Support for multiple users on Raspberry Pi 5

[kevinjwalters]

I've been using wayvnc setup under systemd on a headless Raspberry Pi 5 and it's working well.

I thought I'd see what happens if I tried to login to a second account on the Raspberry pi using VNC. If I

1. Login at testacc1 remotely using a VNC client (TigerVNC)
2. Close the VNC client.
3. Login as testacc2 - this will authenticate okay and allow me to connect to testacc1's existing session.

Is that the intended/desirable behaviour? Is there a way to change this?

[any1]

I am actually working on a PAM plugin for this right now. If you want to test, here it is:

#include <unistd.h>
#include <string.h>
#include <stdlib.h>
#include <stdbool.h>
#include <syslog.h>
#include <pwd.h>

#include <systemd/sd-bus.h>

#define PAM_SM_ACCOUNT
#include <security/pam_modules.h>
#include <security/pam_ext.h>

static bool is_session_type_wayland(pam_handle_t *pamh, sd_bus *bus, const char *session_path)
{
	char *value = NULL;
	int ret = sd_bus_get_property_string(bus, "org.freedesktop.login1", session_path,
		"org.freedesktop.login1.Session", "Type", NULL, &value);
	bool result = ret == 0 && value && strcmp(value, "wayland") == 0;
	free(value);
	return result;
}

static bool is_session_class_greeter(pam_handle_t *pamh, sd_bus *bus, const char *session_path)
{
	char *value = NULL;
	int ret = sd_bus_get_property_string(bus, "org.freedesktop.login1", session_path,
		"org.freedesktop.login1.Session", "Class", NULL, &value);
	bool result = ret == 0 && value && strcmp(value, "greeter") == 0;
	free(value);
	return result;
}

static int get_session_uid(pam_handle_t *pamh, sd_bus *bus, const char *session_path, uid_t *uid_out)
{
	sd_bus_message *reply = NULL;
	int ret = sd_bus_get_property(bus, "org.freedesktop.login1", session_path,
		"org.freedesktop.login1.Session", "User", NULL, &reply, "(uo)");
	if (ret < 0)
		return ret;

	uint32_t uid32 = 0;
	const char *object_path = NULL;
	ret = sd_bus_message_read(reply, "(uo)", &uid32, &object_path);
	sd_bus_message_unref(reply);
	if (ret < 0)
		return ret;

	*uid_out = (uid_t)uid32;
	return 0;
}

static bool is_session_active(pam_handle_t *pamh, sd_bus *bus, const char *session_path)
{
	int active = 0;
	int ret = sd_bus_get_property_trivial(bus, "org.freedesktop.login1", session_path,
		"org.freedesktop.login1.Session", "Active", NULL, 'b', &active);
	return ret == 0 && active != 0;
}

static bool is_conflicting_session(pam_handle_t *pamh, sd_bus *bus, const char *session_path, uid_t auth_uid)
{
	if (!is_session_type_wayland(pamh, bus, session_path))
		return false;

	if (is_session_class_greeter(pamh, bus, session_path))
		return false;

	if (!is_session_active(pamh, bus, session_path))
		return false;

	uid_t session_uid;
	if (get_session_uid(pamh, bus, session_path, &session_uid) != 0)
		return false;

	return auth_uid != session_uid;
}

static bool have_conflicting_session(pam_handle_t *pamh, sd_bus *bus, uid_t auth_uid, const char *auth_username)
{
	sd_bus_error error = SD_BUS_ERROR_NULL;
	sd_bus_message *m = NULL;
	bool found = false;

	int ret = sd_bus_call_method(bus, "org.freedesktop.login1", "/org/freedesktop/login1",
		"org.freedesktop.login1.Manager", "ListSessions", &error, &m, "");
	if (ret < 0) {
		pam_syslog(pamh, LOG_ERR, "Failed to call ListSessions: %s", error.message);
		goto done;
	}

	ret = sd_bus_message_enter_container(m, 'a', "(susso)");
	if (ret < 0) {
		pam_syslog(pamh, LOG_ERR, "Failed to enter session array: %s", strerror(-ret));
		goto done;
	}

	for (;;) {
		if (sd_bus_message_peek_type(m, NULL, NULL) <= 0)
			break;

		const char *session_path;
		if (sd_bus_message_read(m, "(susso)", NULL, NULL, NULL, NULL, &session_path) < 0) {
			pam_syslog(pamh, LOG_WARNING, "Whoops");
			break;
		}

		if (is_conflicting_session(pamh, bus, session_path, auth_uid)) {
			pam_syslog(pamh, LOG_WARNING, "Login for user '%s' rejected; another user is already using the desktop.", auth_username);
			found = true;
			break;
		}
	}

done:
	sd_bus_error_free(&error);
	sd_bus_message_unref(m);
	return found;
}

PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv)
{
	const char *auth_username = NULL;
	if (pam_get_user(pamh, &auth_username, NULL) != PAM_SUCCESS || !auth_username) {
		pam_syslog(pamh, LOG_ERR, "Could not get username from PAM.");
		return PAM_SERVICE_ERR;
	}


	struct passwd *pwd = getpwnam(auth_username);
	if (!pwd) {
		pam_syslog(pamh, LOG_ERR, "Could not find user '%s' in system database.", auth_username);
		return PAM_SERVICE_ERR;
	}
	uid_t auth_uid = pwd->pw_uid;

	sd_bus *bus = NULL;
	int ret = sd_bus_open_system(&bus);
	if (ret < 0) {
		pam_syslog(pamh, LOG_ERR, "Failed to connect to system bus: %s", strerror(-ret));
		return PAM_SERVICE_ERR;
	}

	bool conflict = have_conflicting_session(pamh, bus, auth_uid, auth_username);
	sd_bus_unref(bus);
	return conflict ? PAM_PERM_DENIED : PAM_SUCCESS;
}

PAM_EXTERN int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags, int argc, const char **argv)
{
	return PAM_SUCCESS;
}

PAM_EXTERN int pam_sm_setcred(pam_handle_t *pamh, int flags, int argc, const char **argv)
{
	return PAM_SUCCESS;
}

Compile using

gcc -o pam_allow_desktopuser.so pam_allow_desktopuser.c -fPIC -shared $(pkg-config --libs --cflags libsystemd pam)

# copy to the right spot:
sudo cp pam_allow_desktopuser.so /lib/security/

Put this into /etc/pam.d/wayvnc:

auth    required pam_unix.so nodelay
auth    required pam_allow_desktopuser.so nodelay
account required pam_unix.so nodelay