Bug 1745147

Summary: GDM does not prevent users with login shell /sbin/nologin from logging on
Product: Red Hat Enterprise Linux 8 Reporter: Steffen Froemer <sfroemer>
Component: gdmAssignee: Ray Strode [halfline] <rstrode>
Status: CLOSED ERRATA QA Contact: Desktop QE <desktop-qa-list>
Severity: high Docs Contact:
Priority: high    
Version: 8.0CC: cww, dchen, hdegoede, jkoten, modehnal, rstrode, toneata, tpelka
Target Milestone: rcKeywords: ZStream
Target Release: 8.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: gnome-session-3.28.1-7.el8 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1752493 2015519 (view as bug list) Environment:
Last Closed: 2020-04-28 16:09:41 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1752493, 2015519    

Description Steffen Froemer 2019-08-23 17:40:00 UTC 
Description of problem:
A user with login-shell set to /sbin/nologin is still able to login using GDM

Version-Release number of selected component (if applicable):
gdm-3.28.3-20.el8.x86_64

How reproducible:
100%

Steps to Reproduce:
1. RHEL 8
2. useradd -s /sbin/nologin -m user2
3. login via GDM

Actual results:
The user is able to login

Expected results:
The user should not be able to login

Additional info:
# grep user2 /etc/passwd
user2:x:1001:1001::/home/user2:/sbin/nologin

# w
 17:39:27 up 30 min,  2 users,  load average: 0,80, 0,17, 0,07
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
root     pts/0    172.16.100.100   17:09    1.00s  0.11s  0.01s w
user2    :1       :1               17:39   ?xdm?  16.42s  0.02s /usr/libexec/gdm-x-session gnome-session

# su - user2
Last login: Fr Aug 23 17:39:24 UTC 2019 on tty2
This account is currently not available.
Comment 1 Ding-Yi Chen 2019-09-13 03:33:44 UTC 
I can reproduce it with gdm-3.28-3-20.el8.x86_64
Comment 3 Ray Strode [halfline] 2019-10-21 14:30:52 UTC 
So this is an interesting bug.

For console logins, they get the lock out for "free", because they're just handing off to the shell which is /sbin/nologin.

For graphical logins, we're starting a graphical desktop, not the users shell.

We do still run a shell, however, as part of the login process.  /usr/bin/gnome-session is a shell script that does:

if [ "x$XDG_SESSION_TYPE" = "xwayland" ] &&
   [ "x$XDG_SESSION_CLASS" != "xgreeter" ] &&
   [  -n "$SHELL" ] &&
   grep -q "$SHELL" /etc/shells &&
   ! (echo "$SHELL" | grep -q "false") &&
   ! (echo "$SHELL" | grep -q "nologin"); then
  if [ "$1" != '-l' ]; then
    exec bash -c "exec -l '$SHELL' -c '$0 -l $*'"
  else
    shift
  fi
fi

See it runs exec -l '$SHELL' to execute the users shell as a "login shell" so all the appropriate startup scripts get run.

But also see it explicitly avoids this step for the "nologin" shell. The reasoning for this is discussed upstream here:

https://bugzilla.gnome.org/show_bug.cgi?id=736660#c58

Namely, the login screen itself uses gnome-session and has its shell set to nologin!

But i think we're still safe to remove the check because we also check XDG_SESSION_CLASS to make sure it's not a login screen before proceeding.
In other words, we had redundant checks to skip the script loading for the login screen and dropping one shouldn't hurt anything.

Dropping it, will mean that we try to run nologin as the users shell during login.  it will fail and login will be aborted which is the desired behavior.

devack+
Comment 10 errata-xmlrpc 2020-04-28 16:09:41 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:1766