Rework starting of Xorg to use setpriv, directly from xrdp.
Document SELinux deficiencies.
This commit is contained in:
Bojan Smojver
parent
0e2197f37f
commit
c89b807752
@ -27,3 +27,14 @@ account not logged onto the console will be used. To avoid Xorg.wrap refusing
|
|||||||
to run, put the following into /etc/X11/Xwrapper.config:
|
to run, put the following into /etc/X11/Xwrapper.config:
|
||||||
|
|
||||||
allowed_users = anybody
|
allowed_users = anybody
|
||||||
|
|
||||||
|
SELinux
|
||||||
|
=======
|
||||||
|
|
||||||
|
Please note that you may need to add an SELinux policy module in order to run
|
||||||
|
xrdp successfully under Fedora with SELinux enabled. One way to do this is to
|
||||||
|
put SELinux into permissive mode and build the policy from the denials you see
|
||||||
|
in the audit logs.
|
||||||
|
|
||||||
|
We are working on making this part of the default installation, but it is not
|
||||||
|
quite there yet as of this writing.
|
||||||
|
|||||||
@ -28,12 +28,3 @@
|
|||||||
|
|
||||||
[Xvnc]
|
[Xvnc]
|
||||||
param=Xvnc
|
param=Xvnc
|
||||||
@@ -71,6 +71,8 @@
|
|
||||||
param=96
|
|
||||||
|
|
||||||
[Xorg]
|
|
||||||
+param=setpriv
|
|
||||||
+param=--no-new-privs
|
|
||||||
param=Xorg
|
|
||||||
param=-config
|
|
||||||
param=xrdp/xorg.conf
|
|
||||||
|
|||||||
54
xrdp-0.9.2-setpriv.patch
Normal file
54
xrdp-0.9.2-setpriv.patch
Normal file
@ -0,0 +1,54 @@
|
|||||||
|
diff -ruN xrdp-0.9.2-vanilla/sesman/session.c xrdp-0.9.2/sesman/session.c
|
||||||
|
--- xrdp-0.9.2-vanilla/sesman/session.c 2017-03-30 17:18:55.000000000 +1100
|
||||||
|
+++ xrdp-0.9.2/sesman/session.c 2017-04-08 15:51:58.738246971 +1000
|
||||||
|
@@ -33,10 +33,6 @@
|
||||||
|
#include "config_ac.h"
|
||||||
|
#endif
|
||||||
|
|
||||||
|
-#ifdef HAVE_SYS_PRCTL_H
|
||||||
|
-#include <sys/prctl.h>
|
||||||
|
-#endif
|
||||||
|
-
|
||||||
|
#include "sesman.h"
|
||||||
|
#include "libscp_types.h"
|
||||||
|
#include "xauth.h"
|
||||||
|
@@ -641,20 +637,7 @@
|
||||||
|
|
||||||
|
if (type == SESMAN_SESSION_TYPE_XORG)
|
||||||
|
{
|
||||||
|
-#ifdef HAVE_SYS_PRCTL_H
|
||||||
|
- /*
|
||||||
|
- * Make sure Xorg doesn't run setuid root. Root access is not
|
||||||
|
- * needed. Xorg can fail when run as root and the user has no
|
||||||
|
- * console permissions.
|
||||||
|
- * PR_SET_NO_NEW_PRIVS requires Linux kernel 3.5 and newer.
|
||||||
|
- */
|
||||||
|
- if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0)
|
||||||
|
- {
|
||||||
|
- log_message(LOG_LEVEL_WARNING,
|
||||||
|
- "Failed to disable setuid on X server: %s",
|
||||||
|
- g_get_strerror());
|
||||||
|
- }
|
||||||
|
-#endif
|
||||||
|
+ char *setpriv = g_strdup("setpriv");
|
||||||
|
|
||||||
|
xserver_params = list_create();
|
||||||
|
xserver_params->auto_free = 1;
|
||||||
|
@@ -663,6 +646,8 @@
|
||||||
|
xserver = g_strdup((const char *)list_get_item(g_cfg->xorg_params, 0));
|
||||||
|
|
||||||
|
/* these are the must have parameters */
|
||||||
|
+ list_add_item(xserver_params, (tintptr) setpriv);
|
||||||
|
+ list_add_item(xserver_params, (tintptr) g_strdup("--no-new-privs"));
|
||||||
|
list_add_item(xserver_params, (tintptr) g_strdup(xserver));
|
||||||
|
list_add_item(xserver_params, (tintptr) g_strdup(screen));
|
||||||
|
list_add_item(xserver_params, (tintptr) g_strdup("-auth"));
|
||||||
|
@@ -686,7 +671,7 @@
|
||||||
|
g_setenv("XRDP_START_HEIGHT", geometry, 1);
|
||||||
|
|
||||||
|
/* fire up Xorg */
|
||||||
|
- g_execvp(xserver, pp1);
|
||||||
|
+ g_execvp(setpriv, pp1);
|
||||||
|
}
|
||||||
|
else if (type == SESMAN_SESSION_TYPE_XVNC)
|
||||||
|
{
|
||||||
@ -4,7 +4,7 @@ Summary: Open source remote desktop protocol (RDP) server
|
|||||||
Name: xrdp
|
Name: xrdp
|
||||||
Epoch: 1
|
Epoch: 1
|
||||||
Version: 0.9.2
|
Version: 0.9.2
|
||||||
Release: 4%{?dist}
|
Release: 5%{?dist}
|
||||||
License: ASL 2.0
|
License: ASL 2.0
|
||||||
Group: Applications/Internet
|
Group: Applications/Internet
|
||||||
URL: http://www.xrdp.org/
|
URL: http://www.xrdp.org/
|
||||||
@ -17,6 +17,7 @@ Source5: README.Fedora
|
|||||||
Patch0: xrdp-0.9.2-sesman.patch
|
Patch0: xrdp-0.9.2-sesman.patch
|
||||||
Patch1: xrdp-0.9.2-xrdp-ini.patch
|
Patch1: xrdp-0.9.2-xrdp-ini.patch
|
||||||
Patch2: xrdp-0.9.2-service.patch
|
Patch2: xrdp-0.9.2-service.patch
|
||||||
|
Patch3: xrdp-0.9.2-setpriv.patch
|
||||||
|
|
||||||
BuildRequires: libX11-devel
|
BuildRequires: libX11-devel
|
||||||
BuildRequires: libXfixes-devel
|
BuildRequires: libXfixes-devel
|
||||||
@ -63,8 +64,6 @@ echo '#!/bin/bash -l
|
|||||||
. %{_sysconfdir}/xrdp/startwm.sh' > sesman/startwm-bash.sh
|
. %{_sysconfdir}/xrdp/startwm.sh' > sesman/startwm-bash.sh
|
||||||
|
|
||||||
%build
|
%build
|
||||||
# Do not detect prctl.h
|
|
||||||
export ac_cv_header_sys_prctl_h=no
|
|
||||||
%configure --enable-fuse --enable-pixman --enable-painter
|
%configure --enable-fuse --enable-pixman --enable-painter
|
||||||
%make_build
|
%make_build
|
||||||
|
|
||||||
@ -192,6 +191,9 @@ chmod 400 %{_sysconfdir}/xrdp/key.pem
|
|||||||
%{_libdir}/pkgconfig/rfxcodec.pc
|
%{_libdir}/pkgconfig/rfxcodec.pc
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Sat Apr 8 2017 Bojan Smojver <bojan@rexurive.com> - 1:0.9.2-5
|
||||||
|
- Rework call to Xorg to use setpriv instead, properly
|
||||||
|
|
||||||
* Fri Apr 7 2017 Bojan Smojver <bojan@rexurive.com> - 1:0.9.2-4
|
* Fri Apr 7 2017 Bojan Smojver <bojan@rexurive.com> - 1:0.9.2-4
|
||||||
- Do not call prctl() from xrdp, use setpriv instead
|
- Do not call prctl() from xrdp, use setpriv instead
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user