The sessions listed in loginctl are created and their IDs assigned by systemd-logind (when asked by pam_systemd).
If /proc/*/loginuid and /proc/*/sessionid are available (set up by pam_loginuid), then logind directly takes the audit session ID as logind session ID. If those are not available (kernel audit support disabled), then logind itself allocates a logind session ID and adds the "c" prefix to prevent collisions with audit IDs. src/login/logind-dbus.c:870: if (asprintf(&id, "c%lu", ++m->session_counter) < 0) On Wed, Jan 11, 2023, 05:58 hai wu <haiwu...@gmail.com> wrote: > Where is the systemd sessionid like `c508` being generated? If kernel > auditd is disabled, then it seems systemd `loginctl list-sessions` > command would list user session ids all with `c` character prefix > instead. > > I could not find the source code where these session ids got > generated. Are these session ids generated from systemd source code or > from Linux kernel source code? > > systemd has this function `sd_pid_get_session` to get session id, it > seems that's parsing `/proc/self/cgroup`, instead of generating such > session ids.. > > Regards, > Hai >
