Launch cockpit-session via socket activation on /run/cockpit/session

[allisonkarlitskaya]

This is a precondition for our goal of removing the static cockpit users.

A nice side effect of this is that we can now connect to unix sockets from cockpitauth, which is useful for https://github.com/allisonkarlitskaya/cockpit-cloud

• cockpit.spec: drop --with-selinux-config-type #16810
• ws: add support for connecting to unix sockets #16819
• pass memfd with login information from ws to session not required. That information comes from cockpit-session to cockpit-bridge, which is unaffected by this change.
• pass $COCKPIT_REMOTE_PEER from ws to session
• find replacement for cgroup detection for cert login
• SELinux rejections for TestLogin.testSELinuxRestrictedUser
• cockpit-session@<id>.service fails with error 5 initially
• Clean up Debian statoverride on upgrades

[allisonkarlitskaya]

One thing that needs discussion: login failures are currently handled with a non-zero return code from cockpit-session which systemd logs as a failure of the unit. We probably want to change that...

[martinpitt]

@allisonkarlitskaya Sorry, this slipped off my review radar. It should be unblocked now (the depending PR landed), but now it's conflict-y and needs to be rebased first. It also breaks tons of tests.

Moving to draft to clear the review list, please re-request my review once ready. Thanks!

[martinpitt]

The depending PR landed, moving to needs-rebase

[packit-as-a-service]

Failed to load packit config file:

Cannot parse package config: ValidationError({'jobs': {0: {'cockpit': ["'specfile_path' is not specified or no specfile was found in the repo"]}, 1: {'cockpit': ["'specfile_path' is not specified or no specfile was found in the repo"]}}}).

For more info, please check out the documentation or contact the Packit team.

[martinpitt]

Added another commit to move the unit to cockpit-ws, so that we end up in the state as it was originally here. It also works in cockpit-tests, but let's not forget about it.

Note: This is just for fun, I'd like to get some results and a feeling how much work this is to get to "good".

[martinpitt]

Hmm, this is causing our bots to crash left and right. I'm going to force-push with no-test to get them out of their misery, and investigate tomorrow.

[allisonkarlitskaya]

So one big thing that's missing here, and is going to be non-trivial to implement is a replacement for the cgroup checking in the PAM module for client certificate authentication.

The cgroup that cockpit-session gets spawned into is no longer the same cgroup as cockpit-ws was in...

We could take advantage of the fact that this is a socket and ask who we're speaking to, but something like SO_PEERCGROUP unfortunately doesn't exist: https://lwn.net/Articles/590928/

We could query the PID and look up their cgroup, but this is subject to the usual races... which are not insurmountable, but requires some pretty careful programming in order to get right.

[allisonkarlitskaya]

We could query the PID and look up their cgroup, but this is subject to the usual races... which are not insurmountable, but requires some pretty careful programming in order to get right.

Apparent state of the art: https://gitlab.freedesktop.org/polkit/polkit/-/blob/master/src/polkit/polkitunixprocess.c#L681

Yikes.

Too bad there's no way to get a pidfd, at least...

[martinpitt]

Yesterday's crashes were "HTTP Error 403: Forbidden" when writing to Linode/S3. Trying a single test here to check again.

[martinpitt]

I added the most obvious missing things to the description as todo list.

[martinpitt]

We could query the PID and look up their cgroup, but this is subject to the usual races... which are not insurmountable, but requires some pretty careful programming in order to get right.

Apparent state of the art: https://gitlab.freedesktop.org/polkit/polkit/-/blob/master/src/polkit/polkitunixprocess.c#L681

Yikes.

Too bad there's no way to get a pidfd, at least...

Since then, pidfs actually happened in polkit: https://gitlab.freedesktop.org/polkit/polkit/-/commit/7f0d792323cdca70b3d581cc9ed54df3d844a637 So that may be worth another look.

For the fun of it I rebased this and will trigger a round of f40 tests.

[martinpitt]

Going through the failures confirms the current laundry list -- the big items are cert auth and passing COCKPIT_REMOTE_PEER.