What is the difference between a system with consolekit and the one without it?

Question

First of all, I'm using Debian testing system with standalone Openbox. I don't have systemd, just sysvinit, and I certainly won't use systemd .

Yesterday my Debian box started returning messages like the ones below:

Jun 14 18:08:10 morfikownia login[4722]: pam_unix(login:session): session opened for user morfik by LOGIN(uid=0)
Jun 14 18:08:10 morfikownia dbus[4391]: [system] Activating service name='org.freedesktop.ConsoleKit' (using servicehelper)
Jun 14 18:08:10 morfikownia dbus[4391]: [system] Activated service 'org.freedesktop.ConsoleKit' failed: Failed to execute program org.freedesktop.ConsoleKit: Success
...
Jun 14 18:08:19 morfikownia pulseaudio[4855]: [pulseaudio] sink.c: Default and alternate sample rates are the same.
Jun 14 18:08:19 morfikownia pulseaudio[4855]: [pulseaudio] source.c: Default and alternate sample rates are the same.
Jun 14 18:08:20 morfikownia dbus[4391]: [system] Activating service name='org.freedesktop.ConsoleKit' (using servicehelper)
Jun 14 18:08:20 morfikownia dbus[4391]: [system] Activated service 'org.freedesktop.ConsoleKit' failed: Failed to execute program org.freedesktop.ConsoleKit: Success
Jun 14 18:08:20 morfikownia pulseaudio[4855]: [pulseaudio] module-console-kit.c: GetSessionsForUnixUser() call failed: org.freedesktop.DBus.Error.Spawn.ExecFailed: Failed to execute program org.freedesktop.ConsoleKit: Success
Jun 14 18:08:20 morfikownia pulseaudio[4855]: [pulseaudio] module.c: Failed to load module "module-console-kit" (argument: ""): initialization failed.
Jun 14 18:08:20 morfikownia pulseaudio[4855]: [pulseaudio] main.c: Module load failed.
Jun 14 18:08:20 morfikownia pulseaudio[4855]: [pulseaudio] main.c: Failed to initialize daemon.

Moreover, each su command generates the following log:

Jun 14 18:08:50 morfikownia su[6043]: Successful su for root by morfik
Jun 14 18:08:50 morfikownia su[6043]: + /dev/pts/2 morfik:root
Jun 14 18:08:50 morfikownia su[6043]: pam_unix(su:session): session opened for user root by (uid=1000)
Jun 14 18:08:50 morfikownia dbus[4391]: [system] Activating service name='org.freedesktop.ConsoleKit' (using servicehelper)
Jun 14 18:08:50 morfikownia dbus[4391]: [system] Activated service 'org.freedesktop.ConsoleKit' failed: Failed to execute program org.freedesktop.ConsoleKit: Success

I managed to fix these issues.

In the case of PulseAudio, I just commented out these lines from the /etc/pulse/default.pa file:

### If autoexit on idle is enabled we want to make sure we only quit
### when no local session needs us anymore.
#.ifexists module-console-kit.so
#load-module module-console-kit
#.endif
#.ifexists module-systemd-login.so
#load-module module-systemd-login
#.endif

In the case of everything else, I had to run pam-auth-update and unchecked ConsoleKit Session Management:

 PAM profiles to enable
    [ ] encfs encrypted home directories                  
    [*] Unix authentication                               
    [ ] Mount volumes for user                            
    [*] GNOME Keyring Daemon - Login keyring management   
    [ ] ConsoleKit Session Management                     
    [ ] Inheritable Capabilities Management

And a small change was needed to the ~/.xinitrc file:

#exec ck-launch-session dbus-launch --sh-syntax --exit-with-session openbox-session
exec openbox-session

because when I was trying to check a session list, I got the following error:

$ ck-list-sessions

** (ck-list-sessions:15584): WARNING **: Failed to get list of seats: Failed to execute program org.freedesktop.ConsoleKit: Success

There's no errors now, but I have no idea what changes these steps can cause. I know the consolekit is dead one way or another, so this ultimately would happen anyway. Meanwhile, I'm reading this question in order to understand what will happen after this change, but I don't get many things.

It allows switching users without logging out [many user can be logged in on the same hardware at the same time with one user active].

I can do su user, and it changes without a problem:

Jun 15 10:36:57 morfikownia su[103349]: Successful su for morfik2 by morfik
Jun 15 10:36:57 morfikownia su[103349]: + /dev/pts/5 morfik:morfik2
Jun 15 10:36:57 morfikownia su[103349]: pam_unix(su:session): session opened for user morfik2 by (uid=1000)

I can also log many users in via ssh. So where's the advantage of using consolekit? Could you tell me if deleting it can cause any security problems, and how can I see the change? Because it looks like nothing has changed.

Solution

It allows switching users without logging out [many user can be logged in on the same hardware at the same time with one user active].

I believe consolekit provided a mechanism for applications to determine which user is active, i.e. sitting in front of the computer. This differs from the su user switch in this way:

• Your computer has one seat assigned a mouse, keyboard, display, microphone, camera, and audio.
• You sit down at your computer and log in via one virtual console(VC)/graphical login manager (GLM).
• You lock your session, then walk away.
• Someone else sits down and logs in via a second VC/GLM.
• Now two users are logged in (two sessions), but only the second is active.

Whose processes have access to the hardware now? You certainly don't want the second user starting a recording program that retains access to the microphone/camera/keyboard when you switch back to your session.

While I'm unclear whether consolekit strips hardware access away from processes, at the very least it allows a process to be a "good citizen" and release hardware when the session changes.

Remote logins and su

ssh and su - user are not affected by consolekit. Consolekit is intended to manage sessions for seats. A seat is a collection of physical devices (mouse, keyboard, display, etc) assigned to said seat. A session is created when a user logs in at said seat. A seat may have many sessions, and consolekit tracks those sessions, and notifies processes (that listen) via DBUS when the session changes.

Multi-user shutdown restrictions

Consolekit can also be used in concert with policykit to prevent users from shutting down the system when multiple sessions are open (more than one user logged in).

Why use consolkit?

For a single-user system, consolekit doesn't have any use. If you have a family sharing a single computer, then it enables everyone to login and switch users without logging out and without interfering with hardware access. IIRC, each user has their own xserver instance as well.

Alternatives

I know of no alternatives to consolekit or systemd. If you need this functionality, you might consider forking consolekit.

Comments

[jasonwryan]

ConsoleKit is no longer maintained...

[VinoPravin]

I know that. :)

[VinoPravin]

So without the consolekit if I have two users logged in (via startx), both of them have access to these devices now? With the consolekit feature just the active one would have, right? And this was mainly invented to help managing graphical sessions, it has nothing to do with ssh and other stuff like this? If so, is there any other way to achieve the same thing as in the case of consolekit (without systemd)?

[Justin C]

Yes, both login sessions should have access to these devices, unless you rely on hardware groups to restrict access. Only processes of the active user may use the hardware. Again, I don't know if consolekit can enforce this. At the least, processes can listen for session changes and release the hardware until their session returns. I believe consolekit is meant to help manage graphical sessions. Basically Windows user switching in Linux. I have no evidence to support this, though. ssh and su - user are not affected. I know of no alternative to consolekit.

[Stuart Cardall]

on systems without systemd you can also use elogind instead of consolekit github.com/elogind/elogind (the systemd project's logind extracted to a standalone package)