Beyond Linux® From Scratch (systemd edition) - Version 8.4

Chapter 4. Security

ConsoleKit2-1.2.1

Introduction to ConsoleKit

The ConsoleKit package is a framework for keeping track of the various users, sessions, and seats present on a system. It provides a mechanism for software to react to changes of any of these items or of any of the metadata associated with them.

This package is known to build and work properly using an LFS-8.4 platform.

Package Information

ConsoleKit Dependencies

Required

dbus-glib-0.110 and Xorg Libraries

Recommended

Linux-PAM-1.3.0, Polkit-0.115, and pm-utils-1.4.1 (run-time dependency to allow ConsoleKit2 to put the system in “Suspend” or “Hibernation” mode)

[Warning]

Warning

If you intend NOT to install polkit, you will need to manually edit the ConsoleKit.conf file to lock down the service. Failure to do so may be a huge SECURITY HOLE.

Optional

xmlto-0.0.28

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/consolekit

Installation of ConsoleKit

Install ConsoleKit by running the following commands: 

./configure --prefix=/usr        \
            --sysconfdir=/etc    \
            --localstatedir=/var \
            --enable-udev-acl    \
            --enable-pam-module  \
            --enable-polkit      \
            --with-xinitrc-dir=/etc/X11/app-defaults/xinitrc.d \
            --docdir=/usr/share/doc/ConsoleKit-1.2.1           \
            --with-systemdsystemunitdir=no                     &&
make

This package does not come with a test suite.

Now, as the root user: 

make install &&

mv -v /etc/X11/app-defaults/xinitrc.d/90-consolekit{,.sh}

Command Explanations

--enable-udev-acl: This switch enables building of the udev-acl tool, which is used to allow normal users to access device nodes normally only accessible to root.

--enable-pam-module: This switch enables building of the ConsoleKit PAM module which is needed for ConsoleKit to work correctly with PAM. Remove if Linux PAM is NOT installed.

--enable-polkit: Enable PolicyKit support.

--with-xinitrc-dir=/etc/X11/app-defaults/xinitrc.d: Fix the location of the 90-consolekit.sh script. Notice that the script has been renamed after installation, because xinitrc only sources script names ending with extension .sh.

--with-systemdsystemunitdir=no: Disable attempting to build with systemd libraries.

--enable-docbook-docs: Use this switch if xmlto is installed and you wish to build the user and API documentation.

Configuring ConsoleKit

PAM Module Configuration

If you use Linux PAM, it needs to be configured to activate ConsoleKit upon user login. This can be achieved by editing the /etc/pam.d/system-session file as the root user: 

cat >> /etc/pam.d/system-session << "EOF"
# Begin ConsoleKit addition

session   optional    pam_loginuid.so
session   optional    pam_ck_connector.so nox11

# End ConsoleKit addition
EOF

You will also need a helper script that creates a file in /var/run/console named as the currently logged in user and that contains the D-Bus address of the session. You can create the script by running the following commands as the root user: 

cat > /usr/lib/ConsoleKit/run-session.d/pam-foreground-compat.ck << "EOF"
#!/bin/sh
TAGDIR=/var/run/console

[ -n "$CK_SESSION_USER_UID" ] || exit 1
[ "$CK_SESSION_IS_LOCAL" = "true" ] || exit 0

TAGFILE="$TAGDIR/`getent passwd $CK_SESSION_USER_UID | cut -f 1 -d:`"

if [ "$1" = "session_added" ]; then
    mkdir -p "$TAGDIR"
    echo "$CK_SESSION_ID" >> "$TAGFILE"
fi

if [ "$1" = "session_removed" ] && [ -e "$TAGFILE" ]; then
    sed -i "\%^$CK_SESSION_ID\$%d" "$TAGFILE"
    [ -s "$TAGFILE" ] || rm -f "$TAGFILE"
fi
EOF
chmod -v 755 /usr/lib/ConsoleKit/run-session.d/pam-foreground-compat.ck

See /usr/share/doc/ConsoleKit/spec/ConsoleKit.html for more configuration.

Contents

Installed Programs: ck-history, ck-launch-session, and ck-list-sessions
Installed Libraries: libconsolekit.so, libck-connector.so, and pam_ck_connector.so
Installed Directories: /etc/ConsoleKit, /usr/{include,lib}/ConsoleKit, /usr/share/doc/ihtml/ConsoleKit-1.2.1, and /var/{log,run}/ConsoleKit

Short Descriptions

ck-history

is a utility that provides information from the ConsoleKit database about what users have logged into the system.

ck-launch-session

is a utility for starting a command in its own ConsoleKit session.

ck-list-sessions

list sessions with respective properties. Also good for debugging purposes.

ck-log-system-restart

write system restart to log.

ck-log-system-start

write system start to log.

ck-log-system-stop

write system stop to log.

console-kit-daemon

is the ConsoleKit daemon.

Last updated on 2019-02-17 10:23:01 -0800