{"action":"created","issue":{"url":"https://api.github.com/repos/lxc/lxcfs/issues/117","repository_url":"https://api.github.com/repos/lxc/lxcfs","labels_url":"https://api.github.com/repos/lxc/lxcfs/issues/117/labels{/name}","comments_url":"https://api.github.com/repos/lxc/lxcfs/issues/117/comments","events_url":"https://api.github.com/repos/lxc/lxcfs/issues/117/events","html_url":"https://github.com/lxc/lxcfs/issues/117","id":158426359,"number":117,"title":"libpam-cgfs breaks systemd user sessions","user":{"login":"bigon","id":264358,"avatar_url":"https://avatars.githubusercontent.com/u/264358?v=3","gravatar_id":"","url":"https://api.github.com/users/bigon","html_url":"https://github.com/bigon","followers_url":"https://api.github.com/users/bigon/followers","following_url":"https://api.github.com/users/bigon/following{/other_user}","gists_url":"https://api.github.com/users/bigon/gists{/gist_id}","starred_url":"https://api.github.com/users/bigon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bigon/subscriptions","organizations_url":"https://api.github.com/users/bigon/orgs","repos_url":"https://api.github.com/users/bigon/repos","events_url":"https://api.github.com/users/bigon/events{/privacy}","received_events_url":"https://api.github.com/users/bigon/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-06-03T18:27:34Z","updated_at":"2016-06-04T05:24:43Z","closed_at":null,"body":"From: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=826260\r\n\r\nHi,\r\n\r\nThe default configuration of libpam-cgfs breaks systemd user session\r\nmanagement.\r\n\r\nAll the processes started by systemd --user are not properly put in the\r\ncorrect systemd cgroup. This can be verified with \"loginctl user-status\"\r\ncommand.\r\n\r\nThis is at least breaking stuffs like policykit.\r\n\r\nRemoving \"name=systemd\" from the call to the pam module seems to fix\r\nthis. I don't think it's the role of libpam-cgfs to mangle with systemd\r\ncgroups."},"comment":{"url":"https://api.github.com/repos/lxc/lxcfs/issues/comments/223737466","html_url":"https://github.com/lxc/lxcfs/issues/117#issuecomment-223737466","issue_url":"https://api.github.com/repos/lxc/lxcfs/issues/117","id":223737466,"user":{"login":"hallyn","id":1359441,"avatar_url":"https://avatars.githubusercontent.com/u/1359441?v=3","gravatar_id":"","url":"https://api.github.com/users/hallyn","html_url":"https://github.com/hallyn","followers_url":"https://api.github.com/users/hallyn/followers","following_url":"https://api.github.com/users/hallyn/following{/other_user}","gists_url":"https://api.github.com/users/hallyn/gists{/gist_id}","starred_url":"https://api.github.com/users/hallyn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hallyn/subscriptions","organizations_url":"https://api.github.com/users/hallyn/orgs","repos_url":"https://api.github.com/users/hallyn/repos","events_url":"https://api.github.com/users/hallyn/events{/privacy}","received_events_url":"https://api.github.com/users/hallyn/received_events","type":"User","site_admin":false},"created_at":"2016-06-04T05:24:43Z","updated_at":"2016-06-04T05:24:43Z","body":"On Fri, Jun 03, 2016 at 12:12:27PM -0700, Laurent Bigonville wrote:\n> Without libpam-cgfs:\n> \n> > 10:pids:/user.slice/user-1002.slice\n> > 9:cpuset:/\n> > 8:freezer:/\n> > 7:memory:/user.slice\n> > 6:cpu,cpuacct:/user.slice\n> > 5:blkio:/user.slice\n> > 4:net_cls,net_prio:/\n> > 3:devices:/user.slice\n> > 2:perf_event:/\n> > 1:name=systemd:/user.slice/user-1002.slice/user@1002.service/gnome-terminal-server.service\n\nRight, this is the problem:  the format of the systemd-generated\ncgroup path used to be\n\t/user/$uid.user/$something.session\nthen it became\n\tuser-$uid.slice/session-c$session.scope\n\nNow I'm not quite certain whether it has changed again, or whether this\nhas something to do with the 'gnome terminal server'.\n\nlibpam-cgfs only creates a new cgroup if it detects that the existing\none was *not* created by systemd.  If it *was* created by systemd, then\nit only chowns the cgroup to the user.  (Not doing this prevents\nunprivileged users from creating containers running systemd)\n"}}
{"actor":{"display_login":"hallyn"}}