sulogin-shell: Use force if SYSTEMD_SULOGIN_FORCE set
authorAndreas Henriksson <andreas@fatal.se>
Sun, 14 Oct 2018 12:53:09 +0000 (14:53 +0200)
committerThe Plumber <50238977+systemd-rhel-bot@users.noreply.github.com>
Mon, 8 Jun 2020 09:07:02 +0000 (11:07 +0200)
commitd8ae33a302f01601e9e98b4aca3516e93c634a54
treec89e01b84f79a18845ba9987c217a95a48fb1447
parent3569b29eb8b082229dd97b8aae60bbe4d2f96ef5
sulogin-shell: Use force if SYSTEMD_SULOGIN_FORCE set

When the root account is locked sulogin will either inform you of
this and not allow you in or if --force is used it will hand
you passwordless root (if using a recent enough version of util-linux).

Not being allowed a shell is ofcourse inconvenient, but at the same
time handing out passwordless root unconditionally is probably not
a good idea everywhere.

This patch thus allows to control which behaviour you want by
setting the SYSTEMD_SULOGIN_FORCE environment variable to true
or false to control the behaviour, eg. via adding this to
'systemctl edit rescue.service' (or emergency.service):

[Service]
Environment=SYSTEMD_SULOGIN_FORCE=1

Distributions who used locked root accounts and want the passwordless
behaviour could thus simply drop in the override file in
/etc/systemd/system/rescue.service.d/override.conf

Fixes: #7115
Addresses: https://bugs.debian.org/802211
(cherry picked from commit 33eb44fe4a8d7971b5614bc4c2d90f8d91cce66c)

Resolves: #1625929
doc/ENVIRONMENT.md
src/sulogin-shell/sulogin-shell.c