Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 813732 - sys-auth/seatd: systemd service requires a seat group
Summary: sys-auth/seatd: systemd service requires a seat group
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal with 1 vote (vote)
Assignee: Haelwenn (lanodan) Monnier
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-09-18 22:01 UTC by John Helmert III
Modified: 2021-10-15 06:57 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-09-18 22:01:49 UTC 
The latest version of seatd changes the group seatd is run as to 'seat' in its systemd service, which leads to being unable to start the seatd service without user intervention:

Sep 18 15:04:46 sol systemd[1]: Started Seat management daemon.
Sep 18 15:04:46 sol seatd[159578]: Could not find group by name 'seat'.
Sep 18 15:04:46 sol systemd[1]: seatd.service: Main process exited, code=exited, status=1/FAILURE

commit 5535c2c3b19b42ebfe4c451600059e9418e401a6
Author: Kenny Levinsen <kl@kl.wtf>
Date:   Sat Apr 17 17:08:51 2021 +0200

    contrib/systemd: Use a different group

    "video" was used for convenience in the example, but a dedicated group
    is preferable so that a user does not gain the ability to bypass the
    seat manager and open devices directly.

diff --git a/contrib/systemd/seatd.service b/contrib/systemd/seatd.service
index a450058..bbbaf23 100644
--- a/contrib/systemd/seatd.service
+++ b/contrib/systemd/seatd.service
@@ -4,7 +4,8 @@ Documentation=man:seatd(1)

 [Service]
 Type=simple
-ExecStart=seatd -g video
+# Specify the group you'd like to grant access to seatd
+ExecStart=seatd -g seat
 Restart=always
 RestartSec=1