<html>
<head>
<base href="https://bugs.freedesktop.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - systemd-logind: allow "loginctl kill-session" for user's own session"
href="https://bugs.freedesktop.org/show_bug.cgi?id=80070">80070</a>
</td>
</tr>
<tr>
<th>Keywords</th>
<td>security
</td>
</tr>
<tr>
<th>Assignee</th>
<td>systemd-bugs@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Summary</th>
<td>systemd-logind: allow "loginctl kill-session" for user's own session
</td>
</tr>
<tr>
<th>QA Contact</th>
<td>systemd-bugs@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Reporter</th>
<td>quequotion@mailinator.com
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Other
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Component</th>
<td>general
</td>
</tr>
<tr>
<th>Product</th>
<td>systemd
</td>
</tr></table>
<p>
<div>
<pre>Currently SUID is required to kill-session.
This prevents users (without sudo access) from using loginctl to log out of
their own session.
This would be useful for users who don't have a third party session manager or
have a broken session manager and need a "clean" means of logging out.
By "clean" I mean a way that ends a specific session, such as their currently
logged in session, without affecting other sessions (owned by themselves or
other users).
I don't think it's necessary to require SUID for this function. Users aren't
allowed to kill processes that don't belong to them anyway, so it follows that
a user would only be able to kill their own session(s). Perhaps this could be
acheived with polkit?
Besides, users (with polkit) already have acess to systemctl shutdown, reboot,
hibernate, and suspend; loginctl kill-session seems less serious.
+1: if kill-session can be allowed to users to end their own sessions, how
about kill-user for users to end themselves?</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>