Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add XAuthorityInSystemDir option #3393

Open
wants to merge 3 commits into
base: devel
Choose a base branch
from
Open

Add XAuthorityInSystemDir option #3393

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b61dfb1
Fix minor typo in sesman.ini(5)
matt335672 Jan 13, 2025
d2e96fe
Add XAuthorityInSystemDir option
matt335672 Jan 13, 2025
ff70842
Update manpage after review
matt335672 Jan 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion docs/man/sesman.ini.5.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ In this instance, the system administrator is responsible for ensuring
the socket can only be created by a suitably privileged process.
.PP
If the parameter does not start with a '/', a name within
@socketdir@ is used.
@socketdir@/\fI<uid>\fR is used.
.RE

.TP
Expand Down Expand Up @@ -251,6 +251,18 @@ The number of login attempts that are allowed on terminal server. If set
to \fI0\fR, unlimited attempts are allowed. If not specified, defaults to
\fI3\fR.

.TP
\fBXAuthorityInSystemDir\fR=\fI[no|yes]\fR
If set to \fBno\fR (the default), \fBXAUTHORITY\fR will not be set for
sessions, and the X11 authfile will be $HOME/.Xauthority.
.br
If set to \fByes\fR, xrdp will point \fBXAUTHORITY\fR to a file
in a system directory private to the logged-in user (currently
@socketdir@/\fI<uid>\fR/Xauthority).
.br
You may wish to use this if $HOME is NFS-mounted, or you are experiencing
other applications overwriting the default file.

.TP
\fBTerminalServerUsers\fR=\fIgroup\fR
Only the users belonging to the specified group are allowed to login on
Expand Down
7 changes: 7 additions & 0 deletions sesman/libsesman/sesman_config.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,7 @@
*/
#define SESMAN_CFG_SECURITY "Security"
#define SESMAN_CFG_SEC_LOGIN_RETRY "MaxLoginRetry"
#define SESMAN_CFG_XAUTH_IN_SYSDIR "XAuthorityInSystemDir"
#define SESMAN_CFG_SEC_ALLOW_ROOT "AllowRootLogin"
#define SESMAN_CFG_SEC_USR_GROUP "TerminalServerUsers"
#define SESMAN_CFG_SEC_ADM_GROUP "TerminalServerAdmins"
Expand Down Expand Up @@ -307,6 +308,7 @@ config_read_security(int file, struct config_security *sc,
/* setting defaults */
sc->allow_root = 0;
sc->login_retry = 3;
sc->xauth_in_sysdir = 0;
sc->restrict_outbound_clipboard = 0;
sc->restrict_inbound_clipboard = 0;
sc->allow_alternate_shell = 1;
Expand All @@ -330,6 +332,10 @@ config_read_security(int file, struct config_security *sc,
{
sc->login_retry = g_atoi(value);
}
else if (0 == g_strcasecmp(buf, SESMAN_CFG_XAUTH_IN_SYSDIR))
{
sc->xauth_in_sysdir = g_text2bool(value);
}
else if (0 == g_strcasecmp(buf, SESMAN_CFG_SEC_USR_GROUP))
{
g_free(sc->ts_users);
Expand Down Expand Up @@ -672,6 +678,7 @@ config_dump(struct config_sesman *config)
g_writeln("Security configuration:");
g_writeln(" AllowRootLogin: %d", sc->allow_root);
g_writeln(" MaxLoginRetry: %d", sc->login_retry);
g_writeln(" XAuthorityInSystemDir: %d", sc->xauth_in_sysdir);
g_writeln(" AlwaysGroupCheck: %d", sc->ts_always_group_check);
g_writeln(" AllowAlternateShell: %d", sc->allow_alternate_shell);
#ifdef HAVE_SYS_PRCTL_H
Expand Down
6 changes: 6 additions & 0 deletions sesman/libsesman/sesman_config.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,12 @@ struct config_security
* @brief maximum login attempts
*/
int login_retry;
/**
* @var x_authority_in_system_dir
* @brief Move XAUTHORITY to a system directory
*/
int xauth_in_sysdir;

/**
* @var ts_users
* @brief Terminal Server Users group
Expand Down
6 changes: 6 additions & 0 deletions sesman/sesexec/env.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,6 +162,12 @@ env_set_user(int uid, char **passwd_file, int display,
/* pulse source socket */
g_snprintf(text, sizeof(text), CHANSRV_PORT_IN_BASE_STR, display);
g_setenv("XRDP_PULSE_SOURCE_SOCKET", text, 1);
if (g_cfg->sec.xauth_in_sysdir)
{
g_snprintf(text, sizeof(text), XRDP_SOCKET_PATH "/Xauthority",
uid);
g_setenv("XAUTHORITY", text, 1);
}
if ((env_names != 0) && (env_values != 0) &&
(env_names->count == env_values->count))
{
Expand Down
1 change: 1 addition & 0 deletions sesman/sesman.ini.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ ReconnectScript=reconnectwm.sh
[Security]
AllowRootLogin=true
MaxLoginRetry=4
XAuthorityInSystemDir=no
TerminalServerUsers=tsusers
TerminalServerAdmins=tsadmins
; When AlwaysGroupCheck=false access will be permitted
Expand Down
Loading