On 28/04/2025 20:40, Stefan Monnier wrote:
That's the kind of solution I was hoping someone has developed enough to iron out those major security issues (e.g. letting GDM do the chroot before it changes its UID to that of the user).
See RootDirectory in systemd.exec(5). It can be set for specific users through user@<UID>.service.d drop-ins. Perhaps it would be necessary to create a .desktop file in /usr/share/xsessions/, I have no idea which way GDM spawns session executable (e.g. using systemd-run equivalent or not). RootDirectory affects processes started by pam_systemd and other parts of systemd user session.
Likely a container is better than simple chroot, but I have no idea if there is a simple way to start whole user session inside a container.