 4. Technical Description: > 4.1. Details: > > ConsoleKit maintains a database of which users are logged into the > system. ConsoleKit groups sessions by seats which represent a set of > hardware (usually a keyboard and mouse). Other process communicate > with ConsoleKit via D-Bus. > How ConsoleKit know which seat the session belong to? -- Best Regards, Ming. ------------------------------------------ -Edward Shu -Solaris x86 Engineering, Sun Microsystems -tele: +86-10-62673100 __________________________________________ From Brian.Cameron@sun.com Wed Aug 12 15:01:18 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7CM1Isn023274 for ; Wed, 12 Aug 2009 15:01:18 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n7CM1IvY022979; Wed, 12 Aug 2009 15:01:18 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOA00K03AI4EQ00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 12 Aug 2009 15:01:16 -0700 (PDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOA00HW8AI3YC30@nwk-avmta-1.sfbay.Sun.COM>; Wed, 12 Aug 2009 15:01:16 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7CM1F2V006752; Wed, 12 Aug 2009 22:01:15 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KOA00200A7EO900@mail-amer.sun.com>; Wed, 12 Aug 2009 16:01:15 -0600 (MDT) Received: from [10.0.0.5] ([unknown] [67.167.203.84]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KOA00IWYAHH5XG0@mail-amer.sun.com>; Wed, 12 Aug 2009 16:00:53 -0600 (MDT) Date: Wed, 12 Aug 2009 17:01:16 -0500 From: Brian Cameron Subject: Re: ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <4A828591.2010207@Sun.COM> Sender: Brian.Cameron@sun.com To: Darren J Moffat Cc: Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A833BAC.30103@sun.com> MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_jv1U6jeNwT4bS1jIi3oj0w)" X-PMX-Version: 5.4.1.325704 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> <4A828591.2010207@Sun.COM> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090804 Thunderbird/3.0b3 Status: RO Content-Length: 9819 This is a multi-part message in MIME format. --Boundary_(ID_jv1U6jeNwT4bS1jIi3oj0w) Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT Darren and Gary: >> On some Linux systems, the pam_ck_connector is used to ensure that >> non-graphical logins (e.g. telnet, ssh, etc.) are registered with >> ConsoleKit. Thus ConsoleKit can be used as a utmp/wtmp replacement >> since it stores a superset of the information as in the utmp/wtmp >> database. However, this is not an appropriate use of PAM and there are >> no plans to support this feature on Solaris since there is no >> immediate need to replace utmp/wtmp at this point in time. Instead, >> GDM will make use of ConsoleKit to manage its displays. > > I don't understand why you think this isn't appropriate use of PAM. I discussed this with Gary Winiger several months ago and he seemed insistent that this was an inappropriate use of PAM. He said that if we wanted programs to integrate with ConsoleKit, they should integrate directly (as GDM does), and not use a PAM module for this purpose. If my understanding of Gary's concerns are correct, he seemed to feel that PAM was to be used for authorization purposes, and not to keep random databases up to date. I've cc:ed Gary. Hopefully he can elaborate his views on this. Unless I am confused it seems that you and he have different perspectives on this. > It > sounds perfectly reasonable use of a PAM session module. The fact that > we don't currently update utmpx/wtmpx/lastlog properly from > pam_unix_session is a bug (ironically we used to do it in 2.5.1 before > PAM became public in 2.6). pam_ck_connector looks like a nicely written > and very useful PAM module. > > I don't think this should replace utmpx/wtmpx on OpenSolaris systems but > I have no problem with it augmenting them. While ConsoleKit does aim to replace utmpx/wtmpx, the practical reason for providing pam-ck-connector is to make sure that programs on Linux which depend on ConsoleKit work. However, on Solaris, we do not deliver any of the programs which use ConsoleKit that benefit from providing this PAM module. On Linux, this PAM module is needed because some components (such as PolicyKit and PulseAudio) use ConsoleKit to check if the user is on the console and grant the user certain authorizations if they are. For example, without this PAM module, users who login to the console would not be able to use audio since PulseAudio would otherwise not be able to tell the user is logged into the console. However, on Solaris, we do not ship PulseAudio, PolicyKit, or any other modules which use ConsoleKit to determine if the user is on the console. On Solaris, we use a very different mechanism for granting such privilege (RBAC and PSARC 2008/034 Defining Workstation Owner Infrastructure). So, pam-ck-connector is currently not really needed on Solaris. If, in the future, we integrate modules which need this PAM module, then we could explore adding it. Though, perhaps it would make more sense to directly integrate such modules directly with RBAC and PSARC 2008/034 rather than using ConsoleKit to tell if the user should gain authorizations if they are on the console. As you say, though, we could deliver the PAM plugin anyway and simply not make use of it in any default PAM stack. There may be some usefulness in doing this. For example, if someone wants to build and use PolicyKit or PulseAudio on OpenSolaris, or if they just want to use ConsoleKit as a utmp/wtmp replacement, then this PAM module could be useful. > I highly recommend that we ship pam_ck_connector. It is quite a > different issue of wither or not we choose to have it configured in any > of the default PAM stacks we provide in /etc/pam.conf. What do others think? I do not have a problem providing the PAM module, but not using it any default PAM stacks if that's what ARC thinks is best. >> ConsoleKit source code contains the programs >> /usr/sbin/ck-log-system-start, /usr/sbin/ck-log-system-restart, and >> /usr/sbin/ck-log-system-stop. These are intended to be helper tools to >> log system start, restart, and stop events. These are intended to make >> ConsoleKit more like utmp/wtmp which also logs these events. Since >> there are no plans to support ConsoleKit as a utmp/wtmp replacement, >> these programs are not included with the Solaris ConsoleKit packages. > > I think they should be delivered. For these helper scripts to be useful, programs that actually shutdown, restart, and stop the machine need to call these helper scripts. On Fedora Linux, they modified upstart (their version of "init") to call these scripts at the appropriate time. Is there really any value in providing these helper scripts before we plan to make Solaris init integrate with them? Note that the only consumer of the start/stop/restart ConsoleKit database entries is the ConsoleKit exported interface /usr/bin/ck-history. So, there is no problem if we do not deliver the helper scripts. The only thing this affects is that when you run ck-history, you do not see information about when the system started, stopped or restarted. >> 4.1.6 Stop/Restart Scripts >> >> ConsoleKit manages stopping and restarting the system. On Solaris, when >> the display manager informs ConsoleKit that such an action is requested, >> the chkauthattr function is called to see if the calling user has RBAC >> permissions for the "solaris.system.shutdown" key. If yes, then the >> /usr/lib/ConsoleKit/scripts/ck-system-restart script is run if a restart >> action was requested. If a shutdown action was requested, then the >> /usr/lib/ConsoleKit/scripts/ck-system-stop script is run. >> >> On Solaris, the ck-system-stop script runs "/sbin/init 5" and the >> ck-system-restart script runs "/sbin/init 6". > > Why does it use init rather than shutdown which is uses on Linux and > FreeBSD ? Rich McAllister said we should do this. Refer to the mail log for LSARC 2004/713: http://sac.eng.sun.com/arc/LSARC/2004/713/mail And search for "init 5" or "init 6" In summary he said: > I'd stay away from the reboot and halt commands, these are migrated > from the old SunOS4 compatibility and don't really do everything > you'd want. I'd go for either the SVR4-ish shutdown (not the /usr/ucb > one, even though most people prefer it) or just go straight to > /usr/sbin/init > the main difference between "shutdown" and "init" is that shutdown > does a "wall" to notify time sharing users. Since rebooting/shutting > down from the login screen really only makes sense on a single-user > system, there doesn't seem to be much use for the "wall". However, we could switch to using shutdown if that makes better sense now. >> 4.1.9 SMF integration >> >> ConsoleKit includes SMF integration files to start and stop the >> /usr/sbin/console-kit-daemon program as a service. >> >> 4.2. Interfaces: >> Exported Interfaces Stability Comments >> --------------------------------------- ----------- ------------- >> SUNWconsolekit Uncommitted Package name. >> SUNWconsolekit-devel Uncommitted Package name. >> SUNWconsolekit-root Uncommitted Package name. >> /usr/lib/pkgconfig/ck-connector.pc Uncommitted pkg-config >> file. >> /var/svc/manifest/system/consolekit.xml Uncommitted SMF >> integration >> file. > > What is the FMRI that is the important interface not the filesystem > location of the manifest file. svc:/system/consolekit:default > What is the method_credential section in the manifest for starting > consolekit ? It currently doesn't have one. You can see the manifest file, it is attached if you have any suggestions for improving it. I based this manifest on the gdm.xml file, which also doesn't have any method_credential sections. Perhaps that was incorrect? >> 4.4. Packaging & Delivery: >> SUNWconsolekit, SUNWconsolekit-root, SUNWconsolekit-devel - packages >> for ConsoleKit. > > Does this project intent to integrate before or after the SXCE demise ? > If after then I see no reason to have SUNWconsolekit and > SUNWconsolekit-root split apart since whey will just get recombined. I am not sure. Obviously the Desktop time will not bother splitting the package if there is no need. Brian --Boundary_(ID_jv1U6jeNwT4bS1jIi3oj0w) Content-type: text/xml; name=consolekit.xml Content-transfer-encoding: 7BIT Content-disposition: attachment; filename=consolekit.xml --Boundary_(ID_jv1U6jeNwT4bS1jIi3oj0w)-- From Nicolas.Williams@sun.com Wed Aug 12 15:44:02 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7CMi1ox023664 for ; Wed, 12 Aug 2009 15:44:01 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n7CMhudO029662; Wed, 12 Aug 2009 23:43:59 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOA00H03CHAEQ00@brm-avmta-1.central.sun.com>; Wed, 12 Aug 2009 16:43:58 -0600 (MDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOA00KKACH93K90@brm-avmta-1.central.sun.com>; Wed, 12 Aug 2009 16:43:57 -0600 (MDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id n7CMXKxY013238; Wed, 12 Aug 2009 17:33:20 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id n7CMXJKP013237; Wed, 12 Aug 2009 17:33:19 -0500 (CDT) Date: Wed, 12 Aug 2009 17:33:19 -0500 From: Nicolas Williams Subject: Re: ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <4A833BAC.30103@sun.com> To: Brian Cameron Cc: Darren J Moffat , Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <20090812223319.GP10982@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> <4A828591.2010207@Sun.COM> <4A833BAC.30103@sun.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 3159 On Wed, Aug 12, 2009 at 05:01:16PM -0500, Brian Cameron wrote: > >I don't understand why you think this isn't appropriate use of PAM. > > I discussed this with Gary Winiger several months ago and he seemed > insistent that this was an inappropriate use of PAM. He said that if > we wanted programs to integrate with ConsoleKit, they should integrate > directly (as GDM does), and not use a PAM module for this purpose. If > my understanding of Gary's concerns are correct, he seemed to feel that > PAM was to be used for authorization purposes, and not to keep random > databases up to date. > > I've cc:ed Gary. Hopefully he can elaborate his views on this. Unless > I am confused it seems that you and he have different perspectives on > this. PAM includes "session management". Just what that means is a bit nebulous, but a) the "hook" is there, b) the login apps that deal in "sessions" do call PAM session management functions, therefore I don't see why modules that make use of it would be inappropriate. But that's not the question here (see below). Login apps should update the system's login accounting databases, but as we're seeing here, there's a desire to replace those. PAM makes it possible to replace those dynamically. But there are some good [and/or some lame] reasons for not wanting to rely on PAM for this: - There aren't sufficient PAM items by which to convey to modules all the possibly relevant information (e.g., client IP address, port number, [client hostname FQDN], [server virtual name/port], ...). Yes, we could add some. But that's going to be a lot of work, and there's the potential for conflicts with Linux-PAM (hopefully not, but I've not looked). - last(1), w(1), ... should use the same DB as login apps, or PAM, are using. If we use PAM... then it's hard to tell which DB is in use! IMO it would be unacceptable for last(1) and friends to break, or not find all the relevant information, when using an alternative user login DB. - Some PAM apps don't call pam_close_session(3PAM) and pam_end(3PAM) in the same process, or even with the same PAM handle, as pam_open_session(3PAM). Or maybe the call pam_close_session(3PAM) with less than all privileges. We could get away with saying that all third-party apps that are broken in this way are... broken and that's too bad. But we have some right in Solaris that are similarly broken. The SunSSH sshd used to get this right, but recently it became one of these broken applications (for reasons that are not relevant here). The Solaris telnet and rlogin daemons are also similarly broken (unless auditing is enabled). Modules can sometimes work around this well enough, but it requires jumping through hoops. I've no idea if the module in question here does that. IMO it would be fine to ship the module, with suitable warnings in its manpage, but /etc/pam.conf should make no use of it. Except, perhaps, in the case of the gdm service, in which case GDM could skip using ConsoleKit directly (but I suspect that GDM will run into the "not enough PAM items" problem). Nico -- From Brian.Cameron@sun.com Wed Aug 12 15:50:34 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7CMoYOg023689 for ; Wed, 12 Aug 2009 15:50:34 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n7CMoXnC018920 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Wed, 12 Aug 2009 15:50:34 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOA00I03CS95O00@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 12 Aug 2009 16:50:33 -0600 (MDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOA00K9QCS93JC0@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 12 Aug 2009 16:50:33 -0600 (MDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7CMoXTF007284 for ; Wed, 12 Aug 2009 22:50:33 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KOA00I00CLVTO00@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 12 Aug 2009 16:50:33 -0600 (MDT) Received: from [10.0.0.5] ([unknown] [67.167.203.84]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KOA00LMICS46E00@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 12 Aug 2009 16:50:32 -0600 (MDT) Date: Wed, 12 Aug 2009 17:50:51 -0500 From: Brian Cameron Subject: Re: ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <4A81FC05.7050209@sun.com> Sender: Brian.Cameron@sun.com To: Brian Cameron Cc: Alan Coopersmith , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A83474B.9010708@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> <4A81E93A.7040803@sun.com> <4A81FC05.7050209@sun.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090804 Thunderbird/3.0b3 Status: RO Content-Length: 4450 Alan: >>> # Boolean. Set to "true" if the active session, "false otherwise" >>> is_active=false >> >> "the" active session? On a multi-seat or Sun Ray system, is it okay that >> there are multiple active sessions? I updated the comment in the onepager so it now says: # Boolean. Set to "true" if the session is active, "false otherwise" # For example, useful to keep track of which VT session is the active # one. Which is hopefully now more clear. >>> /var/svc/manifest/system/consolekit.xml Uncommitted SMF >>> integration >>> file. >> >> The SMF manifest (*.xml file) should be a Project Private >> implementation detail. >> The public interface you're missing here is the FMRI - that's the >> interface the >> rest of the system needs to use to control your service, and thus the >> one you >> need to include in your interface table. > > Okay, I will also make this change to the onepager tomorrow. Updated. The Exported Interface table now has these lines: svc:/system/consolekit:default Uncommitted ConsoleKit FMRI /var/svc/manifest/system/consolekit.xml Project SMF manifest Private integration >>> + /usr/lib/ck-collect-session-info --uid UID --pid PID >>> >>> This program is passed the UID and PID of a process, and it returns >>> the following information from the ConsoleKit database about that >>> process. >>> >>> + /usr/lib/ck-get-x11-server-pid >>> >>> Returns the PID of the Xserver process running on the current >>> $DISPLAY environment variable. >> >> What happens if the X server is running in a different zone/label than >> the >> client? (For instance, on a Trusted Extensions system, the X server runs >> in the global zone, labeled clients in non-global, per-label zones.) >> Is there a ConsoleKit daemon per zone? > > In this case, parts of the ConsoleKit framework would not work, > including this program. > > However, since the parts of the ConsoleKit framework which would break > are only used to support VT switching on the console, I do not believe > this would be a problem. Clients in a trusted environment would not be > using VT switching, or using the console. I also tried to make this more clear in the onepager. See attached diff file. >>> GDM uses the ck-get-x11-display-device application to get the >>> x11-display-device value. When a display is running via graphical VT, >>> ConsoleKit uses the following mechanism to get the TTY value. This >>> mechanism works on other operating systems, such as Linux, and also >>> works on Solaris when VT is being used. When VT is used, these >>> programs make use of proc interfaces to collect some of this >>> information, as follows: >>> >>> The ConsoleKit ck-get-x11-display-device, ck-get-x11-server-pid, and >>> ck-collect-session-info programs call XOpenDisplay on a given $DISPLAY, >>> and then calls ConnectionNumber to get the socket associated with >>> that display. getpeerucred is used to get the UID and PID of the >>> process. >> >> This still seems highly silly, given that gdm can get the pid of the >> Xserver >> by simply checking the variable into which it put the return value >> from the >> fork() call it made to start the X server. Note that ConsoleKit does not store the PID of the X server in its database. It only uses the PID to get other information about the process, such as the display-device. > I will touch base with the upstream ConsoleKit maintainers and get a > more official response to this design choice before responding. After talking with the upstream maintainers, they provide the following reason why ConsoleKit works this way. This design prevents the session leader from providing spoofed information. Since the D-Bus OpenSession interface is an unprivileged operation and takes no arguments. When this is used, the entries in the database are filled via doing such probing. The session leader can use the OpenSessionWithParameters and pass in the arguments, and thus avoid ConsoleKit from needing to do such probing. In fact GDM does use OpenSessionWithParameters, but GDM also calls the ck-x11-get-display-device script to figure out what display device is associated with the display and should be passed into OpenSessionWithParameters. When using VT, ck-x11-get-display-device does probe the Xserver to get the VT device name. Brian From Halton.Huo@sun.com Wed Aug 12 20:29:49 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7D3TmeX007510 for ; Wed, 12 Aug 2009 20:29:48 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n7D3TkqT007994 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Thu, 13 Aug 2009 04:29:47 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOA00503PPNHP00@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 12 Aug 2009 20:29:47 -0700 (PDT) Received: from sineb-mail-2.sun.com ([192.18.19.7]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOA00FD8PPL5IE0@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 12 Aug 2009 20:29:46 -0700 (PDT) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7D3Tjk3024258 for ; Thu, 13 Aug 2009 03:29:45 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KOA00800PIY0P00@mail-apac.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 13 Aug 2009 11:29:45 +0800 (SGT) Received: from [129.158.217.65] ([unknown] [129.158.217.65]) by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KOA00BMYPPIV910@mail-apac.sun.com>; Thu, 13 Aug 2009 11:29:44 +0800 (SGT) Date: Thu, 13 Aug 2009 11:24:39 +0800 From: Halton Huo Subject: Re: [desktop-discuss] ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <4A8288C8.1000206@sun.com> Sender: Halton.Huo@sun.com To: Edward Shu Cc: Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <1250133879.8716.19.camel@judo> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> <4A8288C8.1000206@sun.com> Status: RO Content-Length: 2398 On Wed, 2009-08-12 at 17:18 +0800, Edward Shu wrote: > Brian Cameron: > > 2. Project Summary > > 2.1. Project Description: > > > > ConsoleKit is a FreeDesktop framework for defining and tracking users, > > login sessions and seats. ConsoleKit has two main purposes: > > > > - To maintain a database of information about each running session > > which the display manager (GDM) uses. The old GDM keeps track of > > this information internally, but new versions of GDM (2.21 and > > later) use ConsoleKit. > > - To support switching sessions and session migration when using > > > What is "session migration" here? Does it mean the session can be > migrated from > one VT to another VT? With VT, will ConsoleKit be noticed the session > switch? > Session switch may automatically cause the keyboard and mouse migration > between sessions. Currently in Solaris, graphics session will grab the > mouse and keyboard input from the text session in the session switch. > Leave the session migration question for Brian. > > > > 4. Technical Description: > > 4.1. Details: > > > > ConsoleKit maintains a database of which users are logged into the > > system. ConsoleKit groups sessions by seats which represent a set of > > hardware (usually a keyboard and mouse). Other process communicate > > with ConsoleKit via D-Bus. > > > How ConsoleKit know which seat the session belong to? > For each session, there is D-Bus method call "GetSeatId" to get the seat id. And ck-list-sessions will print all properties of a session include seat. In the 4.1.2 ck-list-sessions, the seat id is 'Seat1' [quote] SessionSeat1Local: unix-user = '50' realname = 'GDM Reserved UID' seat = 'Seat1' session-type = 'LoginWindow' display-type = 'Local' open = 'TRUE' active = 'TRUE' x11-display = ':0' x11-display-device = '/dev/console' display-device = '/dev/console' remote-host-name = '' is-local = 'TRUE' on-since = '2009-08-11T06:46:42.941134Z' login-session-id = '' idle-since-hint = '' [/quote] Regards, Halton. From Edward.Shu@sun.com Wed Aug 12 23:31:49 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7D6VmpI010834 for ; Wed, 12 Aug 2009 23:31:49 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n7D6VjnB011036 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Thu, 13 Aug 2009 14:31:47 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOA00M03Y4YQP00@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 12 Aug 2009 23:31:46 -0700 (PDT) Received: from sineb-mail-2.sun.com ([192.18.19.7]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOA002NKY4UED60@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 12 Aug 2009 23:31:45 -0700 (PDT) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7D6VfVQ004203 for ; Thu, 13 Aug 2009 06:31:41 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KOA00L00Y44W400@mail-apac.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 13 Aug 2009 14:31:41 +0800 (SGT) Received: from [129.158.218.35] ([unknown] [129.158.218.35]) by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KOA00H8EY4CNIF0@mail-apac.sun.com>; Thu, 13 Aug 2009 14:31:41 +0800 (SGT) Date: Thu, 13 Aug 2009 14:29:16 +0800 From: Edward Shu Subject: Re: [desktop-discuss] ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <1250133879.8716.19.camel@judo> Sender: Edward.Shu@sun.com To: Halton Huo Cc: Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A83B2BC.6060705@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> <4A8288C8.1000206@sun.com> <1250133879.8716.19.camel@judo> User-Agent: Thunderbird 2.0.0.9 (X11/20080213) Status: RO Content-Length: 1167 > SessionSeat1Local: > unix-user = '50' > realname = 'GDM Reserved UID' > seat = 'Seat1' > session-type = 'LoginWindow' > display-type = 'Local' > open = 'TRUE' > active = 'TRUE' > x11-display = ':0' > x11-display-device = '/dev/console' > display-device = '/dev/console' > remote-host-name = '' > is-local = 'TRUE' > on-since = '2009-08-11T06:46:42.941134Z' > login-session-id = '' > idle-since-hint = '' > [/quote] > > Regards, > Halton. > Thanks for your clarification. One more question, how do we define the "seat"? From the description of "Seat1", it looks like that a seat is directly connected one console device without designating mouse and keyboard devices. > > -- Best Regards, Ming. ------------------------------------------ -Edward Shu -Solaris x86 Engineering, Sun Microsystems -tele: +86-10-62673100 __________________________________________ From Edward.Shu@sun.com Wed Aug 12 23:32:33 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7D6WWp6010868 for ; Wed, 12 Aug 2009 23:32:32 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n7D6WPlm011375 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Thu, 13 Aug 2009 14:32:31 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOA00001Y659N00@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 13 Aug 2009 00:32:29 -0600 (MDT) Received: from sineb-mail-2.sun.com ([192.18.19.7]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOA003YAY63ZQ80@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 13 Aug 2009 00:32:28 -0600 (MDT) Received: from fe-apac-05.sun.com (fe-apac-05.sun.com [192.18.19.176] (may be forged)) by sineb-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7D6WRsA004244 for ; Thu, 13 Aug 2009 06:32:27 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KOA00400Y0ZPP00@mail-apac.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 13 Aug 2009 14:32:27 +0800 (SGT) Received: from [129.158.218.35] ([unknown] [129.158.218.35]) by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KOA0065ZY5SW9B0@mail-apac.sun.com>; Thu, 13 Aug 2009 14:32:27 +0800 (SGT) Date: Thu, 13 Aug 2009 14:29:57 +0800 From: Edward Shu Subject: Re: [desktop-discuss] ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <1250133879.8716.19.camel@judo> Sender: Edward.Shu@sun.com To: Halton Huo Cc: Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A83B2E5.5080603@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> <4A8288C8.1000206@sun.com> <1250133879.8716.19.camel@judo> User-Agent: Thunderbird 2.0.0.9 (X11/20080213) Status: RO Content-Length: 1170 > SessionSeat1Local: > unix-user = '50' > realname = 'GDM Reserved UID' > seat = 'Seat1' > session-type = 'LoginWindow' > display-type = 'Local' > open = 'TRUE' > active = 'TRUE' > x11-display = ':0' > x11-display-device = '/dev/console' > display-device = '/dev/console' > remote-host-name = '' > is-local = 'TRUE' > on-since = '2009-08-11T06:46:42.941134Z' > login-session-id = '' > idle-since-hint = '' > [/quote] > > Regards, > Halton. > Thanks for your clarification. One more question, how do we define the "seat"? From the description of "Seat1", it looks like that a seat is directly connected to one console device without designating mouse and keyboard devices. > > -- Best Regards, Ming. ------------------------------------------ -Edward Shu -Solaris x86 Engineering, Sun Microsystems -tele: +86-10-62673100 __________________________________________ From Halton.Huo@Sun.COM Thu Aug 13 00:03:49 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7D73nVP012828 for ; Thu, 13 Aug 2009 00:03:49 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n7D73nKY005352 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Thu, 13 Aug 2009 00:03:49 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOA00L01ZMDMS00@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 13 Aug 2009 00:03:49 -0700 (PDT) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOA00D8PZMB9L90@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 13 Aug 2009 00:03:49 -0700 (PDT) Received: from fe-apac-05.sun.com (fe-apac-05.sun.com [192.18.19.176] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7D73lXa022372 for ; Thu, 13 Aug 2009 07:03:47 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KOA00M00ZDMFX00@mail-apac.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 13 Aug 2009 15:03:47 +0800 (SGT) Received: from [129.158.217.65] ([unknown] [129.158.217.65]) by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KOA006G4ZM6W5I0@mail-apac.sun.com>; Thu, 13 Aug 2009 15:03:47 +0800 (SGT) Date: Thu, 13 Aug 2009 14:58:37 +0800 From: Halton Huo Subject: Re: [desktop-discuss] ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <4A83B2E5.5080603@sun.com> Sender: Halton.Huo@Sun.COM To: Edward Shu Cc: Brian Cameron , LSARC-ext@Sun.COM, desktop-discuss@opensolaris.org Message-id: <1250146717.8716.59.camel@judo> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> <4A8288C8.1000206@sun.com> <1250133879.8716.19.camel@judo> <4A83B2E5.5080603@sun.com> Status: RO Content-Length: 2726 On Thu, 2009-08-13 at 14:29 +0800, Edward Shu wrote: > > SessionSeat1Local: > > unix-user = '50' > > realname = 'GDM Reserved UID' > > seat = 'Seat1' > > session-type = 'LoginWindow' > > display-type = 'Local' > > open = 'TRUE' > > active = 'TRUE' > > x11-display = ':0' > > x11-display-device = '/dev/console' > > display-device = '/dev/console' > > remote-host-name = '' > > is-local = 'TRUE' > > on-since = '2009-08-11T06:46:42.941134Z' > > login-session-id = '' > > idle-since-hint = '' > > [/quote] > > > > Regards, > > Halton. > > > Thanks for your clarification. One more question, how do we define the > "seat"? > From the description of "Seat1", it looks like that a seat is directly > connected > to one console device without designating mouse and keyboard devices. In section 4.1 said "ConsoleKit groups sessions by seats which represent a set of hardware (usually a keyboard and mouse)." I just send a update to Brian which adding a new section 4.1.10 to explain the Seat configuration file. There is a Key called Devices to identify the devices list. This key is defined for future use. [quote] 4.1.10 Detail About Seat configuration file ConsoleKit load static seat configuration files from /etc/ConsoleKit/seats.d. One .seat file stands for one static configured seat to start. By default, there is one .seat file available: 00-primary.seat. Administrators could put customized .seat files. Following are explanation for each key of 00-primary.seat # Seat Entry section [Seat Entry] # Version information Version=1.0 # Name of this seat Name=Primary seat # Description of this seat Description=start one static local display at :0 # Indicate whether to create this seat or not. If it is set true, # then CK will not create this seat. Default value is false. Hidden=false # Indicate input/output devices including keyboard-pointer-video # card-monitor-sound-usb devices, # This key is not used now, it might need be divided into several # keys in the future: # Pointer= # Monitor= # VideoCard= # Monitor= # UsbHub= Devices= # List of sessions to start on the seat, separated by ';' # Each session is defined in sessions.d/ Sessions=Local; [/quote] Thanks, Halton. From Darren.Moffat@sun.com Thu Aug 13 00:52:31 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7D7qUbA016355 for ; Thu, 13 Aug 2009 00:52:31 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n7D7qNcq020914 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Thu, 13 Aug 2009 15:52:29 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOB00A0P1VHS800@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Thu, 13 Aug 2009 00:52:29 -0700 (PDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOB002YX1VFEAC0@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Thu, 13 Aug 2009 00:52:28 -0700 (PDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-1-fe1.eu.sun.com [192.18.6.7] (may be forged)) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n7D7qQIT008272 for ; Thu, 13 Aug 2009 07:52:27 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KOB0080010FH700@fe-emea-09.sun.com> for LSARC-ext@Sun.COM (ORCPT LSARC-ext@Sun.COM); Thu, 13 Aug 2009 08:52:24 +0100 (BST) Received: from [192.168.1.105] (cpc2-rdng20-2-0-cust917.15-3.cable.virginmedia.com [86.28.167.150]) by fe-emea-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KOB000UD1VBA830@fe-emea-09.sun.com>; Thu, 13 Aug 2009 08:52:23 +0100 (BST) Date: Thu, 13 Aug 2009 08:52:14 +0100 From: Darren J Moffat Subject: Re: ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <4A833BAC.30103@sun.com> Sender: Darren.Moffat@sun.com To: Brian Cameron Cc: Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A83C62E.50107@Sun.COM> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> <4A828591.2010207@Sun.COM> <4A833BAC.30103@sun.com> User-Agent: Thunderbird 2.0.0.21 (X11/20090623) Status: RO Content-Length: 2146 Brian Cameron wrote: > > Darren and Gary: > >>> On some Linux systems, the pam_ck_connector is used to ensure that >>> non-graphical logins (e.g. telnet, ssh, etc.) are registered with >>> ConsoleKit. Thus ConsoleKit can be used as a utmp/wtmp replacement >>> since it stores a superset of the information as in the utmp/wtmp >>> database. However, this is not an appropriate use of PAM and there are >>> no plans to support this feature on Solaris since there is no >>> immediate need to replace utmp/wtmp at this point in time. Instead, >>> GDM will make use of ConsoleKit to manage its displays. >> >> I don't understand why you think this isn't appropriate use of PAM. > > I discussed this with Gary Winiger several months ago and he seemed > insistent that this was an inappropriate use of PAM. He said that if > we wanted programs to integrate with ConsoleKit, they should integrate > directly (as GDM does), and not use a PAM module for this purpose. If > my understanding of Gary's concerns are correct, he seemed to feel that > PAM was to be used for authorization purposes, and not to keep random > databases up to date. I disagree with that assesment. The module is implementing session semantics and is doing so correctly in pam_sm_open_session and pam_sm_close_session. This is exactly what these PAM functions were designed for and we should be using them for utmpx. The ConsoleKit logging appears to be an alternate utmp. > I've cc:ed Gary. Hopefully he can elaborate his views on this. Unless > I am confused it seems that you and he have different perspectives on > this. Well we are different people and we don't agree on everything. Remember I said we should ship the module, I didn't say we should have it in the default configuration. Not shipping the module means people that really want to use it can't do so without building ConsoleKit themselves. The beauty of PAM (and the old reason it was invented by Sun) was so that we can give admins that choice. I very strongly believe (having actually read the source code of the pam_ck_connector) we should be shipping the module. -- Darren J Moffat From Brian.Cameron@sun.com Thu Aug 13 16:57:14 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7DNvE6w022430 for ; Thu, 13 Aug 2009 16:57:14 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n7DNvDen020558 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Thu, 13 Aug 2009 16:57:13 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOC00L05AJD5800@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 13 Aug 2009 16:57:13 -0700 (PDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOC00B5GAJCCK70@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 13 Aug 2009 16:57:13 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7DNvCXj007696 for ; Thu, 13 Aug 2009 23:57:12 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KOC00L00AJC7600@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 13 Aug 2009 17:57:12 -0600 (MDT) Received: from [129.153.250.184] ([unknown] [129.153.250.184]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KOC00HETAJBN9D0@mail-amer.sun.com>; Thu, 13 Aug 2009 17:57:12 -0600 (MDT) Date: Thu, 13 Aug 2009 18:57:34 -0500 From: Brian Cameron Subject: Re: ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> Sender: Brian.Cameron@sun.com To: Brian Cameron Cc: lsarc-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A84A86E.2010007@sun.com> MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_Qtd/SNY8feNtGqgoAMP1Sw)" X-PMX-Version: 5.4.1.325704 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090804 Thunderbird/3.0b3 Status: RO Content-Length: 16232 This is a multi-part message in MIME format. --Boundary_(ID_Qtd/SNY8feNtGqgoAMP1Sw) Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT I have updated the ConsoleKit one-pager with some better examples and some corrections based on the discussion so far. The diff file showing these changes, compared to the original materials submitted with the case, is attached. Brian --Boundary_(ID_Qtd/SNY8feNtGqgoAMP1Sw) Content-type: text/plain; name=ConsoleKit.diff Content-transfer-encoding: 7BIT Content-disposition: attachment; filename=ConsoleKit.diff --- onepager-consolekit.txt-orig Wed Aug 12 15:07:28 2009 +++ onepager-consolekit.txt Thu Aug 13 16:32:47 2009 @@ -68,7 +68,7 @@ hardware (usually a keyboard and mouse). Other process communicate with ConsoleKit via D-Bus. - One session leader process is responsible for asking ConsoleKit to open + One session leader process is responsible for asking ConsoleKit to open a new session. In the typical case, the session leader would be a ConsoleKit enabled display manager, such as GDM. This leader makes a connection to the D-Bus system bus and asks ConsoleKit to open a @@ -80,13 +80,6 @@ child processes. The environment variable contains the UUID used to tie processes to a session. - Note that the XDG_SESSION_COOKIE variable is only meaningful to help - manage session switching and migration, which currently only works - with graphical VT sessions running on the console. Although ConsoleKit - will assign the variable for all sessions, it is ignored if the session - does not support migration via ConsoleKit. Note Sun Ray uses its own - mechanisms for user switching, and is not affected by ConsoleKit. - At this point the session will be registered with ConsoleKit and a particular set of information about the session will be stored along with it. @@ -125,6 +118,20 @@ Comments (lines beginning with "#" are comments added to explain the purpose of each line: + Note that the XDG_SESSION_COOKIE variable is only meaningful to help + manage session switching and migration, which currently only works + with graphical VT sessions running on the console. Although ConsoleKit + will assign the variable for all sessions, it is ignored if the session + does not support migration via ConsoleKit. Note Sun Ray uses its own + mechanisms for user switching, and is not affected by ConsoleKit. + + Likewise, other parts of the ConsoleKit framework are designed to only + be useful in environments that support VT switching. For example, the + /usr/lib/ck-get-x11-server-pid program will not work if the X server + is running in a different zone/label as the client, as in a Trusted + Extensions system. However, this is not a problem since this script + is only used when supporting VT switching. + 4.1.1 Detail About ConsoleKit Database # Seat configuration section. @@ -170,7 +177,9 @@ # Remote hostname if a remote connection, e.g. XDMCP. remote_host_name= - # Boolean. Set to "true" if the active session, "false otherwise" + # Boolean. Set to "true" if the session is active, "false otherwise" + # For example, useful to keep track of which VT session is the active + # one. is_active=false # Boolean. Set to "true" if a local session, "false" if remote. @@ -196,7 +205,7 @@ service_name=:1.203 4.1.2 Detail About ConsoleKit Program And Library Interfaces - + + /usr/sbin/console-kit-daemon [--debug] [--no-daemon] [--timed-exit] The main consoleKit daemon. Supports --debug, --no-daemon, and @@ -223,14 +232,14 @@ This would be useful if a user wanted to start their own session via a startx script and have it registered with ConsoleKit, for example. - + /usr/bin/ck-list-sessions [--format=VAR1,VAR2...] + + /usr/bin/ck-list-sessions [--all] [--format=VAR1,VAR2...] Program that displays information from the ConsoleKit database about - active sessions on the system. It returns information about each - ConsoleKit session. Users can specify what properties to show via - --format arguments. + open sessions or all exsiting (--all) sessions on the system. It + returns information about each ConsoleKit session. Users can + specify what properties to show via --format arguments. - Example 1: output for a login single session without --format follows: + Example 1: output for a login single session without --format: SessionSeat1Local: unix-user = '50' @@ -443,6 +452,204 @@ ConsoleKit includes SMF integration files to start and stop the /usr/sbin/console-kit-daemon program as a service. + 4.1.10 Detail About Seat configuration file + + ConsoleKit load static seat configuration files from + /etc/ConsoleKit/seats.d. One .seat file stands for one static + configured seat to start. + + By default, there is one .seat file available: 00-primary.seat. + Administrators could put customized .seat files. + + Following are explanation for each key of 00-primary.seat + + # Seat Entry section + [Seat Entry] + + # Version information + Version=1.0 + + # Name of this seat + Name=Primary seat + + # Description of this seat + Description=start one static local display at :0 + + # Indicate whether to create this seat or not. If it is set true, + # then CK will not create this seat. Default value is false. + Hidden=false + + # Indicate input/output devices including keyboard-pointer-video + # card-monitor-sound-usb devices, + # This key is not used now, it might need be divided into several + # keys in the future: + # Pointer= + # Monitor= + # VideoCard= + # Monitor= + # UsbHub= + Devices= + + # List of sessions to start on the seat, separated by ';' + # Each session is defined in sessions.d/ + Sessions=Local; + + 4.1.11 Detail About Session configuration file + + ConsoleKit load session configuration files from + /etc/ConsoleKit/sessions.d. + + By default, there are four .session files available: Local.session, + LocalVNC.session, Headless.session and Remote.session. + Administrators could put customized .session files. + + Following are explanation for each key of Local.session + + # Session Entry section + [Session Entry] + + # Indicate whether to create this session or not. If it is set true, + # then CK will not create this session. Default value is false. + Hidden=false + + # Name of this session + Name=Local + + # Type of this session. Default is LoginWindow. + Type=LoginWindow + + # Description of this session + Description=Local Login Screen + + # Display Template of this session, it is defined in displays.d/ + DisplayTemplate=Local + + # Session variables section + # They are used to override corresponding parameters of Exec defined in + # displays.d/Loal.display + [Local] + + # Override $diplay to :0 + display=:0 + + # Override $vt to /dev/vt/7 + # Again, graphical VT sessions will be added in build 124. + vt=/dev/vt/7 + + 4.1.12 Detail About Display Template configuration file + + ConsoleKit load display template configuration files from + /etc/ConsoleKit/displays.d. + + By default, there are five .display files available: Local.display, + LocalVNC.display, Headless.display Remote.display and Sunray.display. + + Sunray.display should be removed when SRSS ship this file itself + in the future. + + Administrators could put customized .display files. + + Following are explanation for each key of Local.display + + # Display Entry section + [Display] + + # Display type + Type=X11 + + # X11 section + [X11] + + # Command to start X11. + # + # Parameters with prefix dollar ('$') would be overridden at run time. + # ConsoleKit will override them either by variables defined in + # session configuration files, or by variables passed to + # "ck-seat-tool --add". + # + # If any parameter is not overridden, then Display Manager will + # decide the value. + # + # For example, $display and $vt are not given, GDM will choose next + # available display number and VT, then start Xorg process. + Exec=/usr/X11/bin/Xorg $display -br -verbose \ + -auth $auth -nolisten tcp $vt + + 4.1.13 Detail About How to start multiple sessions on single seat + + For example, users want to start two local displays, + one is :0 on vt7 and another one is :1 on vt8. + + Refer to 4.1.10, 4.1.11 and 4.1.12, users can edit 00-primary.seat + file as following: + + [Seat Entry] + Version=1.0 + Name=Primary seat + Description=start two static local displays, one is :0 on vt7 \ + and another one is :1 on vt8 + Hidden=false + Devices= + Sessions=Local;Local2; + + Besides original Local.session, we put another similar Local2.session + under /etc/ConsoleKit/sessions.d/ + [Session Entry] + Name=Local + Type=LoginWindow + Description=Local Login Screen + DisplayTemplate=Local + + [Local] + display=:1 + vt=/dev/vt/8 + + Alternatively, users can do with 'ck-seat-tool' at run time without + modifying configuration files. + + $ck-seat-tool --add --session-type=LoginWindow \ + --display-type=Local --seat-id=Seat1 \ + display=:1,vt=/dev/vt/8 + + 4.1.14 Detail About How to start multiple seats + + For example, users want to start two seats, one seat start local + session :0 on vt7 and another seat start VNC session :64. + + Refer to 4.1.10, 4.1.11 and 4.1.12, users can put another file + 01-vnc.seat under /etc/ConsoleKit/seats.d/ as following: + + [Seat Entry] + Version=1.0 + Name=VNC seat + Description=start one VNC display on :64 + Hidden=false + Devices= + Sessions=LocalVNC; + + The LocalVNC.session is as following: + [Session Entry] + Name=LocalVNC + Type=LoginWindow + Description=Connect to local VNC server running on same machine + DisplayTemplate=LocalVNC + + [LocalVNC] + display=:64 + + The LocalVNC.display is as following: + [Display] + Type=X11 + + [X11] + Exec=/usr/X11/bin/Xvnc $display -auth $auth -query localhost + + Alternatively, users can do with 'ck-seat-tool' at run time without + modifying configuration files. + + $ck-seat-tool --add --session-type=LoginWindow \ + --display-type=LocalVNC display=:64 + 4.2. Interfaces: Exported Interfaces Stability Comments @@ -452,9 +659,10 @@ SUNWconsolekit-root Uncommitted Package name. /usr/lib/pkgconfig/ck-connector.pc Uncommitted pkg-config file. - /var/svc/manifest/system/consolekit.xml Uncommitted SMF - integration - file. + svc:/system/consolekit:default Uncommitted ConsoleKit + FMRI + /var/svc/manifest/system/consolekit.xml Project SMF manifest + Private integration /usr/bin/ck-history Volatile See 4.1.2. /usr/bin/ck-launch-session Volatile See 4.1.2. /usr/bin/ck-list-sessions Volatile See 4.1.2. @@ -470,32 +678,20 @@ /usr/include/ConsoleKit Volatile Header files. /usr/lib/ConsoleKit/run-session.d Volatile See 4.1.4. /etc/ConsoleKit/run-session.d Volatile See 4.1.4. - /etc/ConsoleKit/seats.d/ Volatile Directory for - Seat - configuration - files - /etc/ConsoleKit/seats.d/00-primary.seat Volatile Configuration - for default - seat, DISPLAY - ":0". - /etc/ConsoleKit/displays.d/ Volatile Directory for - display - template - configuration - files - /etc/ConsoleKit/displays.d/Local.display Volatile Configuration - for local - display X11 - command - /etc/ConsoleKit/sessions.d/ Volatile Directory for - session - variables - configuration - files - /etc/ConsoleKit/sessions.d/Local.session Volatile Configuration - for local - display X11 - variables + /etc/ConsoleKit/seats.d/ Volatile See 4.1.10. + /etc/ConsoleKit/seats.d/00-primary.seat Volatile See 4.1.10. + /etc/ConsoleKit/sessions.d/ Volatile See 4.1.11. + /etc/ConsoleKit/sessions.d/Local.session Volatile See 4.1.11. + /etc/ConsoleKit/sessions.d/LocalVNC.session Volatile See 4.1.11. + /etc/ConsoleKit/sessions.d/Headless.session Volatile See 4.1.11. + /etc/ConsoleKit/sessions.d/Remote.session Volatile See 4.1.11. + /etc/ConsoleKit/displays.d/ Volatile See 4.1.12. + /etc/ConsoleKit/displays.d/Local.display Volatile See 4.1.12. + /etc/ConsoleKit/displays.d/LocalVNC.display Volatile See 4.1.12. + /etc/ConsoleKit/displays.d/Headless.display Volatile See 4.1.12. + /etc/ConsoleKit/displays.d/RemoteMachine.display + Volatile See 4.1.12. + /etc/ConsoleKit/displays.d/Sunray.display Volatile See 4.1.12. /etc/dbus-1/system.d/ConsoleKit.conf Volatile D-Bus Integration. [1] --Boundary_(ID_Qtd/SNY8feNtGqgoAMP1Sw)-- From Joerg.Barfurth@sun.com Fri Aug 14 00:27:36 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7E7RZEA008039 for ; Fri, 14 Aug 2009 00:27:35 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n7E7RSW8005514 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Fri, 14 Aug 2009 08:27:34 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOC00K0BVDXLF00@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 14 Aug 2009 01:27:33 -0600 (MDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOC0092XVDWCV60@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 14 Aug 2009 01:27:32 -0600 (MDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-1-fe1.eu.sun.com [192.18.6.7] (may be forged)) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n7E7RVZi010708 for ; Fri, 14 Aug 2009 07:27:31 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KOC00F00V7PJS00@fe-emea-10.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 14 Aug 2009 08:27:15 +0100 (BST) Received: from [10.16.66.63] ([unknown] [10.16.66.63]) by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KOC0025DVDFD1B0@fe-emea-10.sun.com>; Fri, 14 Aug 2009 08:27:15 +0100 (BST) Date: Fri, 14 Aug 2009 09:27:15 +0200 From: Joerg Barfurth Subject: Re: ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> Sender: Joerg.Barfurth@sun.com To: Brian Cameron Cc: LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A8511D3.2050609@sun.com> Organization: Sun Microsystem - Desktop MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 8BIT X-PMX-Version: 5.4.1.325704 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.17 (X11/20081014) Status: RO Content-Length: 1365 Brian Cameron schrieb: > + /usr/bin/ck-seat-tool [--add --session-type=SESSION_TYPE > --display-type=DISPLAY_TYPE [--seat-id=SEAT_ID] [variables...] > | --delete --session-id=SESSION_ID] > - How are seat ids chosen if not explicitly specified, for example when using gdmdynamic or for XDMCP sessions? It appears that there is some persistent state associated with seats via seat-ids. Currently this is the case through ck-history, but the display manager may maintain more per-seat state in the future. If seat-ids for dynamic seats are simply assigned using linear numbering, that will cause spurious association of data across unrelated seats. - What are the constraints for the SEAT-ID argument? For the same reason as in the previous item, a client like Sun Ray will want to use seat ids that do reflect their internal notion of client identity. The API documentation says that a seat ID is a DBus object path, but all the sample tool output uses names like 'Seat1' to identify the seat. - Jrg -- Joerg Barfurth phone: +49 40 23646662 / x66662 Software Engineer mailto:joerg.barfurth@sun.com Desktop Technology http://reserv.ireland/twiki/bin/view/Argus/ Thin Client Software http://www.sun.com/software/sunray/ Sun Microsystems GmbH http://www.sun.com/software/javadesktopsystem/ From Halton.Huo@sun.com Sun Aug 16 20:47:43 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7H3lh1Y002294 for ; Sun, 16 Aug 2009 20:47:43 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n7H3lgnk027665 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Sun, 16 Aug 2009 21:47:43 -0600 (MDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOI0010557IWU00@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Sun, 16 Aug 2009 21:47:42 -0600 (MDT) Received: from sineb-mail-2.sun.com ([192.18.19.7]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOI001HR57HS700@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Sun, 16 Aug 2009 21:47:42 -0600 (MDT) Received: from fe-apac-05.sun.com (fe-apac-05.sun.com [192.18.19.176] (may be forged)) by sineb-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7H3lewc025746 for ; Mon, 17 Aug 2009 03:47:40 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KOI00B0055O6H00@mail-apac.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Mon, 17 Aug 2009 11:47:40 +0800 (SGT) Received: from [129.158.217.47] ([unknown] [129.158.217.47]) by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KOI008B557F3690@mail-apac.sun.com>; Mon, 17 Aug 2009 11:47:40 +0800 (SGT) Date: Mon, 17 Aug 2009 11:47:38 +0800 From: Halton Huo Subject: Re: [desktop-discuss] ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <4A8511D3.2050609@sun.com> Sender: Halton.Huo@sun.com To: Joerg Barfurth Cc: Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <1250480858.776.23.camel@hp-dv2000> MIME-version: 1.0 X-Mailer: Evolution 2.26.1.1 Content-type: text/plain; CHARSET=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> <4A8511D3.2050609@sun.com> Status: RO Content-Length: 1867 On Fri, 2009-08-14 at 09:27 +0200, Joerg Barfurth wrote: > Brian Cameron schrieb: > > > + /usr/bin/ck-seat-tool [--add --session-type=SESSION_TYPE > > --display-type=DISPLAY_TYPE [--seat-id=SEAT_ID] [variables...] > > | --delete --session-id=SESSION_ID] > > > > - How are seat ids chosen if not explicitly specified, for example when > using gdmdynamic or for XDMCP sessions? If --seat-id is not given, the console-kit-daemon will start a new seat for this session. The seat-id will be next available seat number. Normally is /org/freedesktop/ConsoleKit/Seat#. > > It appears that there is some persistent state associated with seats via > seat-ids. Currently this is the case through ck-history, but the display > manager may maintain more per-seat state in the future. I do understand what you mean here. ConsoleKit is maintaining seat formation, display manager does not. What more states need in the future? > If seat-ids for dynamic seats are simply assigned using linear numbering, that will > cause spurious association of data across unrelated seats. Yes, it is true. ck-seat-tool offers user feasibility to create sessions rather than static write configuration files. I do not see any issue for the time being. > > - What are the constraints for the SEAT-ID argument? > > For the same reason as in the previous item, a client like Sun Ray will > want to use seat ids that do reflect their internal notion of client > identity. > > The API documentation says that a seat ID is a DBus object path, but all > the sample tool output uses names like 'Seat1' to identify the seat. The SEAT-ID could be full name of a seat object path (/org/freedesktop/ConsoleKit/Seat#) or a short name (Seat#). ck-seat-tool is able to append the prefix "/org/freedesktop/ConsoleKit/" if give the short name. Regards, Halton. From Joerg.Barfurth@sun.com Sun Aug 16 23:54:51 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7H6sova004868 for ; Sun, 16 Aug 2009 23:54:51 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n7H6skrS027905 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Mon, 17 Aug 2009 07:54:50 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOI00M0VDVBUM00@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Mon, 17 Aug 2009 00:54:47 -0600 (MDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOI00HY5DV9QI20@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Mon, 17 Aug 2009 00:54:46 -0600 (MDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-1-fe1.eu.sun.com [192.18.6.7] (may be forged)) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n7H6sjS9010499 for ; Mon, 17 Aug 2009 06:54:45 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KOI00G00DU8RK00@fe-emea-09.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Mon, 17 Aug 2009 07:54:41 +0100 (BST) Received: from [10.16.46.61] ([unknown] [10.16.46.61]) by fe-emea-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KOI00E5TDUYXE70@fe-emea-09.sun.com>; Mon, 17 Aug 2009 07:54:34 +0100 (BST) Date: Mon, 17 Aug 2009 08:54:34 +0200 From: Joerg Barfurth Subject: Re: [desktop-discuss] ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <1250480858.776.23.camel@hp-dv2000> Sender: Joerg.Barfurth@sun.com To: Halton Huo Cc: Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A88FEAA.4010805@sun.com> Organization: Sun Microsystem - Desktop MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=UTF-8 Content-transfer-encoding: 8BIT X-PMX-Version: 5.4.1.325704 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> <4A8511D3.2050609@sun.com> <1250480858.776.23.camel@hp-dv2000> User-Agent: Thunderbird 2.0.0.17 (X11/20081014) Status: RO Content-Length: 2243 Halton Huo schrieb: > On Fri, 2009-08-14 at 09:27 +0200, Joerg Barfurth wrote: >> Brian Cameron schrieb: >> >>> + /usr/bin/ck-seat-tool [--add --session-type=SESSION_TYPE >>> --display-type=DISPLAY_TYPE [--seat-id=SEAT_ID] [variables...] >>> | --delete --session-id=SESSION_ID] >>> >> - How are seat ids chosen if not explicitly specified, for example when >> using gdmdynamic or for XDMCP sessions? > If --seat-id is not given, the console-kit-daemon will start a new seat > for this session. The seat-id will be next available seat number. > Normally is /org/freedesktop/ConsoleKit/Seat#. > So ck-history --seat ... for a dynamic seat will give the merged history of all the transient seats that used that seat-id in the past. :-( >> It appears that there is some persistent state associated with seats via >> seat-ids. Currently this is the case through ck-history, but the display >> manager may maintain more per-seat state in the future. > I do understand what you mean here. ConsoleKit is maintaining seat > formation, display manager does not. What more states need in the > future? > In the gdm case we were discussing the idea of (in the future) storing user choices like the last-used language (to use as initial UI language), and the recent-language (and recent-Keyboard eventually) settings on a per-seat basis. The current approach to share such settings across seats is broken. >> If seat-ids for dynamic seats are simply assigned using linear numbering, that will >> cause spurious association of data across unrelated seats. > Yes, it is true. > ck-seat-tool offers user feasibility to create sessions rather than > static write configuration files. I do not see any issue for the time > being. > Except as described above. If gdm uses the per-seat history to sort/populate the face browser, that list will be relatively random for dynamic seats. - Jörg -- Joerg Barfurth phone: +49 40 23646662 / x66662 Software Engineer mailto:joerg.barfurth@sun.com Desktop Technology http://reserv.ireland/twiki/bin/view/Argus/ Thin Client Software http://www.sun.com/software/sunray/ Sun Microsystems GmbH http://www.sun.com/software/javadesktopsystem/ From Halton.Huo@sun.com Mon Aug 17 07:06:21 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7HE6KWL019804 for ; Mon, 17 Aug 2009 07:06:21 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n7HE6J3l013311 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Mon, 17 Aug 2009 15:06:20 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOI00F0JXUJH700@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Mon, 17 Aug 2009 07:06:19 -0700 (PDT) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOI00KQ2XUHAQE0@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Mon, 17 Aug 2009 07:06:18 -0700 (PDT) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7HE6GWE002429 for ; Mon, 17 Aug 2009 14:06:16 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KOI00500XPI3A00@mail-apac.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Mon, 17 Aug 2009 22:06:16 +0800 (SGT) Received: from [192.168.2.4] ([unknown] [219.236.31.62]) by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KOI00MXNXUBIE80@mail-apac.sun.com>; Mon, 17 Aug 2009 22:06:16 +0800 (SGT) Date: Mon, 17 Aug 2009 22:06:04 +0800 From: Halton Huo Subject: Re: [desktop-discuss] ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <4A88FEAA.4010805@sun.com> Sender: Halton.Huo@sun.com To: Joerg Barfurth Cc: Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A8963CC.6050204@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=UTF-8 Content-transfer-encoding: 8BIT X-PMX-Version: 5.4.1.325704 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> <4A8511D3.2050609@sun.com> <1250480858.776.23.camel@hp-dv2000> <4A88FEAA.4010805@sun.com> User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) Status: RO Content-Length: 2630 Joerg Barfurth 写道: > Halton Huo schrieb: >> On Fri, 2009-08-14 at 09:27 +0200, Joerg Barfurth wrote: >>> Brian Cameron schrieb: >>> >>>> + /usr/bin/ck-seat-tool [--add --session-type=SESSION_TYPE >>>> --display-type=DISPLAY_TYPE [--seat-id=SEAT_ID] >>>> [variables...] >>>> | --delete --session-id=SESSION_ID] >>>> >>> - How are seat ids chosen if not explicitly specified, for example >>> when using gdmdynamic or for XDMCP sessions? >> If --seat-id is not given, the console-kit-daemon will start a new seat >> for this session. The seat-id will be next available seat number. >> Normally is /org/freedesktop/ConsoleKit/Seat#. >> > > So ck-history --seat ... for a dynamic seat will give the merged > history of all the transient seats that used that seat-id in the past. > :-( > >>> It appears that there is some persistent state associated with seats >>> via seat-ids. Currently this is the case through ck-history, but the >>> display manager may maintain more per-seat state in the future. >> I do understand what you mean here. ConsoleKit is maintaining seat >> formation, display manager does not. What more states need in the >> future? >> > > In the gdm case we were discussing the idea of (in the future) storing > user choices like the last-used language (to use as initial UI > language), and the recent-language (and recent-Keyboard eventually) > settings on a per-seat basis. The current approach to share such > settings across seats is broken. Then ConsoleKit can be redesigned as SeatID can be specified as desired. Either in configurations file, or through ck-seat-tool. If SEAT_ID is given and this seat is existing, a new session will be append on that seat. If SEAT_ID is given but this seat is not existing, a new seat with given seat id created, and a new session append on that seat. If SEAT_ID is not given, a new seat with generated seat id (Seat#) will be created, and a new session append on that seat. NOTE, current code does not do like that. We need talk about this idea with community. > >>> If seat-ids for dynamic seats are simply assigned using linear >>> numbering, that will cause spurious association of data across >>> unrelated seats. >> Yes, it is true. ck-seat-tool offers user feasibility to create >> sessions rather than >> static write configuration files. I do not see any issue for the time >> being. >> > > Except as described above. If gdm uses the per-seat history to > sort/populate the face browser, that list will be relatively random > for dynamic seats. Again, this is a enhancement same with above. Thanks, Halton. From Brian.Cameron@sun.com Mon Aug 17 12:57:41 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7HJvfGN006503 for ; Mon, 17 Aug 2009 12:57:41 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n7HJvemD046710 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Mon, 17 Aug 2009 13:57:41 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOJ00C03E447M00@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Mon, 17 Aug 2009 12:57:40 -0700 (PDT) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOJ009XNE44MO90@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Mon, 17 Aug 2009 12:57:40 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7HJvd86016019 for ; Mon, 17 Aug 2009 19:57:39 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KOJ00A00BRG5L00@mail-amer.sun.com> for LSARC-ext@Sun.COM (ORCPT LSARC-ext@Sun.COM); Mon, 17 Aug 2009 13:57:39 -0600 (MDT) Received: from [192.168.1.67] ([unknown] [69.211.121.211]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KOJ00F7ME43QE60@mail-amer.sun.com>; Mon, 17 Aug 2009 13:57:39 -0600 (MDT) Date: Mon, 17 Aug 2009 14:58:03 -0500 From: Brian Cameron Subject: Re: [desktop-discuss] ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <1250133879.8716.19.camel@judo> Sender: Brian.Cameron@sun.com To: Halton Huo Cc: Edward Shu , Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A89B64B.7040103@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> <4A8288C8.1000206@sun.com> <1250133879.8716.19.camel@judo> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090804 Thunderbird/3.0b3 Status: RO Content-Length: 1558 Edward: On 08/12/09 22:24, Halton Huo wrote: > On Wed, 2009-08-12 at 17:18 +0800, Edward Shu wrote: >> What is "session migration" here? Does it mean the session can be >> migrated from >> one VT to another VT? With VT, will ConsoleKit be noticed the session >> switch? >> Session switch may automatically cause the keyboard and mouse migration >> between sessions. Currently in Solaris, graphics session will grab the >> mouse and keyboard input from the text session in the session switch. >> > Leave the session migration question for Brian. The VT framework takes care of making sure that mouse and keyboard input is managed when VT switching takes place. Refer to PSARC 2006/591 and PSARC 2008/515. When you switch to another VT when you have an existing user session running, then the screenlock program is automatically launched so that the VT you just switched away from will be locked. If the user switches back to it, then they need to re-authenticate with the lockscreen program to get back into their session. If the user switches to a VT where there is not an existing user session running, then the user will be presented with the GDM login program. If the user tries to log into a user who already has a session running, then migration is done. GDM will do a chvt() call on the Xserver running the existing session. This switches the current active VT to where the user's session is running. In this case it will also unlock the screensaver since the user doesn't need to re-authenticate after logging in via the GDM greeter. Brian From Brian.Cameron@sun.com Mon Aug 17 23:32:05 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7I6W4iU025953 for ; Mon, 17 Aug 2009 23:32:04 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n7I6Vi2q016996 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Tue, 18 Aug 2009 14:32:03 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOK00F057HEMD00@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Mon, 17 Aug 2009 23:32:02 -0700 (PDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOK00AMO7HDOE30@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Mon, 17 Aug 2009 23:32:01 -0700 (PDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7I6W16Q013839 for ; Tue, 18 Aug 2009 06:32:01 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KOK0090079DDE00@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Tue, 18 Aug 2009 00:32:00 -0600 (MDT) Received: from [192.168.1.67] ([unknown] [69.213.24.197]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KOK005E17H2ELB0@mail-amer.sun.com>; Tue, 18 Aug 2009 00:32:00 -0600 (MDT) Date: Tue, 18 Aug 2009 01:32:12 -0500 From: Brian Cameron Subject: Re: ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> Sender: Brian.Cameron@sun.com To: Brian Cameron Cc: LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A8A4AEC.6050105@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090804 Thunderbird/3.0b3 Status: RO Content-Length: 4945 Thanks to everyone for helping to review the ConsoleKit case. I would like to summarize the issues raised so far. I think all of these issues have been answered and resolved. Please let me know if there are any other remaining issues, or if any of the following items need further clarification. - Darren Moffat suggested that the pam-ck-connector PAM module be delivered. The PAM module will be delivered in the package SUNWconsolekit-pam, so this new package name was added to the Exported Interface table and to section "4.4 packagin & Delivery". I also updated the paragraph about pam_ck_connector in section 4.1.3 as follows: On some Linux systems, the pam_ck_connector is used to ensure that non-graphical logins (e.g. telnet, ssh, etc.) are registered with ConsoleKit. Thus ConsoleKit can be used as a utmp/wtmp replacement since it stores a superset of the information as in the utmp/wtmp database. This PAM module will be delivered in the SUNWconsolekit-pam package, but it will not be referenced in the default /etc/pam.conf(4) file. This way it is available if any users decide to make use of it. - Darren Moffat also suggested that we deliver the /usr/sbin/ck-log-system-start, /usr/sbin/ck-log-system-restart and /usr/sbin/ck-log-system-stop scripts. However, these are intended to be integrated directly into init(1M). Until we have plans to do this, I do not see any value in providing these scripts with the ConsoleKit packages. - Darren Moffat asked why the ck-system-stop script and the ck-system-restart script call "/sbin/init 5" and "/sbin/init 6" instead of "shutdown" as they do on Linux. Rich McAllister said we should use /sbin/init. Refer to the mail log for LSARC 2004/713: http://sac.eng.sun.com/arc/LSARC/2004/713/mail And search for "init 5" or "init 6" In summary he said: > I'd stay away from the reboot and halt commands, these are migrated > from the old SunOS4 compatibility and don't really do everything > you'd want. I'd go for either the SVR4-ish shutdown (not the > /usr/ucb one, even though most people prefer it) or just go > straight to /usr/sbin/init the main difference between "shutdown" > and "init" is that shutdown does a "wall" to notify time sharing > users. Since rebooting/shutting down from the login screen really > only makes sense on a single-user system, there doesn't seem to be > much use for the "wall" So there is no plan to switch to using shutdown unless someone suggests that Rich's recommendation is no longer valid. - Alan Coopersmith had a concern that the CK_SESSION_X11_DISPLAY_DEVICE would not be meaningful to client programs. It was highlighted that this environment variable is only used by the scripts described in section 4.1.4. In other words, the scripts that ConsoleKit runs when a session starts. These environment variables simply pass along the information associated with the session. Since the display device indicates what VT is being used on the console, this could be useful for the session startup script to do special work based on which VT is being used, if desired. - Alan Coopersmith asked why some scripts are installed to /usr/lib and others to /usr/lib/ConsoleKit/scripts. The difference is that the files installs to /usr/lib are libexec programs which would normally be installed to /usr/libexec on Linux. - Alan Coopersmith asked why ConsoleKit looks up the UID and PID of the Xserver process rather than just being informed by GDM. This design prevents the session leader from providing spoofed information. Since the D-Bus OpenSession interface is an unprivileged operation and takes no arguments. When this is used, the entries in the database are filled via doing such probing. The session leader can use the OpenSessionWithParameters and pass in the arguments, and thus avoid ConsoleKit from needing to do such probing. In fact GDM does use OpenSessionWithParameters, but GDM also calls the ck-x11-get-display-device script to figure out what display device is associated with the display and should be passed into OpenSessionWithParameters. When using VT, ck-x11-get-display-device does probe the Xserver to get the VT device name. - Alan Coopersmith asked whether ConsoleKit needs to handle fast reboot and slow reboot. Jedy Wang responded that a separate ARC case is planned for the update of the reboot dialog to take care of this. - Joerg Barfuth suggested that ck-seat-tool allow the user to specify the SeatID to be created when starting a dynamic display. This is desired to ensure that ConsoleKit always maps any saved state to the right device. The project team is currently discussing this option with the upstream maintainers and will add such a feature if it makes sense. Thanks, Brian From Alan.Coopersmith@sun.com Tue Aug 18 06:47:56 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7IDluPm015116 for ; Tue, 18 Aug 2009 06:47:56 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n7IDlqvu027014 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Tue, 18 Aug 2009 14:47:55 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOK00K0NRNSKO00@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Tue, 18 Aug 2009 06:47:52 -0700 (PDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOK00G03RNSLM50@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Tue, 18 Aug 2009 06:47:52 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n7IDlqNc004718 for ; Tue, 18 Aug 2009 06:47:52 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KOK00900RGGQP00@fe-sfbay-09.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Tue, 18 Aug 2009 06:47:52 -0700 (PDT) Received: from [10.6.102.27] ([unknown] [10.6.102.27]) by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KOK004BZRNRCO30@fe-sfbay-09.sun.com>; Tue, 18 Aug 2009 06:47:51 -0700 (PDT) Date: Tue, 18 Aug 2009 06:47:51 -0700 From: Alan Coopersmith Subject: Re: ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <4A8A4AEC.6050105@sun.com> Sender: Alan.Coopersmith@sun.com To: Brian Cameron Cc: Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A8AB107.4050504@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Enigmail-Version: 0.95.1 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> <4A8A4AEC.6050105@sun.com> User-Agent: Thunderbird 2.0.0.21 (X11/20090323) Status: RO Content-Length: 467 Brian Cameron wrote: > - Alan Coopersmith asked why some scripts are installed to /usr/lib and > others to /usr/lib/ConsoleKit/scripts. > > The difference is that the files installs to /usr/lib are libexec > programs which would normally be installed to /usr/libexec on Linux. So will you be putting them all under /usr/lib/ConsoleKit or not? -- -Alan Coopersmith- alan.coopersmith@sun.com Sun Microsystems, Inc. - X Window System Engineering From Halton.Huo@sun.com Tue Aug 18 19:02:04 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7J224gg023974 for ; Tue, 18 Aug 2009 19:02:04 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n7J22432032241 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Tue, 18 Aug 2009 20:02:04 -0600 (MDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOL00I0FPNEIN00@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Tue, 18 Aug 2009 20:02:02 -0600 (MDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOL008M8PNCZME0@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Tue, 18 Aug 2009 20:02:01 -0600 (MDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-1-fe1.eu.sun.com [192.18.6.7] (may be forged)) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n7J21xs2017813 for ; Wed, 19 Aug 2009 02:02:00 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KOL00L00PEM2U00@fe-emea-09.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 19 Aug 2009 03:01:52 +0100 (BST) Received: from [129.158.217.63] ([unknown] [129.158.217.63]) by fe-emea-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KOL00HBKPM9P7D0@fe-emea-09.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 19 Aug 2009 03:01:25 +0100 (BST) Date: Wed, 19 Aug 2009 10:01:18 +0800 From: Halton Huo Subject: Re: [desktop-discuss] ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <4A8A4AEC.6050105@sun.com> Sender: Halton.Huo@sun.com To: Brian Cameron , Joerg Barfurth Cc: LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <1250647278.4464.2.camel@hp-dv2000> MIME-version: 1.0 X-Mailer: Evolution 2.27.90 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> <4A8A4AEC.6050105@sun.com> Status: RO Content-Length: 561 On Tue, 2009-08-18 at 01:32 -0500, Brian Cameron wrote: > - Joerg Barfuth suggested that ck-seat-tool allow the user to > specify the SeatID to be created when starting a dynamic display. > This is desired to ensure that ConsoleKit always maps any saved > state to the right device. > > The project team is currently discussing this option with the > upstream maintainers and will add such a feature if it makes > sense. Community accept this request. http://lists.freedesktop.org/archives/consolekit/2009-August/000025.html Thanks, Halton. From Brian.Cameron@sun.com Tue Aug 18 23:19:48 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7J6JmCN004686 for ; Tue, 18 Aug 2009 23:19:48 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n7J6JkYJ000124 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Wed, 19 Aug 2009 00:19:47 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOM00M091KY6E00@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Tue, 18 Aug 2009 23:19:46 -0700 (PDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOM0087M1KYDXB0@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Tue, 18 Aug 2009 23:19:46 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7J6JjuJ010377 for ; Wed, 19 Aug 2009 06:19:45 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KOM00500184KB00@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 19 Aug 2009 00:19:45 -0600 (MDT) Received: from [192.168.1.67] ([unknown] [69.213.24.197]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KOM00J5C1KX67E0@mail-amer.sun.com>; Wed, 19 Aug 2009 00:19:45 -0600 (MDT) Date: Wed, 19 Aug 2009 01:20:11 -0500 From: Brian Cameron Subject: Re: ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <4A8AB107.4050504@sun.com> Sender: Brian.Cameron@sun.com To: Alan Coopersmith Cc: Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A8B999B.8040601@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> <4A8A4AEC.6050105@sun.com> <4A8AB107.4050504@sun.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090804 Thunderbird/3.0b3 Status: RO Content-Length: 805 Alan: >> - Alan Coopersmith asked why some scripts are installed to /usr/lib and >> others to /usr/lib/ConsoleKit/scripts. >> >> The difference is that the files installs to /usr/lib are libexec >> programs which would normally be installed to /usr/libexec on Linux. > > So will you be putting them all under /usr/lib/ConsoleKit or not? Currently the ConsoleKit pkgconfig file does not expose the libexecdir that ConsoleKit is configured with, so other modules (such as GDM) can't easily figure out that they are installed to a non-standard directory. So, changing this would require a fair bit of work to fix not only ConsoleKit, but to also fix all other modules which use its libexec programs. Therefore, I do not plan to make this change unless it would otherwise cause a TCR/TCA. Brian From Alan.Coopersmith@sun.com Wed Aug 19 07:15:06 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7JEF5OA026611 for ; Wed, 19 Aug 2009 07:15:05 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n7JEF4pg035312 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Wed, 19 Aug 2009 08:15:05 -0600 (MDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOM0041JNL4LL00@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 19 Aug 2009 08:15:04 -0600 (MDT) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOM007SPNL3C7C0@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 19 Aug 2009 08:15:03 -0600 (MDT) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n7JEF3KT007640 for ; Wed, 19 Aug 2009 07:15:03 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KOM00100NCYO600@fe-sfbay-10.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 19 Aug 2009 07:15:03 -0700 (PDT) Received: from [129.145.155.53] ([unknown] [129.145.155.53]) by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KOM00I0HNL3VGC0@fe-sfbay-10.sun.com>; Wed, 19 Aug 2009 07:15:03 -0700 (PDT) Date: Wed, 19 Aug 2009 07:15:03 -0700 From: Alan Coopersmith Subject: Re: ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <4A8B999B.8040601@sun.com> Sender: Alan.Coopersmith@sun.com To: Brian Cameron Cc: Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A8C08E7.7000809@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Enigmail-Version: 0.95.1 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> <4A8A4AEC.6050105@sun.com> <4A8AB107.4050504@sun.com> <4A8B999B.8040601@sun.com> User-Agent: Thunderbird 2.0.0.21 (X11/20090323) Status: RO Content-Length: 957 Brian Cameron wrote: > > Alan: > >>> - Alan Coopersmith asked why some scripts are installed to /usr/lib and >>> others to /usr/lib/ConsoleKit/scripts. >>> >>> The difference is that the files installs to /usr/lib are libexec >>> programs which would normally be installed to /usr/libexec on Linux. >> >> So will you be putting them all under /usr/lib/ConsoleKit or not? > > Currently the ConsoleKit pkgconfig file does not expose the libexecdir > that ConsoleKit is configured with, so other modules (such as GDM) can't > easily figure out that they are installed to a non-standard directory. So how is it finding them when they're not installed under libexec? > Therefore, I do not plan to make this change unless it would otherwise > cause a TCR/TCA. I don't think it's worth a TCR, would just be nicer to be consistent. -- -Alan Coopersmith- alan.coopersmith@sun.com Sun Microsystems, Inc. - X Window System Engineering From Brian.Cameron@sun.com Wed Aug 19 14:50:02 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7JLo24A028405 for ; Wed, 19 Aug 2009 14:50:02 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n7JLo1A4000851 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Wed, 19 Aug 2009 14:50:02 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KON00L0H8ND1700@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 19 Aug 2009 14:50:01 -0700 (PDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KON00IEX8NCEAF0@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 19 Aug 2009 14:50:00 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7JLnxeB021451 for ; Wed, 19 Aug 2009 21:49:59 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KON00A008HIOJ00@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 19 Aug 2009 15:49:59 -0600 (MDT) Received: from [192.168.1.67] ([unknown] [69.213.24.197]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KON007YE8NASI70@mail-amer.sun.com>; Wed, 19 Aug 2009 15:49:59 -0600 (MDT) Date: Wed, 19 Aug 2009 16:50:24 -0500 From: Brian Cameron Subject: Re: ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <4A8C08E7.7000809@sun.com> Sender: Brian.Cameron@sun.com To: Alan Coopersmith Cc: Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A8C73A0.8090603@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200908112120.n7BLKNwO025074@sac.sfbay.sun.com> <4A8A4AEC.6050105@sun.com> <4A8AB107.4050504@sun.com> <4A8B999B.8040601@sun.com> <4A8C08E7.7000809@sun.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090804 Thunderbird/3.0b3 Status: RO Content-Length: 1712 Alan: >>>> - Alan Coopersmith asked why some scripts are installed to /usr/lib and >>>> others to /usr/lib/ConsoleKit/scripts. >>>> >>>> The difference is that the files installs to /usr/lib are libexec >>>> programs which would normally be installed to /usr/libexec on Linux. >>> >>> So will you be putting them all under /usr/lib/ConsoleKit or not? >> >> Currently the ConsoleKit pkgconfig file does not expose the libexecdir >> that ConsoleKit is configured with, so other modules (such as GDM) can't >> easily figure out that they are installed to a non-standard directory. > > So how is it finding them when they're not installed under libexec? GDM looks just looks in the libexec directory that it is configured to use. Since both ConsoleKit and GDM configure libexec to be /usr/lib on Solaris, they both work fine. So, to make it work with a different directory, I'd either need to configure GDM to also use /usr/lib/ConsoleKit as its libexec directory, or fix the ConsoleKit pc file to expose what libexec directory it is using and then fix GDM and any other modules which need to access ConsoleKit's libexec files to lookup the directory from the ConsoleKit pc file and use that instead. Not a huge amount of work, though it tends to be slow-going getting such changes upstream. >> Therefore, I do not plan to make this change unless it would otherwise >> cause a TCR/TCA. > > I don't think it's worth a TCR, would just be nicer to be consistent. I do agree, and will work to address this issue at some point. If you would like to file a bug against ConsoleKit so I do not forget, that would be helpful. But I think we can treat this as a bug, since it is not worth a TCR. Brian From Brian.Cameron@sun.com Wed Aug 19 17:19:56 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7K0JtOE011418 for ; Wed, 19 Aug 2009 17:19:55 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n7K0Jqsh014877 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Thu, 20 Aug 2009 01:19:54 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KON00I03FL6TW00@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.Com); Wed, 19 Aug 2009 17:19:54 -0700 (PDT) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KON00FW1FL5DP40@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.Com); Wed, 19 Aug 2009 17:19:53 -0700 (PDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7K0Jrro026561 for ; Thu, 20 Aug 2009 00:19:53 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KON00L00FGJR700@mail-amer.sun.com> for LSARC-ext@Sun.Com (ORCPT LSARC-ext@Sun.Com); Wed, 19 Aug 2009 18:19:53 -0600 (MDT) Received: from [192.168.1.67] ([unknown] [69.213.24.197]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KON00G86FL4OQ20@mail-amer.sun.com> for LSARC-ext@Sun.Com (ORCPT LSARC-ext@Sun.Com); Wed, 19 Aug 2009 18:19:53 -0600 (MDT) Date: Wed, 19 Aug 2009 19:20:18 -0500 From: Brian Cameron Subject: Re: ConsoleKit [LSARC/2009/432 OnePager] Sender: Brian.Cameron@sun.com To: LSARC-ext@sun.com Cc: Desktop Discuss Message-id: <4A8C96C2.4000305@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090804 Thunderbird/3.0b3 Status: RO Content-Length: 5811 This case is set to time-out tomorrow as a FastTrack. If there are no issues raised, then it will be approved as a fasttrack. If people think there are any remaining issues that require further discussion, then I have made arrangements for this case to be converted to a full-case and we can have the inception review next Tuesday. Here is an update of the issues raised and the proposed solutions. This is updated to reflect the discussion since I last sent out a similar update on the 17th. Assuming the case closes tomorrow, then I will update the case materials with the following proposed changes before closing it (if I haven't already). - Darren Moffat suggested that the pam-ck-connector PAM module be delivered. The PAM module will be delivered in the package SUNWconsolekit-pam, so this new package name was added to the Exported Interface table and to section "4.4 packagin & Delivery". I also updated the paragraph about pam_ck_connector in section 4.1.3 as follows: On some Linux systems, the pam_ck_connector is used to ensure that non-graphical logins (e.g. telnet, ssh, etc.) are registered with ConsoleKit. Thus ConsoleKit can be used as a utmp/wtmp replacement since it stores a superset of the information as in the utmp/wtmp database. This PAM module will be delivered in the SUNWconsolekit-pam package, but it will not be referenced in the default /etc/pam.conf(4) file. This way it is available if any users decide to make use of it. - Darren Moffat also suggested that we deliver the /usr/sbin/ck-log-system-start, /usr/sbin/ck-log-system-restart and /usr/sbin/ck-log-system-stop scripts. However, these are intended to be integrated directly into init(1M). Until we have plans to do this, I do not see any value in providing these scripts with the ConsoleKit packages. - Darren Moffat asked why the ck-system-stop script and the ck-system-restart script call "/sbin/init 5" and "/sbin/init 6" instead of "shutdown" as they do on Linux. Rich McAllister said we should use /sbin/init. Refer to the mail log for LSARC 2004/713: http://sac.eng.sun.com/arc/LSARC/2004/713/mail And search for "init 5" or "init 6" In summary he said: > I'd stay away from the reboot and halt commands, these are migrated > from the old SunOS4 compatibility and don't really do everything > you'd want. I'd go for either the SVR4-ish shutdown (not the > /usr/ucb one, even though most people prefer it) or just go > straight to /usr/sbin/init the main difference between "shutdown" > and "init" is that shutdown does a "wall" to notify time sharing > users. Since rebooting/shutting down from the login screen really > only makes sense on a single-user system, there doesn't seem to be > much use for the "wall" So there is no plan to switch to using shutdown unless someone suggests that Rich's recommendation is no longer valid. - Alan Coopersmith had a concern that the CK_SESSION_X11_DISPLAY_DEVICE would not be meaningful to client programs. It was highlighted that this environment variable is only used by the scripts described in section 4.1.4. In other words, the scripts that ConsoleKit runs when a session starts. These environment variables simply pass along the information associated with the session. Since the display device indicates what VT is being used on the console, this could be useful for the session startup script to do special work based on which VT is being used, if desired. - Alan Coopersmith asked why some scripts are installed to /usr/lib and others to /usr/lib/ConsoleKit/scripts. The difference is that the files installs to /usr/lib are libexec programs which would normally be installed to /usr/libexec on Linux. This issue will be treated as a bug, and not an issue that needs to be addressed before initial integration. - Alan Coopersmith asked why ConsoleKit looks up the UID and PID of the Xserver process rather than just being informed by GDM. This design prevents the session leader from providing spoofed information. Since the D-Bus OpenSession interface is an unprivileged operation and takes no arguments. When this is used, the entries in the database are filled via doing such probing. The session leader can use the OpenSessionWithParameters and pass in the arguments, and thus avoid ConsoleKit from needing to do such probing. In fact GDM does use OpenSessionWithParameters, but GDM also calls the ck-x11-get-display-device script to figure out what display device is associated with the display and should be passed into OpenSessionWithParameters. When using VT, ck-x11-get-display-device does probe the Xserver to get the VT device name. - Alan Coopersmith asked whether ConsoleKit needs to handle fast reboot and slow reboot. Jedy Wang responded that a separate ARC case is planned for the update of the reboot dialog to take care of this. - Joerg Barfurth suggested that ck-seat-tool allow the user to specify the SeatID to be created when starting a dynamic display. This is desired to ensure that ConsoleKit always maps any saved state to the right device. The project team has verified that the upstream community finds adding the following arguments acceptable to support this: + If --seat-id=SEAT_ID is given and this seat is existing, a new session will be append on that seat. + If --seat-id=SEAT_ID is given but this seat is not existing, a new seat with given seat id created, and a new session append on that seat. + If --seat-id=SEAT_ID is not given, a new seat with generated seat id (Seat#) will be created, and a new session append on that seat. Thanks, Brian From Brian.Cameron@sun.com Fri Aug 21 11:32:40 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7LIWd7j008241 for ; Fri, 21 Aug 2009 11:32:40 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n7LIWSOE015438 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Sat, 22 Aug 2009 02:32:38 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOQ00I0XOUCVQ00@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 21 Aug 2009 12:32:36 -0600 (MDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOQ00ADAOUBE950@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 21 Aug 2009 12:32:35 -0600 (MDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7LIWZY7010148 for ; Fri, 21 Aug 2009 18:32:35 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KOQ00300O9V1100@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 21 Aug 2009 12:32:35 -0600 (MDT) Received: from [129.153.250.167] ([unknown] [129.153.250.167]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KOQ002Y8OUB9640@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 21 Aug 2009 12:32:35 -0600 (MDT) Date: Fri, 21 Aug 2009 13:33:01 -0500 From: Brian Cameron Subject: Re: ConsoleKit [LSARC/2009/432 OnePager] In-reply-to: <4A8C96C2.4000305@sun.com> Sender: Brian.Cameron@sun.com To: Brian Cameron Cc: LSARC-ext@sun.com, Desktop Discuss Message-id: <4A8EE85D.3010201@sun.com> MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_gECupZq8sGOcD/hOH0WR2g)" X-PMX-Version: 5.4.1.325704 References: <4A8C96C2.4000305@sun.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090804 Thunderbird/3.0b3 Status: RO Content-Length: 19149 This is a multi-part message in MIME format. --Boundary_(ID_gECupZq8sGOcD/hOH0WR2g) Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT The timeout for this case has passed, and no further unresolved issues were raised. I have marked the case as "closed approved" I have attached a diff file which shows all the differences to the onepager since it was first submitted, which reflects the discussion and agreements made in this review. Brian --Boundary_(ID_gECupZq8sGOcD/hOH0WR2g) Content-type: text/plain; name=ck.diff Content-transfer-encoding: 7BIT Content-disposition: attachment; filename=ck.diff --- onepager-consolekit-old.txt 2009-08-21 13:29:01.784231000 -0500 +++ onepager-consolekit.txt 2009-08-21 13:28:06.140367000 -0500 @@ -68,7 +68,7 @@ hardware (usually a keyboard and mouse). Other process communicate with ConsoleKit via D-Bus. - One session leader process is responsible for asking ConsoleKit to open + One session leader process is responsible for asking ConsoleKit to open a new session. In the typical case, the session leader would be a ConsoleKit enabled display manager, such as GDM. This leader makes a connection to the D-Bus system bus and asks ConsoleKit to open a @@ -80,13 +80,6 @@ child processes. The environment variable contains the UUID used to tie processes to a session. - Note that the XDG_SESSION_COOKIE variable is only meaningful to help - manage session switching and migration, which currently only works - with graphical VT sessions running on the console. Although ConsoleKit - will assign the variable for all sessions, it is ignored if the session - does not support migration via ConsoleKit. Note Sun Ray uses its own - mechanisms for user switching, and is not affected by ConsoleKit. - At this point the session will be registered with ConsoleKit and a particular set of information about the session will be stored along with it. @@ -106,10 +99,9 @@ non-graphical logins (e.g. telnet, ssh, etc.) are registered with ConsoleKit. Thus ConsoleKit can be used as a utmp/wtmp replacement since it stores a superset of the information as in the utmp/wtmp - database. However, this is not an appropriate use of PAM and there are - no plans to support this feature on Solaris since there is no - immediate need to replace utmp/wtmp at this point in time. Instead, - GDM will make use of ConsoleKit to manage its displays. + database. This PAM module will be delivered in the SUNWconsolekit-pam + package, but it will not be referenced in the default /etc/pam.conf(4) + file. This way it is available if any users decide to make use of it. ConsoleKit source code contains the programs /usr/sbin/ck-log-system-start, /usr/sbin/ck-log-system-restart, and @@ -125,6 +117,20 @@ Comments (lines beginning with "#" are comments added to explain the purpose of each line: + Note that the XDG_SESSION_COOKIE variable is only meaningful to help + manage session switching and migration, which currently only works + with graphical VT sessions running on the console. Although ConsoleKit + will assign the variable for all sessions, it is ignored if the session + does not support migration via ConsoleKit. Note Sun Ray uses its own + mechanisms for user switching, and is not affected by ConsoleKit. + + Likewise, other parts of the ConsoleKit framework are designed to only + be useful in environments that support VT switching. For example, the + /usr/lib/ck-get-x11-server-pid program will not work if the X server + is running in a different zone/label as the client, as in a Trusted + Extensions system. However, this is not a problem since this script + is only used when supporting VT switching. + 4.1.1 Detail About ConsoleKit Database # Seat configuration section. @@ -170,7 +176,9 @@ # Remote hostname if a remote connection, e.g. XDMCP. remote_host_name= - # Boolean. Set to "true" if the active session, "false otherwise" + # Boolean. Set to "true" if the session is active, "false otherwise" + # For example, useful to keep track of which VT session is the active + # one. is_active=false # Boolean. Set to "true" if a local session, "false" if remote. @@ -196,7 +204,7 @@ service_name=:1.203 4.1.2 Detail About ConsoleKit Program And Library Interfaces - + + /usr/sbin/console-kit-daemon [--debug] [--no-daemon] [--timed-exit] The main consoleKit daemon. Supports --debug, --no-daemon, and @@ -223,14 +231,14 @@ This would be useful if a user wanted to start their own session via a startx script and have it registered with ConsoleKit, for example. - + /usr/bin/ck-list-sessions [--format=VAR1,VAR2...] + + /usr/bin/ck-list-sessions [--all] [--format=VAR1,VAR2...] Program that displays information from the ConsoleKit database about - active sessions on the system. It returns information about each - ConsoleKit session. Users can specify what properties to show via - --format arguments. + open sessions or all exsiting (--all) sessions on the system. It + returns information about each ConsoleKit session. Users can + specify what properties to show via --format arguments. - Example 1: output for a login single session without --format follows: + Example 1: output for a login single session without --format: SessionSeat1Local: unix-user = '50' @@ -267,6 +275,15 @@ the main ConsoleKit daemon, which is normally root. Otherwise the request is ignored. + Regarding how the --seat-id argument works: + + If --seat-id=SEAT_ID is given and this seat is existing, a new + session will be append on that seat. + + If --seat-id=SEAT_ID is given but this seat is not existing, a new + seat with given seat id created, and a new session append on that + seat. + + If --seat-id=SEAT_ID is not given, a new seat with generated seat + id (Seat#) will be created, and a new session append on that seat. + Currently this program is added by a Solaris-specific patch to support the gdmdynamic program, needed for backwards compatibility. The Sun GNOME team is working with the external community to @@ -443,6 +460,204 @@ ConsoleKit includes SMF integration files to start and stop the /usr/sbin/console-kit-daemon program as a service. + 4.1.10 Detail About Seat configuration file + + ConsoleKit load static seat configuration files from + /etc/ConsoleKit/seats.d. One .seat file stands for one static + configured seat to start. + + By default, there is one .seat file available: 00-primary.seat. + Administrators could put customized .seat files. + + Following are explanation for each key of 00-primary.seat + + # Seat Entry section + [Seat Entry] + + # Version information + Version=1.0 + + # Name of this seat + Name=Primary seat + + # Description of this seat + Description=start one static local display at :0 + + # Indicate whether to create this seat or not. If it is set true, + # then CK will not create this seat. Default value is false. + Hidden=false + + # Indicate input/output devices including keyboard-pointer-video + # card-monitor-sound-usb devices, + # This key is not used now, it might need be divided into several + # keys in the future: + # Pointer= + # Monitor= + # VideoCard= + # Monitor= + # UsbHub= + Devices= + + # List of sessions to start on the seat, separated by ';' + # Each session is defined in sessions.d/ + Sessions=Local; + + 4.1.11 Detail About Session configuration file + + ConsoleKit load session configuration files from + /etc/ConsoleKit/sessions.d. + + By default, there are four .session files available: Local.session, + LocalVNC.session, Headless.session and Remote.session. + Administrators could put customized .session files. + + Following are explanation for each key of Local.session + + # Session Entry section + [Session Entry] + + # Indicate whether to create this session or not. If it is set true, + # then CK will not create this session. Default value is false. + Hidden=false + + # Name of this session + Name=Local + + # Type of this session. Default is LoginWindow. + Type=LoginWindow + + # Description of this session + Description=Local Login Screen + + # Display Template of this session, it is defined in displays.d/ + DisplayTemplate=Local + + # Session variables section + # They are used to override corresponding parameters of Exec defined in + # displays.d/Loal.display + [Local] + + # Override $diplay to :0 + display=:0 + + # Override $vt to /dev/vt/7 + # Again, graphical VT sessions will be added in build 124. + vt=/dev/vt/7 + + 4.1.12 Detail About Display Template configuration file + + ConsoleKit load display template configuration files from + /etc/ConsoleKit/displays.d. + + By default, there are five .display files available: Local.display, + LocalVNC.display, Headless.display Remote.display and Sunray.display. + + Sunray.display should be removed when SRSS ship this file itself + in the future. + + Administrators could put customized .display files. + + Following are explanation for each key of Local.display + + # Display Entry section + [Display] + + # Display type + Type=X11 + + # X11 section + [X11] + + # Command to start X11. + # + # Parameters with prefix dollar ('$') would be overridden at run time. + # ConsoleKit will override them either by variables defined in + # session configuration files, or by variables passed to + # "ck-seat-tool --add". + # + # If any parameter is not overridden, then Display Manager will + # decide the value. + # + # For example, $display and $vt are not given, GDM will choose next + # available display number and VT, then start Xorg process. + Exec=/usr/X11/bin/Xorg $display -br -verbose \ + -auth $auth -nolisten tcp $vt + + 4.1.13 Detail About How to start multiple sessions on single seat + + For example, users want to start two local displays, + one is :0 on vt7 and another one is :1 on vt8. + + Refer to 4.1.10, 4.1.11 and 4.1.12, users can edit 00-primary.seat + file as following: + + [Seat Entry] + Version=1.0 + Name=Primary seat + Description=start two static local displays, one is :0 on vt7 \ + and another one is :1 on vt8 + Hidden=false + Devices= + Sessions=Local;Local2; + + Besides original Local.session, we put another similar Local2.session + under /etc/ConsoleKit/sessions.d/ + [Session Entry] + Name=Local + Type=LoginWindow + Description=Local Login Screen + DisplayTemplate=Local + + [Local] + display=:1 + vt=/dev/vt/8 + + Alternatively, users can do with 'ck-seat-tool' at run time without + modifying configuration files. + + $ck-seat-tool --add --session-type=LoginWindow \ + --display-type=Local --seat-id=Seat1 \ + display=:1,vt=/dev/vt/8 + + 4.1.14 Detail About How to start multiple seats + + For example, users want to start two seats, one seat start local + session :0 on vt7 and another seat start VNC session :64. + + Refer to 4.1.10, 4.1.11 and 4.1.12, users can put another file + 01-vnc.seat under /etc/ConsoleKit/seats.d/ as following: + + [Seat Entry] + Version=1.0 + Name=VNC seat + Description=start one VNC display on :64 + Hidden=false + Devices= + Sessions=LocalVNC; + + The LocalVNC.session is as following: + [Session Entry] + Name=LocalVNC + Type=LoginWindow + Description=Connect to local VNC server running on same machine + DisplayTemplate=LocalVNC + + [LocalVNC] + display=:64 + + The LocalVNC.display is as following: + [Display] + Type=X11 + + [X11] + Exec=/usr/X11/bin/Xvnc $display -auth $auth -query localhost + + Alternatively, users can do with 'ck-seat-tool' at run time without + modifying configuration files. + + $ck-seat-tool --add --session-type=LoginWindow \ + --display-type=LocalVNC display=:64 + 4.2. Interfaces: Exported Interfaces Stability Comments @@ -450,11 +665,13 @@ SUNWconsolekit Uncommitted Package name. SUNWconsolekit-devel Uncommitted Package name. SUNWconsolekit-root Uncommitted Package name. + SUNWconsolekit-pam Uncommitted Package name. /usr/lib/pkgconfig/ck-connector.pc Uncommitted pkg-config file. - /var/svc/manifest/system/consolekit.xml Uncommitted SMF - integration - file. + svc:/system/consolekit:default Uncommitted ConsoleKit + FMRI + /var/svc/manifest/system/consolekit.xml Project SMF manifest + Private integration /usr/bin/ck-history Volatile See 4.1.2. /usr/bin/ck-launch-session Volatile See 4.1.2. /usr/bin/ck-list-sessions Volatile See 4.1.2. @@ -470,32 +687,20 @@ /usr/include/ConsoleKit Volatile Header files. /usr/lib/ConsoleKit/run-session.d Volatile See 4.1.4. /etc/ConsoleKit/run-session.d Volatile See 4.1.4. - /etc/ConsoleKit/seats.d/ Volatile Directory for - Seat - configuration - files - /etc/ConsoleKit/seats.d/00-primary.seat Volatile Configuration - for default - seat, DISPLAY - ":0". - /etc/ConsoleKit/displays.d/ Volatile Directory for - display - template - configuration - files - /etc/ConsoleKit/displays.d/Local.display Volatile Configuration - for local - display X11 - command - /etc/ConsoleKit/sessions.d/ Volatile Directory for - session - variables - configuration - files - /etc/ConsoleKit/sessions.d/Local.session Volatile Configuration - for local - display X11 - variables + /etc/ConsoleKit/seats.d/ Volatile See 4.1.10. + /etc/ConsoleKit/seats.d/00-primary.seat Volatile See 4.1.10. + /etc/ConsoleKit/sessions.d/ Volatile See 4.1.11. + /etc/ConsoleKit/sessions.d/Local.session Volatile See 4.1.11. + /etc/ConsoleKit/sessions.d/LocalVNC.session Volatile See 4.1.11. + /etc/ConsoleKit/sessions.d/Headless.session Volatile See 4.1.11. + /etc/ConsoleKit/sessions.d/Remote.session Volatile See 4.1.11. + /etc/ConsoleKit/displays.d/ Volatile See 4.1.12. + /etc/ConsoleKit/displays.d/Local.display Volatile See 4.1.12. + /etc/ConsoleKit/displays.d/LocalVNC.display Volatile See 4.1.12. + /etc/ConsoleKit/displays.d/Headless.display Volatile See 4.1.12. + /etc/ConsoleKit/displays.d/RemoteMachine.display + Volatile See 4.1.12. + /etc/ConsoleKit/displays.d/Sunray.display Volatile See 4.1.12. /etc/dbus-1/system.d/ConsoleKit.conf Volatile D-Bus Integration. [1] @@ -538,8 +743,8 @@ 4.4. Packaging & Delivery: - SUNWconsolekit, SUNWconsolekit-root, SUNWconsolekit-devel - packages - for ConsoleKit. + SUNWconsolekit, SUNWconsolekit-root, SUNWconsolekit-devel, + SUNWconsolekit-pam - packages for ConsoleKit. 4.5. Dependencies: @@ -563,9 +768,12 @@ 5. Reference Documents: - [1] The ConsoleKit.html file is also included with the case materials + [1] The ./ConsoleKit.conf file is also included with the case materials for reference. + The ConsoleKit documentation from the ConsoleKit website is also + included with the case materials as the file ./ConsoleKit.html + ConsoleKit Website: http://www.freedesktop.org/wiki/Software/ConsoleKit --Boundary_(ID_gECupZq8sGOcD/hOH0WR2g)--