Bug 855160 - Spurious pam_systemd(sudi:session) message about non-existing environment entry XDG_RUNTIME_DIR
Summary: Spurious pam_systemd(sudi:session) message about non-existing environment ent...
Status: RESOLVED FIXED
Alias: None
Product: openSUSE 13.1
Classification: openSUSE
Component: Security (show other bugs)
Version: Final
Hardware: x86-64 openSUSE 13.1
: P5 - None : Minor (vote)
Target Milestone: ---
Assignee: systemd maintainers
QA Contact: E-mail List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-12-12 12:32 UTC by Claude Diderich
Modified: 2017-01-17 12:23 UTC (History)
6 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
sudo -V (3.78 KB, text/plain)
2013-12-12 12:32 UTC, Claude Diderich
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Claude Diderich 2013-12-12 12:32:39 UTC
Created attachment 571563 [details]
sudo -V

User-Agent:       Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0

When executing the command 'sudo zypper ps' or any other command related to sudo and su, the following message is logged through syslog:

[date] [hostname] sudo: pam_systemd(sudo:session): pam_putenv: delete non-existing entry; XDG_RUNTIME_DIR

The command is executed correctly.

Reproducible: Always

Steps to Reproduce:
1. sudo zypper ps
2.
3.
Actual Results:  
Message
[date] [hostname] sudo: pam_systemd(sudo:session): pam_putenv: delete non-existing entry; XDG_RUNTIME_DIR
is logged to syslog

Expected Results:  
No message is logged to syslog

Kernel: Linux 3.11.6-4-default #1 SMP
Comment 1 Marcus Meissner 2013-12-12 15:31:48 UTC
-> systemd bug
Comment 2 Pawel Wieczorkiewicz 2013-12-13 16:03:02 UTC
This problem is introduced with a patch 1012-pam_systemd_do_override_XDG_RUNTIME_DIR_of_the_original_user.patch 

I think best would be to add a check for both env and pam_env to check with getenv() and pam_getenv() whether variable XDG_RUNTIME_DIR is not empty and then remove.

I mean in the following part of the patch:

+        } else {
+                (void) unsetenv("XDG_RUNTIME_DIR");
+                r = pam_putenv(handle, "XDG_RUNTIME_DIR");
+                if (r != PAM_SUCCESS && r != PAM_BAD_ITEM) {
+                         pam_syslog(handle, LOG_ERR, "Failed to unset runtime dir.");
+                }

Upstream is a bit different in this regard and does not contain the above.
Comment 3 Dr. Werner Fink 2013-12-19 13:12:44 UTC
The problem is if XDG_RUNTIME_DIR is set then the upstream code does exactly nothing which leads to the fact that if xdg-su is called for e.g. pulseaudio then there will be a root owned directory below $XDG_RUNTIME_DIR which is the user and not root.  If only pam_putenv() is used to remove the XDG_RUNTIME_DIR variable nothing happens and this is the reason *why* I have added unsetenv() to make sure that root does *never* use the users $XDG_RUNTIME_DIR
Comment 4 Claude Diderich 2013-12-19 15:58:04 UTC
To be consistent with the requirement Werner Finks describes and to avoid the error message, shouldn't the code be ammended as follows?

-                (void) unsetenv("XDG_RUNTIME_DIR");

+                if(getenv("XDG_RUNTIME_DIR") != NULL) {
+                    (void) unsetenv("XDG_RUNTIME_DIR");
+                }
Comment 5 Pawel Wieczorkiewicz 2013-12-19 16:23:14 UTC
(In reply to comment #4)
> To be consistent with the requirement Werner Finks describes and to avoid the
> error message, shouldn't the code be ammended as follows?
> 
> -                (void) unsetenv("XDG_RUNTIME_DIR");
> 
> +                if(getenv("XDG_RUNTIME_DIR") != NULL) {
> +                    (void) unsetenv("XDG_RUNTIME_DIR");
> +                }

Yea, this is basically what I wrote, but since warning comes from pam_putenv(), it should be also covered with a similar check.
Comment 7 Swamp Workflow Management 2015-05-06 14:05:11 UTC
openSUSE-RU-2015:0823-1: An update that has two recommended fixes can now be installed.

Category: recommended (moderate)
Bug References: 855160,922536
CVE References: 
Sources used:
openSUSE 13.1 (src):    systemd-208-35.1, systemd-mini-208-35.1, systemd-rpm-macros-2-35.1
Comment 8 Thomas Blume 2017-01-17 12:23:13 UTC
closing as fixed