https://bugzilla.novell.com/show_bug.cgi?id=865337 https://bugzilla.novell.com/show_bug.cgi?id=865337#c0 Summary: systemd holds open users in KDE that are loged out, KDE holds open KDEsuid from that user Classification: openSUSE Product: openSUSE 13.1 Version: Final Platform: x86-64 OS/Version: Other Status: NEW Severity: Major Priority: P5 - None Component: Basesystem AssignedTo: bnc-team-screening@forge.provo.novell.com ReportedBy: stakanov@freenet.de QAContact: qa-bugs@suse.de Found By: --- Blocker: --- Created an attachment (id=579753) --> (http://bugzilla.novell.com/attachment.cgi?id=579753) suid stays open User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:27.0) Gecko/20100101 Firefox/27.0 This is a possible security problem, at least I to me it seems so. Create a system with three users in kde (A,B,C). Log in the first one (A), the second one (B), the third one(C). Switch between users with alt+ctrl+F7 etc (VT change). Use sudo in terminal with the second one. Now close user "B". Close user C after this. This will cause the first anomaly. The system will hang with a black screen and a minus blinking in the left upper corner. To get out of this you have to change to the first user that was opened. Only then you see a desktop again. Now, if you go to switch user, you see as a user still online the VT of user C. You see VT8 as unused and then of course user A as VT7. Now open with Alt+F2 the processes. You will see: if you do use just the users, they will stay open after logout with two processes: sd-pam and systemd. This is annoying because if (use-case) a user wants to suppress the user in yast he cannot. It says: user still logged in. The user should NOT be logged in anymore. But really tricky it gets when you use sudo. Then you find: the two processes stay open on a per user base but also the process KDESuid of the user that was owner stays open. This process gets not even killed when you do it givin the password of root in the list. You have to open a terminal, search for it and kill it with root rights and Kill (PID number). A logged-out user that in reality is logged-in with a KDEsuid seem to me a bad thing. Put this toghether with the fact that in multiusersystems 64 bit KDE listens on 6001 ecc by default.... Reproducible: Always Steps to Reproduce: 1.create system with three users. 2.login all three, use e.g. sudo with the second 3.logout the second then the third Actual Results: system locks with black screen on logout if the order of logout is not the order of login. Two processes are staying logged in although the user was logged out. If sudo was used in KDE sudo stays open and cannot be easily killed (IF it is noticed by the admin). If one wants to suppress a user with yast, this is denied as "user logged in" logout user first. BTW when this happens also the multi-monitor support often breaks leaving all users with a "cloned mointor" instead of a multi-monitor. This is the case as long as all "logged in processes" are not eliminated, thus, either the user restarts the system, or he kills with the terminal and root rights all the users in question one by one and then logs in again. Otherwise the multi-monitor support will stay broken. Expected Results: A user logged out should be logged out. KDEsuid has to be terminated when the user that evoked it logs out. The order of log out should be insignificant and the system should not lock up with a black screen. Multi-support should not crash of course, but if it does, simple logout and login should be sufficient to restore a working desktop with settings as foreseen. (The monitor thing is just a symptom for the fact that a logged out user does not log out). This is a standard opensuse 13.1 installation. However the users are created with umask 077 (that is the only deviation from the standard). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.