Luciano Mannucci <luciano@???> writes:
> On Sat, 25 Mar 2023 09:07:43 +0100
> aitor <aitor_czr@???> wrote:
>
>> It's elogind's function:
>>
>> static int user_mkdir_runtime_path(
>>     const char *runtime_path,
>>     uid_t uid,
>>     gid_t gid,
>>     uint64_t runtime_dir_size,
>>     uint64_t runtime_dir_inodes);
>>
>> in "user-runtime-dir.c":
>>
>> https://github.com/elogind/elogind/blob/main/src/login/user-runtime-dir.c
> Thanks!!
> That's what I was thinking. Tough uninstalling the elogin package via
> apt-get did the trick on a PC running Chimaera, bun not on the PI with
> beowulf.

On my system, this directory is created by the consolekit daemon which
gets notified about a user login by the pam_ck_connector PAM module
which is part of the PAM module stack for session management defined in
/etc/pam.d/common-session (included by the dovecot, login, other, sshd
and su PAM config files).
?
Since /run/user is not world-writable, the directory must be created by
some program running as root and for an ordinary user login on a VT,
that's login. For a network session, it's going to be sshd via the same
vector.