41 lines
1.5 KiB
Plaintext
41 lines
1.5 KiB
Plaintext
Restarts
|
|
========
|
|
|
|
Service restarts after RPM package upgrades have been disabled on purpose.
|
|
This is to avoid a situation where an update is performed from within a
|
|
session running on xrdp, which can then cause dnf to only perform part of the
|
|
transaction and leave the system in a state that requires further manual
|
|
intervention, including removal of duplicate packages etc.
|
|
|
|
So, it will be up to the user/admin to restart xrdp service after any RPM
|
|
package upgrade. This is in line with what other GUI systems like Xorg and
|
|
Wayland do.
|
|
|
|
xorgxrdp
|
|
========
|
|
|
|
On Fedora, /usr/bin/Xorg is a script that starts either
|
|
/usr/libexec/Xorg.wrap, which is a SUID binary, or /usr/libexec/Xorg, if the
|
|
former does not exist. Xrdp binary makes sure that SUID of the Xorg.wrap
|
|
binary is not obeyed.
|
|
|
|
However, the Xorg.wrap has an additional hurdle to clear, because by default,
|
|
it will only allow users logged into the console to start it.
|
|
|
|
So, in order to run the Xorg xrdp session via xrogxrdp, normally a user
|
|
account not logged onto the console will be used. To avoid Xorg.wrap refusing
|
|
to run, put the following into /etc/X11/Xwrapper.config:
|
|
|
|
allowed_users = anybody
|
|
|
|
SELinux
|
|
=======
|
|
|
|
Please note that you may need to add an SELinux policy module in order to run
|
|
xrdp successfully under Fedora with SELinux enabled. One way to do this is to
|
|
put SELinux into permissive mode and build the policy from the denials you see
|
|
in the audit logs.
|
|
|
|
We are working on making this part of the default installation, but it is not
|
|
quite there yet as of this writing.
|