This is really a bug in the libpam-ck-connector PAM integration. It shouldn't be in common-session, but in /etc/pam.d/login only.
/usr/share/pam-configs/consolekit already says "Session-Interactive-Only: yes", so pam-auth-update shoudln't put it in common-session in the first place (as this is also called for cron and the like)?
If pam-auth-update can't put stuff into /etc/pam.d/login, then we need to work around this in consolekit itself and filter out system users.
This is really a bug in the libpam-ck-connector PAM integration. It shouldn't be in common-session, but in /etc/pam.d/login only. pam-configs/ consolekit already says "Session- Interactive- Only: yes", so pam-auth-update shoudln't put it in common-session in the first place (as this is also called for cron and the like)?
/usr/share/
If pam-auth-update can't put stuff into /etc/pam.d/login, then we need to work around this in consolekit itself and filter out system users.