I have been working on guest account support in GDM but due to the difficulty of this this work has been shelved for now to focus on other tasks (mostly GNOME Software).
The solution I was working towards was to manage account creation in AccountsService (the previous support in LightDM had the LightDM daemon doing this). This makes the accounts easier to identify as guest accounts and means the guest account can be enable / disabled by storing a flag in AccountsService (this previously required a config file in LightDM).
We still have the issue that the display manager failing to clean up guest accounts correctly leaves them lying around. They are easier to identify once AccountsService is involved as they are flagged as guest accounts. It was discussed previously that systemd could be used for temporary accounts, but this seemed to me to be more difficult than using AccountsService.
What work exists today:
- A patch to AccountsService in the
git.freedesktop.org). This adds new D-Bus methods
DeleteGuest. This patch works.
- A patch to GDM in the
wip/rancell/guestbranch. This allows a GDM greeter to log into a guest account by adding the D-Bus API for the greeter and passing it through the GDM layers to the core. I haven’t been able to get this branch to work, and I think part of the issue may be the Polkit checks in AccountsService don’t let GDM create the accounts (even though it is root).
- A patch to GNOME Shell that shows a guest option on the greeter. This is a bit hacky and would need some cleaning up / restructuring to be suitable upstream.
The main difficulties I have encountered are:
- The many layers of GDM make it very hard to work out the appropriate way to pass through the requests.
- GNOME Shell uses the GDM interface which is very complex and not well abstracted. This means there are a number of places when it needs to be modified to interact with the guest support.
- GNOME Shell is very tied to the AccountsService objects for showing users. My patch hacked up a compatible JS object but Shell should probably support both “real” users and virtual ones.