jupyterhub / jupyterhub/systemdspawner

PAM authentication fails in pam_loginuid.so

Open
#104 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
100
Forks
44
PR merge metrics
No merged PRs in 30d

Description

On my SystemdSpawner-based JupyterHub, PAM authentication fails with the following warning:

```
Mär 27 13:46:07 vm3 python[8780]: pam_loginuid(login:session): Error writing /proc/self/loginuid: Operation not permitted
Mär 27 13:46:07 vm3 python[8780]: pam_loginuid(login:session): set_loginuid failed
```

/var/log/auth.log:

```
Mar 27 13:46:07 vm3 python: pam_loginuid(login:session): Error writing /proc/self/loginuid: Operation not permitted
Mar 27 13:46:07 vm3 python: pam_loginuid(login:session): set_loginuid failed
Mar 27 13:46:07 vm3 python: pam_unix(login:session): session opened for user lukas by (uid=0)
Mar 27 13:46:07 vm3 systemd: pam_unix(systemd-user:session): session opened for user lukas by (uid=0)
```

JupyterHub runs as `root` on Ubuntu 20.04 LTS, and it has been installed via Miniconda3-py39_4.9.2-Linux-x86_64:

```bash
conda install -y jupyterhub=1.4.1 jupyter_core=4.9.1 jupyter_server=1.4.1 jupyter_client=7.0.1 ipykernel=6.4.1 notebook=6.4.0 oauthlib-3.1.1 ipython=7.29.0
conda install -c conda-forge -y jupyterhub-systemdspawner=0.15.0
```

It's worth adding that I have a similar setup (same operating system, same Miniconda version, same Conda packages), on which PAM authentication does work.

Both machines use the same PAM/Audit shared libraries (`libpam0g` 1.3.1, `libaudit1` 2.8.5) and the same Python wrapper (`pamela` 1.0.0). Also the PAM config in `/etc/pam.d` is identical on both machines.

I have temporarily disabled AppArmor to make sure that it does not interfer with the login procedure. SELinux is not installed.

As far as I can tell, the only difference between the two setups is the Linux Kernel: 5.4 (working setup) vs. 5.15 (brokensetup). However, I cannot find anything in the Linux kernel's changelog that would indicate any significant PAM-related changes.

Are you aware of issues related to PAM authentication?

Contributor guide

Open the contributing guide

Research direction

The report names no project files or tests; start by reproducing the PAM session with the listed JupyterHub, SystemdSpawner, and pamela versions on Ubuntu kernels 5.4 and 5.15. Compare the loginuid warnings and environment differences, then establish a project-relevant fix or documented cause for the authentication failure.

Written by the indexing model from the issue text.

Assessment

Tech stack
jupyter, linux, python
Domain
authentication, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.