github/xrdp
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add XorgNoNewPrivileges configuration option

Browse Source 
This allows Linux's no_new_privs restriction to be disabled when starting
the X server, which may be desirable if xrdp is running inside a kernel
confinement framework such as AppArmor or SELinux.
This commit is contained in:
Daniel Richard G
2023-05-13 02:14:54 -04:00
parent b191d87e33
commit fdfe47668b
5 changed files with 31 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/man/sesman.ini.5.in
+9
View File
@@ -303,6 +303,15 @@ if the group specified in \fBTerminalServerUsers\fR doesn't exist.
\fBAllowAlternateShell\fR=\fI[true|false]\fR
If set to \fB0\fR, \fBfalse\fR or \fBno\fR, prevent usage of alternate shells by users.
.TP
\fBXorgNoNewPrivileges\fR=\fI[true|false]\fR
Only applicable on Linux. If set to \fB0\fR, \fBfalse\fR or \fBno\fR, do
not use the kernel's \fIno_new_privs\fR restriction when invoking the Xorg
X11 server. The use of \fIno_new_privs\fR is intended to prevent issues due
to a setuid Xorg executable. However, if a kernel security module (such as
AppArmor) is used to confine xrdp, \fIno_new_privs\fR may interfere with
transitions between confinement domains.
.SH "X11 SERVER"
Following parameters can be used in the \fB[Xvnc]\fR and
\fB[Xorg]\fR sections.