systemd-ptybrokerd.service, systemd-ptybrokerd — Pseudo TTY Broker
systemd-ptybrokerd.service
systemd-ptybrokerd.socket
/usr/lib/systemd/systemd-ptybrokerd
systemd-ptybrokerd is a service that allocates and manages pseudo terminals
(PTYs) on behalf of clients. It allocates a PTY pair on client request — or takes possession of the
frontend (i.e. "master") side of a PTY the client already allocated — and then takes
care of the frontend side of the PTY: whatever is written to the PTY is either discarded or forwarded to
the log, and may at any time be monitored and interactively attached to. The backend (i.e.
"slave") side of the PTY is handed back to the client, which typically invokes some
payload with its standard input/output/error connected to it. At the client's request the broker may also
invoke a shell on the backend side itself, as a transient service unit. When running as part of the
system service manager, such shell sessions run through the "systemd-ptybroker-shell"
PAM stack.
This mechanism decouples the lifetime and management of a PTY from the process that requested it: the terminal of a service, container, virtual machine or shell session managed by the broker exists independently of any interactive client, may be monitored or attached to at any time (also by multiple clients simultaneously), and continues to operate — logging output, if configured — when no client is attached at all. It hence provides terminal semantics for otherwise non-interactive contexts, for example fully headless systems.
The service is used by various other components:
The service manager connects the standard input/output/error of services to a
broker-provided PTY if StandardInput=broker,
StandardOutput=broker, StandardError=broker (or their
broker-log flavours) are used, see
systemd.exec(5).
systemd-pty-forward(1)
invokes arbitrary commands on a broker-provided PTY via
--console=broker/--console=broker-log.
systemd-nspawn(1)
and
systemd-vmspawn(1)
register the console of a container or virtual machine with the broker via their
--console=broker/--console=broker-log switches.
run0(1) requests interactive privileged shell sessions from the broker.
PTYs managed by the broker may be listed, monitored, interactively attached to, and hung up with the ptyctl(1) tool.
The service is available both as a system service and as a per-user service. The system instance
brokers PTYs for system services and privileged clients, the user instances do the same for the
respective user's service manager and clients. Both instances are socket activated (via
systemd-ptybrokerd.socket) and exit automatically again once they are idle, i.e.
when no client is connected and no PTY is registered anymore.
The service provides the io.systemd.PTYBroker Varlink IPC interface on /run/systemd/io.systemd.PTYBroker
(for the system instance) and $XDG_RUNTIME_DIR/systemd/io.systemd.PTYBroker (for
the user instances). Access to the operations of the system instance is gated via polkit.