Beyond Linux® From Scratch - Version 2015-03-06-multilib

Chapter 4. Security

ConsoleKit-0.4.6

Introduction to ConsoleKit

The ConsoleKit package is a framework for keeping track of the various users, sessions, and seats present on a system. It provides a mechanism for software to react to changes of any of these items or of any of the metadata associated with them.

This package is known to build and work properly using an LFS-7.7 platform.

Package Information

ConsoleKit Dependencies

Required

dbus-glib-0.104 and Xorg Libraries

Recommended

Linux-PAM-1.1.8 and Polkit-0.112

[Warning]

Warning

If you intend NOT to install polkit, you will need to manually edit the ConsoleKit.conf file to lock down the service. Failure to do so may be a huge SECURITY HOLE.

Optional

xmlto-0.0.26

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/consolekit

Installation of ConsoleKit

Install ConsoleKit by running the following commands: 

./configure --prefix=/usr        \
            --sysconfdir=/etc    \
            --localstatedir=/var \
            --enable-udev-acl    \
            --enable-pam-module  \
            --with-systemdsystemunitdir=no &&
make

This package does not come with a test suite.

Now, as the root user: 

make install

Command Explanations

--enable-udev-acl: This switch enables building of the udev-acl tool, which is used to allow normal users to access device nodes normally only accessible to root.

--enable-pam-module: This switch enables building of the ConsoleKit PAM module which is needed for ConsoleKit to work correctly with PAM. Remove if Linux PAM is NOT installed.

--with-systemdsystemunitdir=no: Disable attempting to build with systemd libraries.

--enable-docbook-docs: Use this switch if xmlto is installed and you wish to build the API documentation.

Configuring ConsoleKit

PAM Module Configuration

If you use Linux PAM, it needs to be configured to activate ConsoleKit upon user login. This can be achieved by editing the /etc/pam.d/system-session file as the root user: 

cat >> /etc/pam.d/system-session << "EOF"
# Begin ConsoleKit addition

session   optional    pam_loginuid.so
session   optional    pam_ck_connector.so nox11

# End ConsoleKit addition
EOF

You will also need a helper script that creates a file in /var/run/console named as the currently logged in user and that contains the D-Bus address of the session. You can create the script by running the following commands as the root user: 

cat > /usr/lib/ConsoleKit/run-session.d/pam-foreground-compat.ck << "EOF"
#!/bin/sh
TAGDIR=/var/run/console

[ -n "$CK_SESSION_USER_UID" ] || exit 1
[ "$CK_SESSION_IS_LOCAL" = "true" ] || exit 0

TAGFILE="$TAGDIR/`getent passwd $CK_SESSION_USER_UID | cut -f 1 -d:`"

if [ "$1" = "session_added" ]; then
    mkdir -p "$TAGDIR"
    echo "$CK_SESSION_ID" >> "$TAGFILE"
fi

if [ "$1" = "session_removed" ] && [ -e "$TAGFILE" ]; then
    sed -i "\%^$CK_SESSION_ID\$%d" "$TAGFILE"
    [ -s "$TAGFILE" ] || rm -f "$TAGFILE"
fi
EOF
chmod -v 755 /usr/lib/ConsoleKit/run-session.d/pam-foreground-compat.ck

See /usr/share/doc/ConsoleKit/spec/ConsoleKit.html for more configuration.

Contents

Installed Programs: ck-history, ck-launch-session, ck-list-sessions, ck-log-system-restart, ck-log-system-start, ck-log-system-stop and console-kit-daemon
Installed Libraries: libck-connector.so and pam_ck_connector.so
Installed Directories: /etc/ConsoleKit, /usr/include/ConsoleKit, /usr/lib/ConsoleKit, /usr/share/doc/ConsoleKit and /var/log/ConsoleKit

Short Descriptions

ck-list-sessions

list sessions with respective properties. Also good for debugging purposes.

Last updated on 2015-02-24 00:00:51 -0500