Why isn't a systemd user session started by `su`?

Question

When I use ssh to log in to the root user on my server, an entry 0 is created in /var/run/user because pam_systemd tells systemd-logind to do this. This is an indicator that a user session has been started for uid 0.

Then, when I run su jack, I still only see the 0 entry in /var/run/user; no entry has been made for this session.

However, journalctl shows that a pam session was opened, and /etc/pam.d/su includes common-session, which adds session optional pam_systemd.so. So I think that a user session should have been created.

How can I make su create a user session?

If it's relevant, I'm on Debian 11.

Answer 1

The PAM module does not create a session if the current process is already a member of an existing session. I found the following workaround to create a session from an existing session:

systemd-run --system --scope \
    su -l

Basically you run su -l inside a system level scope, this is not part of the current user session and so the PAM module will create a session for the su -l process. Once the process has been moved to the session the temporary scope is empty and will be removed.

The only issue is that your current user must have the permission to create scopes at system level and you have to authenticate twice, once for the current user to authenticate creation of the scope and then again as the user for whom you want to create a session.