Subject: elogind: doesn't seem to be updating lastlog

From: "Dimitris T." <[email-masked]>
Date: Thu, 07 Mar 2019 18:09:57 +0200

Package: elogind
Version: 239.3+20190131-1
Severity: normal

since 30/1 lastlog doesn't seem to be updated for display manager logins. tty logins are reported correctly as seen below :  

# lastlog  
Username         Port     From             Latest
root             tty1                      Thu Mar  7 10:49:55 
user               :0                        Wed Jan 30 15:36:23 

31/1 was the policykit update ( https://lists.dyne.org/lurker/message/20190131.103118.c6fc512b.en.html ), maybe related to that(?).

thanks,
d

-- System Information:
Distributor ID:	Devuan
Description:	Devuan GNU/Linux beowulf/ceres
Release:	10
Codename:	n/a
Architecture: x86_64

Kernel: Linux 4.19.0-3-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)
LSM: AppArmor: enabled

Versions of packages elogind depends on:
ii  dbus         1.12.12-1
ii  debconf      1.5.71
ii  libacl1      2.2.53-4
ii  libc6        2.28-8
ii  libelogind0  239.3+20190131-1
ii  libselinux1  2.8-1+b1
pn  libudev1     <none>
ii  lsb-base     10.2018112800

Versions of packages elogind recommends:
ii  policykit-1  0.105-25+devuan1

elogind suggests no packages.

-- no debconf information

---

From: Mark Hindley <[email-masked]>
Date: Thu, 7 Mar 2019 18:05:18 +0000

> 31/1 was the policykit update ( https://lists.dyne.org/lurker/message/20190131.103118.c6fc512b.en.html ), maybe related to that(?).

Any chance you could have a look in /var/log/apt/history.log* and post the
packages and versions that were updated on 31/1?

What display manager are you using?

Thanks

Mark

---

From: Mark Hindley <[email-masked]>
Date: Fri, 8 Mar 2019 07:13:54 +0000

On Thu, Mar 07, 2019 at 08:21:50PM +0200, Dimitris wrote:
> On 3/7/19 8:05 PM, Mark Hindley wrote:
> unfortunately no, logs are rotated each month & deleted.

By default they get gzipped, I think. But maybe you have changed that ;)

> i might be able to find it on some old external backup, but that
> requires some extra time. will do and keep you posted.
> i do remember apart from policykit, that i switched to lightdm and
> elogind that day also, see here :

Yes, I think it may be the lightdm to slim switch.

I will check.

Thanks

Mark

---

From: Dimitris <[email-masked]>
Date: Fri, 8 Mar 2019 10:28:05 +0200

> By default they get gzipped, I think. But maybe you have changed that ;)

yes i do, never keep more than a month old files.
also checked external backup, no luck there either. :(

> Yes, I think it may be the lightdm to slim switch.

i've used lightdm since 30/1 and slim for the past days. didn't seem to
make a difference...
something else: installed yesterday consolekit & libpam-ck-connector.
parts of MATE DE were removed with this change, so it was just for testing.
result : no updates in lastlog with consolekit either...
switched back to elogind after testing, as libpam-elogind is a
dependency for DE packages i need.

thanks,
d.

---

From: Mark Hindley <[email-masked]>
Date: Fri, 8 Mar 2019 15:53:08 +0000

> user               :0                        Wed Jan 30 15:36:23 

Dimitris,

I have been looking into this. AFAICS display manager logins have never been
logged in lastlog by any of slim, lightdm, consolekit2 or elogind. So, I am not
sure there is a regression here.

I have also been struggling to work out where the user login on :0 (above) comes
from. With the default install could only reproduce logins on ptys. I eventually
managed to do it by adding pam_lastlog.so to the display manager PAM stack in
/etc/pam.d/{slim,lightdm}

Had you customised that and it was overwritten in the upgrade at the end of January?

Mark

---

From: Dimitris <[email-masked]>
Date: Fri, 8 Mar 2019 22:32:02 +0200

> Had you customised that and it was overwritten in the upgrade at the end of January?

no i haven't customised anything in pam.d. not in this install at least.
not sure either about this login on :0, you're right, it shouldn't be
there. lastlog should only report tty logins. puzzled about that entry
too now.
not having around logs from that time is not helpful, i know..

anyway, not really sure if this is a bug here. during that period
(dec-jan) i was testing different scenarios & various DEs, something
could have triggered that..
so, feel free to proceed (close?) as you like...

thanks,
d.

---

From: Mark Hindley <[email-masked]>
Date: Wed, 17 Apr 2019 11:27:08 +0100

Dimitris,

I don't think there is an elogind bug here. I think it is down the the display
manager (slim, lightdm etc) to register logins in lastlog and utmp.

AFAIK lightdm does this already and I have a patch for slim to implement it (see
#301)

So closing, as you suggest.

Thanks

Mark