Bug#1040065: afpd: systemd-logind ReleaseSession rejected by dbus-daemon

[Richard van den Berg]

Package: netatalk
Version: 3.1.12~ds-8
Severity: normal
Tags: patch

I am using netatalk for time machine backups. After every session I see this
line in /var/log/auth.log

2023-07-01T22:31:47.223949+02:00 my-server dbus-daemon[1538889]: [system] Rejected send message, 2 matched rules; type="method_call", sender=":1.153636" (uid=145 pid=2690475 comm="/usr/sbin/afpd -d -F /etc/netatalk/afp.conf") interface="org.freedesktop.login1.Manager" member="ReleaseSession" error name="(unset)" requested_reply="0" destination="org.freedesktop.login1" (uid=0 pid=1538900 comm="/lib/systemd/systemd-logind")

Today I finally found the solution at https://bugs.launchpad.net/ubuntu/+source/netatalk/+bug/1538004

It is simple really, in /etc/pam.d/netatalk replace this line:

@include common-session

with this line:

@include common-session-noninteractive

-- System Information:
Debian Release: 12.0
APT prefers stable-security
APT policy: (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 6.1.0-9-amd64 (SMP w/8 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=C.UTF-8, LC_CTYPE=UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to C.UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages netatalk depends on:
ii init-system-helpers 1.65.2
ii libacl1 2.3.1-3
ii libavahi-client3 0.8-10
ii libavahi-common3 0.8-10
ii libc6 2.36-9
ii libcrack2 2.9.6-5+b1
ii libcrypt1 1:4.4.33-2
ii libdb5.3 5.3.28+dfsg2-1
ii libdbus-glib-1-2 0.112-3
ii libevent-2.1-7 2.1.12-stable-8
ii libgcrypt20 1.10.1-3
ii libglib2.0-0 2.74.6-2
ii libgssapi-krb5-2 1.20.1-2
ii libkrb5-3 1.20.1-2
ii libldap-2.4-2 2.4.57+dfsg-3+deb11u1
ii libmariadb3 1:10.11.3-1
ii libpam-modules 1.5.2-6
ii libpam0g 1.5.2-6
ii libssl1.1 1.1.1n-0+deb11u5
ii libtalloc2 2.4.0-f2
ii libtdb1 1.4.8-2
ii libtracker-sparql-2.0-0 2.3.6-2
ii libwrap0 7.6.q-32
ii lsb-base 11.6
ii netbase 6.4
ii perl 5.36.0-7
ii sysvinit-utils [lsb-base] 3.06-4

Versions of packages netatalk recommends:
ii avahi-daemon 0.8-10
ii cracklib-runtime 2.9.6-5+b1
ii dbus 1.14.6-1
ii lsof 4.95.0-1
ii procps 2:4.0.2-3
ii python3 3.11.2-1+b1
ii python3-dbus 1.3.2-4+b1
pn tracker <none>

Versions of packages netatalk suggests:
pn quota <none>

-- Configuration Files:
/etc/logcheck/ignore.d.server/netatalk [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/netatalk'
/etc/logcheck/violations.ignore.d/netatalk [Errno 13] Permission denied: '/etc/logcheck/violations.ignore.d/netatalk'
/etc/logrotate.d/netatalk changed [not included]
/etc/netatalk/afp.conf changed [not included]
/etc/pam.d/netatalk changed [not included]

-- no debconf information

[Daniel Markstedt]

On Sat, Jul 1, 2023 at 3:27 PM Richard van den Berg <ric...@vdberg.org> wrote:
>
> Package: netatalk
> Version: 3.1.12~ds-8
> Severity: normal
> Tags: patch
>
> I am using netatalk for time machine backups. After every session I see this
> line in /var/log/auth.log
>
> 2023-07-01T22:31:47.223949+02:00 my-server dbus-daemon[1538889]: [system] Rejected send message, 2 matched rules; type="method_call", sender=":1.153636" (uid=145 pid=2690475 comm="/usr/sbin/afpd -d -F /etc/netatalk/afp.conf") interface="org.freedesktop.login1.Manager" member="ReleaseSession" error name="(unset)" requested_reply="0" destination="org.freedesktop.login1" (uid=0 pid=1538900 comm="/lib/systemd/systemd-logind")
>
> Today I finally found the solution at https://bugs.launchpad.net/ubuntu/+source/netatalk/+bug/1538004
>
> It is simple really, in /etc/pam.d/netatalk replace this line:
>
> @include common-session
>
> with this line:
>
> @include common-session-noninteractive
>

Hi Richard,

Thanks for reporting and tracking down the fix.
Do I understand correctly that the fix is confirmed to resolve the
issue for you?

Now, /etc/pam.d/netatalk is obviously a generated file, so for a
persistent fix the file that needs to change is macros/pam-check.m4
I think this should ideally be fixed upstream, so if you have a moment
to spare it'd be helpful if you filed an issue ticket at
https://github.com/Netatalk/netatalk/issues

Best,
Daniel

[Richard van den Berg]

Hi Daniel,

> Thanks for reporting and tracking down the fix.
> Do I understand correctly that the fix is confirmed to resolve the
> issue for you?

Yes, it fixes the issue for me. No more dbus erorrs since I changed the
file.

> Now, /etc/pam.d/netatalk is obviously a generated file, so for a
> persistent fix the file that needs to change is macros/pam-check.m4
> I think this should ideally be fixed upstream, so if you have a moment
> to spare it'd be helpful if you filed an issue ticket at
> https://github.com/Netatalk/netatalk/issues

I have created an issue and pull-request there:

https://github.com/Netatalk/netatalk/issues/361
https://github.com/Netatalk/netatalk/pull/362

Kind regards,

Richard