From 14612e89c82b13c469434dbb925a2670bfa9872d Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Sun, 31 Dec 2023 09:51:24 +1100 Subject: [PATCH 01/62] Update to 0.9.24 --- .gitignore | 1 + sources | 2 +- xrdp.spec | 5 ++++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index d82c978..d521d95 100644 --- a/.gitignore +++ b/.gitignore @@ -29,3 +29,4 @@ xrdp-cvs-03-17-2010.tar.gz /xrdp-0.9.22.1.tar.gz /xrdp-0.9.23.tar.gz /xrdp-0.9.23.1.tar.gz +/xrdp-0.9.24.tar.gz diff --git a/sources b/sources index 6732db7..c2f7c77 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (xrdp-0.9.23.1.tar.gz) = 92b732b85afe49c49c103c37404c66aa24fddf1583a91ec4a691044a8f02ec1abd7c834a6e0f06469e3a3bfe9fae69d90759a7ea6904ccf468271309b1fe5577 +SHA512 (xrdp-0.9.24.tar.gz) = fbb79d407878fe12b25b66e86a4d535afa1a9b4794c5ce2ce1f1e37d1e728d3c255c5026ff1c32684f8c3085576b67b81ab55361732959914c3906012fbfec82 diff --git a/xrdp.spec b/xrdp.spec index af3724b..0e1f964 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -16,7 +16,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 -Version: 0.9.23.1 +Version: 0.9.24 Release: 1%{?dist} License: ASL 2.0 and GPLv2+ and MIT URL: http://www.xrdp.org/ @@ -298,6 +298,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Sun Dec 31 2023 Bojan Smojver - 1:0.9.24-1 +- Update to 0.9.24 + * Thu Sep 28 2023 Bojan Smojver - 1:0.9.23.1-1 - Update to 0.9.23.1 - CVE-2023-42822 From add9bfa26479739601172f46213c128fed1b89b4 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Sun, 31 Dec 2023 11:49:46 +1100 Subject: [PATCH 02/62] Remove already applied patch affecting compilation on EL7 --- xrdp-0.9.22.1-no-c99.patch | 16 ---------------- xrdp.spec | 4 +--- 2 files changed, 1 insertion(+), 19 deletions(-) delete mode 100644 xrdp-0.9.22.1-no-c99.patch diff --git a/xrdp-0.9.22.1-no-c99.patch b/xrdp-0.9.22.1-no-c99.patch deleted file mode 100644 index 9e3d740..0000000 --- a/xrdp-0.9.22.1-no-c99.patch +++ /dev/null @@ -1,16 +0,0 @@ -diff -rup xrdp-0.9.22.1-v/sesman/chansrv/sound.c xrdp-0.9.22.1/sesman/chansrv/sound.c ---- xrdp-0.9.22.1-v/sesman/chansrv/sound.c 2023-05-23 10:18:50.000000000 +1000 -+++ xrdp-0.9.22.1/sesman/chansrv/sound.c 2023-05-23 12:35:50.273215167 +1000 -@@ -1116,9 +1116,11 @@ process_pcm_message(int id, int size, st - char *buf = (char *) g_malloc(g_bbuf_size, 0); - if (buf != NULL) - { -+ int i; -+ - silence_start_time = g_time3(); - sending_silence = 1; -- for (int i = 0; i < send_silence_times; i++) -+ for (i = 0; i < send_silence_times; i++) - { - g_memset(buf, 0, g_bbuf_size); - sound_send_wave_data_chunk(buf, g_bbuf_size); diff --git a/xrdp.spec b/xrdp.spec index 0e1f964..29dab9d 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -38,9 +38,6 @@ Patch6: xrdp-0.9.18-vnc-uninit.patch %if 0%{?fedora} >= 32 || 0%{?rhel} >= 8 Patch7: xrdp-0.9.20-sesman-ini.patch %endif -%if ! 0%{?fedora} && 0%{?rhel} <= 7 -Patch8: xrdp-0.9.22.1-no-c99.patch -%endif BuildRequires: make BuildRequires: gcc @@ -300,6 +297,7 @@ fi %changelog * Sun Dec 31 2023 Bojan Smojver - 1:0.9.24-1 - Update to 0.9.24 +- Remove already applied patch affecting compilation on EL7 * Thu Sep 28 2023 Bojan Smojver - 1:0.9.23.1-1 - Update to 0.9.23.1 From 4252753eb9d0471e775b3ff702bfe0336ebed793 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 27 Jan 2024 10:08:54 +0000 Subject: [PATCH 03/62] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- xrdp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xrdp.spec b/xrdp.spec index 29dab9d..7f5a3cb 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -17,7 +17,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.9.24 -Release: 1%{?dist} +Release: 2%{?dist} License: ASL 2.0 and GPLv2+ and MIT URL: http://www.xrdp.org/ Source0: https://github.com/neutrinolabs/xrdp/releases/download/v%{version}/xrdp-%{version}.tar.gz @@ -295,6 +295,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Sat Jan 27 2024 Fedora Release Engineering - 1:0.9.24-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sun Dec 31 2023 Bojan Smojver - 1:0.9.24-1 - Update to 0.9.24 - Remove already applied patch affecting compilation on EL7 From 05b4d9a5b90492f5e90c3e768be30f41f5375cd3 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Tue, 12 Mar 2024 09:29:28 +1100 Subject: [PATCH 04/62] Initial work on build of 0.10.0 --- xrdp-0.10.0-scripts-libexec.patch | 38 +++++++++++++++++ xrdp-0.10.0-service.patch | 23 ++++++++++ xrdp-0.10.0-xrdp-ini.patch | 44 +++++++++++++++++++ xrdp-0.9.10-scripts-libexec.patch | 37 ---------------- xrdp-0.9.17-xrdp-ini.patch | 70 ------------------------------- xrdp-0.9.4-service.patch | 47 --------------------- xrdp.spec | 32 ++++++++------ 7 files changed, 125 insertions(+), 166 deletions(-) create mode 100644 xrdp-0.10.0-scripts-libexec.patch create mode 100644 xrdp-0.10.0-service.patch create mode 100644 xrdp-0.10.0-xrdp-ini.patch delete mode 100644 xrdp-0.9.10-scripts-libexec.patch delete mode 100644 xrdp-0.9.17-xrdp-ini.patch delete mode 100644 xrdp-0.9.4-service.patch diff --git a/xrdp-0.10.0-scripts-libexec.patch b/xrdp-0.10.0-scripts-libexec.patch new file mode 100644 index 0000000..8970300 --- /dev/null +++ b/xrdp-0.10.0-scripts-libexec.patch @@ -0,0 +1,38 @@ +--- xrdp-0.10.0-beta.1/sesman/libsesman/sesman_config.c.o 2024-03-11 14:21:33.295277249 +1100 ++++ xrdp-0.10.0-beta.1/sesman/libsesman/sesman_config.c 2024-03-11 14:24:16.114048106 +1100 +@@ -249,14 +249,14 @@ config_read_globals(int file, struct con + cf->default_wm = g_strdup("startwm.sh"); + } + /* if default_wm doesn't begin with '/', it's a relative path to +- * XRDP_CFG_PATH */ ++ * /usr/libexec/xrdp */ + if (cf->default_wm[0] != '/') + { + /* sizeof operator returns string length including null terminator */ +- int length = (sizeof(XRDP_CFG_PATH) + ++ int length = (sizeof("/usr/libexec/xrdp") + + g_strlen(cf->default_wm) + 1); /* '/' */ + char *buf = (char *)g_malloc(length, 0); +- g_sprintf(buf, "%s/%s", XRDP_CFG_PATH, cf->default_wm); ++ g_sprintf(buf, "%s/%s", "/usr/libexec/xrdp", cf->default_wm); + g_free(cf->default_wm); + cf->default_wm = buf; + } +@@ -267,14 +267,14 @@ config_read_globals(int file, struct con + cf->reconnect_sh = g_strdup("reconnectwm.sh"); + } + /* if reconnect_sh doesn't begin with '/', it's a relative path to +- * XRDP_CFG_PATH */ ++ * /usr/libexec/xrdp */ + if (cf->reconnect_sh[0] != '/') + { + /* sizeof operator returns string length including null terminator */ +- int length = (sizeof(XRDP_CFG_PATH) + ++ int length = (sizeof("/usr/libexec/xrdp") + + g_strlen(cf->reconnect_sh) + 1); /* '/' */ + char *buf = (char *)g_malloc(length, 0); +- g_sprintf(buf, "%s/%s", XRDP_CFG_PATH, cf->reconnect_sh); ++ g_sprintf(buf, "%s/%s", "/usr/libexec/xrdp", cf->reconnect_sh); + g_free(cf->reconnect_sh); + cf->reconnect_sh = buf; + } diff --git a/xrdp-0.10.0-service.patch b/xrdp-0.10.0-service.patch new file mode 100644 index 0000000..4dd9f76 --- /dev/null +++ b/xrdp-0.10.0-service.patch @@ -0,0 +1,23 @@ +--- xrdp-0.10.0-beta.1/instfiles/xrdp.service.in.o 2024-03-10 02:06:29.000000000 +1100 ++++ xrdp-0.10.0-beta.1/instfiles/xrdp.service.in 2024-03-11 14:10:31.607973918 +1100 +@@ -2,7 +2,7 @@ + Description=xrdp daemon + Documentation=man:xrdp(8) man:xrdp.ini(5) + Requires=xrdp-sesman.service +-After=network.target xrdp-sesman.service ++After=xrdp-sesman.service + + [Service] + Type=exec +--- xrdp-0.10.0-beta.1/instfiles/xrdp-sesman.service.in.o 2024-03-11 14:14:12.510062559 +1100 ++++ xrdp-0.10.0-beta.1/instfiles/xrdp-sesman.service.in 2024-03-11 14:11:27.817255389 +1100 +@@ -1,7 +1,8 @@ + [Unit] + Description=xrdp session manager + Documentation=man:xrdp-sesman(8) man:sesman.ini(5) +-After=network.target ++Wants=network-online.target nss-lookup.target nss-user-lookup.target ++After=network-online.target nss-lookup.target nss-user-lookup.target + StopWhenUnneeded=true + BindsTo=xrdp.service + diff --git a/xrdp-0.10.0-xrdp-ini.patch b/xrdp-0.10.0-xrdp-ini.patch new file mode 100644 index 0000000..0492918 --- /dev/null +++ b/xrdp-0.10.0-xrdp-ini.patch @@ -0,0 +1,44 @@ +--- xrdp-0.10.0-beta.1/xrdp/xrdp.ini.o 2024-03-11 13:59:30.562337578 +1100 ++++ xrdp-0.10.0-beta.1/xrdp/xrdp.ini 2024-03-11 14:01:38.713716136 +1100 +@@ -231,13 +231,13 @@ xrdpvr=true + ; Some session types such as Xorg and Xvnc start a display server. + ; Startup command-line parameters for the display server are configured + ; in sesman.ini. See and configure also sesman.ini. +-[Xorg] +-name=Xorg +-lib=libxup.so +-username=ask +-password=ask +-port=-1 +-code=20 ++#[Xorg] ++#name=Xorg ++#lib=libxup.so ++#username=ask ++#password=ask ++#port=-1 ++#code=20 + + [Xvnc] + name=Xvnc +@@ -259,13 +259,13 @@ port=-1 + ; Generic VNC Proxy + ; Tailor this to specific hosts and VNC instances by specifying an ip + ; and port and setting a suitable name. +-[vnc-any] +-name=vnc-any +-lib=libvnc.so +-ip=ask +-port=ask5900 +-username=na +-password=ask ++#[vnc-any] ++#name=vnc-any ++#lib=libvnc.so ++#ip=ask ++#port=ask5900 ++#username=na ++#password=ask + #pamusername=asksame + #pampassword=asksame + #delay_ms=2000 diff --git a/xrdp-0.9.10-scripts-libexec.patch b/xrdp-0.9.10-scripts-libexec.patch deleted file mode 100644 index e5f17d0..0000000 --- a/xrdp-0.9.10-scripts-libexec.patch +++ /dev/null @@ -1,37 +0,0 @@ -diff -ruN xrdp-0.9.10-v/sesman/config.c xrdp-0.9.10/sesman/config.c ---- xrdp-0.9.10-v/sesman/config.c 2019-04-18 15:38:26.000000000 +1000 -+++ xrdp-0.9.10/sesman/config.c 2019-05-03 07:59:36.784643398 +1000 -@@ -179,13 +179,13 @@ - g_free(cf->default_wm); - cf->default_wm = g_strdup("startwm.sh"); - } -- /* if default_wm doesn't begin with '/', it's a relative path to XRDP_CFG_PATH */ -+ /* if default_wm doesn't begin with '/', it's a relative path to /usr/libexec/xrdp */ - if (cf->default_wm[0] != '/') - { - /* sizeof operator returns string length including null terminator */ -- length = sizeof(XRDP_CFG_PATH) + g_strlen(cf->default_wm) + 1; /* '/' */ -+ length = sizeof("/usr/libexec/xrdp") + g_strlen(cf->default_wm) + 1; /* '/' */ - buf = (char *)g_malloc(length, 0); -- g_sprintf(buf, "%s/%s", XRDP_CFG_PATH, cf->default_wm); -+ g_sprintf(buf, "%s/%s", "/usr/libexec/xrdp", cf->default_wm); - g_free(cf->default_wm); - cf->default_wm = g_strdup(buf); - g_free(buf); -@@ -200,13 +200,13 @@ - g_free(cf->reconnect_sh); - cf->reconnect_sh = g_strdup("reconnectwm.sh"); - } -- /* if reconnect_sh doesn't begin with '/', it's a relative path to XRDP_CFG_PATH */ -+ /* if reconnect_sh doesn't begin with '/', it's a relative path to /usr/libexec/xrdp */ - if (cf->reconnect_sh[0] != '/') - { - /* sizeof operator returns string length including null terminator */ -- length = sizeof(XRDP_CFG_PATH) + g_strlen(cf->reconnect_sh) + 1; /* '/' */ -+ length = sizeof("/usr/libexec/xrdp") + g_strlen(cf->reconnect_sh) + 1; /* '/' */ - buf = (char *)g_malloc(length, 0); -- g_sprintf(buf, "%s/%s", XRDP_CFG_PATH, cf->reconnect_sh); -+ g_sprintf(buf, "%s/%s", "/usr/libexec/xrdp", cf->reconnect_sh); - g_free(cf->reconnect_sh); - cf->reconnect_sh = g_strdup(buf); - g_free(buf); diff --git a/xrdp-0.9.17-xrdp-ini.patch b/xrdp-0.9.17-xrdp-ini.patch deleted file mode 100644 index d2e8ea0..0000000 --- a/xrdp-0.9.17-xrdp-ini.patch +++ /dev/null @@ -1,70 +0,0 @@ -diff -ruN xrdp-0.9.17-v/xrdp/xrdp.ini xrdp-0.9.17/xrdp/xrdp.ini ---- xrdp-0.9.17-v/xrdp/xrdp.ini 2021-09-01 11:32:12.000000000 +1000 -+++ xrdp-0.9.17/xrdp/xrdp.ini 2021-09-01 13:06:55.525816406 +1000 -@@ -203,14 +203,14 @@ - ; Some session types such as Xorg, X11rdp and Xvnc start a display server. - ; Startup command-line parameters for the display server are configured - ; in sesman.ini. See and configure also sesman.ini. --[Xorg] --name=Xorg --lib=libxup.so --username=ask --password=ask --ip=127.0.0.1 --port=-1 --code=20 -+#[Xorg] -+#name=Xorg -+#lib=libxup.so -+#username=ask -+#password=ask -+#ip=127.0.0.1 -+#port=-1 -+#code=20 - - [Xvnc] - name=Xvnc -@@ -232,13 +232,13 @@ - ; Generic VNC Proxy - ; Tailor this to specific hosts and VNC instances by specifying an ip - ; and port and setting a suitable name. --[vnc-any] --name=vnc-any --lib=libvnc.so --ip=ask --port=ask5900 --username=na --password=ask -+#[vnc-any] -+#name=vnc-any -+#lib=libvnc.so -+#ip=ask -+#port=ask5900 -+#username=na -+#password=ask - #pamusername=asksame - #pampassword=asksame - #pamsessionmng=127.0.0.1 -@@ -247,15 +247,15 @@ - ; Generic RDP proxy using NeutrinoRDP - ; Tailor this to specific hosts by specifying an ip and port and setting - ; a suitable name. --[neutrinordp-any] --name=neutrinordp-any -+#[neutrinordp-any] -+#name=neutrinordp-any - ; To use this section, you should build xrdp with configure option - ; --enable-neutrinordp. --lib=libxrdpneutrinordp.so --ip=ask --port=ask3389 --username=ask --password=ask -+#lib=libxrdpneutrinordp.so -+#ip=ask -+#port=ask3389 -+#username=ask -+#password=ask - ; Uncomment the following lines to enable PAM authentication for proxy - ; connections. - #pamusername=ask diff --git a/xrdp-0.9.4-service.patch b/xrdp-0.9.4-service.patch deleted file mode 100644 index 21c259d..0000000 --- a/xrdp-0.9.4-service.patch +++ /dev/null @@ -1,47 +0,0 @@ -diff -ruN xrdp-0.9.4-v/instfiles/xrdp.service.in xrdp-0.9.4/instfiles/xrdp.service.in ---- xrdp-0.9.4-v/instfiles/xrdp.service.in 2017-07-19 14:23:49.000000000 +1000 -+++ xrdp-0.9.4/instfiles/xrdp.service.in 2017-10-06 14:29:13.910973750 +1100 -@@ -2,15 +2,11 @@ - Description=xrdp daemon - Documentation=man:xrdp(8) man:xrdp.ini(5) - Requires=xrdp-sesman.service --After=network.target xrdp-sesman.service -+After=xrdp-sesman.service - - [Service] --Type=forking --PIDFile=@localstatedir@/run/xrdp.pid --EnvironmentFile=-@sysconfdir@/sysconfig/xrdp --EnvironmentFile=-@sysconfdir@/default/xrdp --ExecStart=@sbindir@/xrdp $XRDP_OPTIONS --ExecStop=@sbindir@/xrdp $XRDP_OPTIONS --kill -+EnvironmentFile=@sysconfdir@/sysconfig/xrdp -+ExecStart=@sbindir@/xrdp $XRDP_OPTIONS --nodaemon - - [Install] - WantedBy=multi-user.target -diff -ruN xrdp-0.9.4-v/instfiles/xrdp-sesman.service.in xrdp-0.9.4/instfiles/xrdp-sesman.service.in ---- xrdp-0.9.4-v/instfiles/xrdp-sesman.service.in 2017-07-19 14:23:49.000000000 +1000 -+++ xrdp-0.9.4/instfiles/xrdp-sesman.service.in 2017-10-06 14:29:13.910973750 +1100 -@@ -1,17 +1,14 @@ - [Unit] - Description=xrdp session manager - Documentation=man:xrdp-sesman(8) man:sesman.ini(5) --After=network.target -+Wants=network-online.target nss-lookup.target nss-user-lookup.target -+After=network-online.target nss-lookup.target nss-user-lookup.target - StopWhenUnneeded=true - BindsTo=xrdp.service - - [Service] --Type=forking --PIDFile=@localstatedir@/run/xrdp-sesman.pid --EnvironmentFile=-@sysconfdir@/sysconfig/xrdp --EnvironmentFile=-@sysconfdir@/default/xrdp --ExecStart=@sbindir@/xrdp-sesman $SESMAN_OPTIONS --ExecStop=@sbindir@/xrdp-sesman $SESMAN_OPTIONS --kill -+EnvironmentFile=@sysconfdir@/sysconfig/xrdp -+ExecStart=@sbindir@/xrdp-sesman $SESMAN_OPTIONS --nodaemon - - [Install] - WantedBy=multi-user.target diff --git a/xrdp.spec b/xrdp.spec index 7f5a3cb..0d38388 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -13,14 +13,18 @@ %global _missing_braces -Wno-error=missing-braces %endif +%global pre_number beta.1 +%global pre_release 0.%{pre_number}. +%global pre_version -%{pre_number} + Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 -Version: 0.9.24 -Release: 2%{?dist} +Version: 0.10.0 +Release: %{pre_release}1%{?dist} License: ASL 2.0 and GPLv2+ and MIT URL: http://www.xrdp.org/ -Source0: https://github.com/neutrinolabs/xrdp/releases/download/v%{version}/xrdp-%{version}.tar.gz +Source0: https://github.com/neutrinolabs/xrdp/releases/download/v%{version}%{pre_version}/xrdp-%{version}%{pre_version}.tar.gz Source1: xrdp-sesman.pamd Source2: xrdp.sysconfig Source3: xrdp.logrotate @@ -29,9 +33,9 @@ Source5: README.Fedora Source6: xrdp.te Source7: xrdp-polkit-1.rules Patch0: xrdp-0.9.9-sesman.patch -Patch1: xrdp-0.9.17-xrdp-ini.patch -Patch2: xrdp-0.9.4-service.patch -Patch3: xrdp-0.9.10-scripts-libexec.patch +Patch1: xrdp-0.10.0-xrdp-ini.patch +Patch2: xrdp-0.10.0-service.patch +Patch3: xrdp-0.10.0-scripts-libexec.patch Patch4: xrdp-0.9.6-script-interpreter.patch Patch5: xrdp-0.9.16-arch.patch Patch6: xrdp-0.9.18-vnc-uninit.patch @@ -100,7 +104,7 @@ Requires(postun): /usr/sbin/semodule This package contains SELinux policy module necessary to run xrdp. %prep -%autosetup -p1 +%autosetup -p1 -n %{name}-%{version}%{pre_version} %{__cp} %{SOURCE5} . # SELinux policy module @@ -236,11 +240,14 @@ fi %exclude %ghost %{_sysconfdir}/xrdp/rsakeys.ini %{_libexecdir}/xrdp/startwm*.sh %{_libexecdir}/xrdp/reconnectwm.sh +%{_libexecdir}/xrdp/waitforx +%{_libexecdir}/xrdp/xrdp-sesexec %{_bindir}/xrdp-genkeymap %{_bindir}/xrdp-sesadmin %{_bindir}/xrdp-keygen %{_bindir}/xrdp-sesrun %{_bindir}/xrdp-dis +%{_bindir}/xrdp-dumpfv1 %{_sbindir}/xrdp-chansrv %{_sbindir}/xrdp %{_sbindir}/xrdp-sesman @@ -249,18 +256,18 @@ fi %{_datadir}/xrdp/cursor1.cur %{_datadir}/xrdp/xrdp256.bmp %{_datadir}/xrdp/sans-10.fv1 +%{_datadir}/xrdp/sans-18.fv1 %{_datadir}/xrdp/ad24b.bmp %{_datadir}/xrdp/xrdp24b.bmp %{_datadir}/xrdp/xrdp_logo.bmp +%{_datadir}/xrdp/xrdp_logo.png +%{_datadir}/xrdp/README.logo %{_datadir}/polkit-1/rules.d/xrdp.rules %{_mandir}/man5/* %{_mandir}/man8/* %{_mandir}/man1/* -%{_libdir}/librfxencode.so* %{_libdir}/xrdp/lib*.so* -%exclude %{_libdir}/librfxencode.so %exclude %{_libdir}/xrdp/libcommon.so -%exclude %{_libdir}/xrdp/libscp.so %exclude %{_libdir}/xrdp/libxrdp.so %exclude %{_libdir}/xrdp/libxrdpapi.so %{_unitdir}/xrdp-sesman.service @@ -282,9 +289,7 @@ fi %{_includedir}/ms-* %{_includedir}/xrdp* %{_includedir}/rfxcodec_*.h -%{_libdir}/librfxencode.so %{_libdir}/xrdp/libcommon.so -%{_libdir}/xrdp/libscp.so %{_libdir}/xrdp/libxrdp.so %{_libdir}/xrdp/libxrdpapi.so %{_libdir}/pkgconfig/rfxcodec.pc @@ -295,6 +300,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Mon Mar 11 2024 Bojan Smojver - 1:0.10.0-0.beta.1 +- Update to 0.10.0-beta.1 + * Sat Jan 27 2024 Fedora Release Engineering - 1:0.9.24-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From d2f8963baa807c85b5ee84350bf504b2b8551075 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Tue, 12 Mar 2024 09:59:41 +1100 Subject: [PATCH 05/62] Update to 0.9.25 --- .gitignore | 1 + sources | 2 +- xrdp.spec | 7 +++++-- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index d521d95..a009ff2 100644 --- a/.gitignore +++ b/.gitignore @@ -30,3 +30,4 @@ xrdp-cvs-03-17-2010.tar.gz /xrdp-0.9.23.tar.gz /xrdp-0.9.23.1.tar.gz /xrdp-0.9.24.tar.gz +/xrdp-0.9.25.tar.gz diff --git a/sources b/sources index c2f7c77..3668873 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (xrdp-0.9.24.tar.gz) = fbb79d407878fe12b25b66e86a4d535afa1a9b4794c5ce2ce1f1e37d1e728d3c255c5026ff1c32684f8c3085576b67b81ab55361732959914c3906012fbfec82 +SHA512 (xrdp-0.9.25.tar.gz) = c55cfffd783b969be91d6dbe8aaae07cf698af0cc6d7a707c8c69f8fcb1ab747b0d9543da3fe15523e58a666f8c2dbe3f49ccd6470387166490b9de23069fb52 diff --git a/xrdp.spec b/xrdp.spec index 7f5a3cb..f54d818 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -16,8 +16,8 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 -Version: 0.9.24 -Release: 2%{?dist} +Version: 0.9.25 +Release: 1%{?dist} License: ASL 2.0 and GPLv2+ and MIT URL: http://www.xrdp.org/ Source0: https://github.com/neutrinolabs/xrdp/releases/download/v%{version}/xrdp-%{version}.tar.gz @@ -295,6 +295,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Tue Mar 12 2024 Bojan Smojver - 1:0.9.25-1 +- Update to 0.9.25 + * Sat Jan 27 2024 Fedora Release Engineering - 1:0.9.24-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From d09880d4cae6d80c5a0cfcdc5b137776720a0e04 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Wed, 13 Mar 2024 13:17:49 +1100 Subject: [PATCH 06/62] Add upstream PR 2994 --- xrdp-0.9.25-2994.patch | 116 +++++++++++++++++++++++++++++++++++++++++ xrdp.spec | 6 ++- 2 files changed, 121 insertions(+), 1 deletion(-) create mode 100644 xrdp-0.9.25-2994.patch diff --git a/xrdp-0.9.25-2994.patch b/xrdp-0.9.25-2994.patch new file mode 100644 index 0000000..95bf5c3 --- /dev/null +++ b/xrdp-0.9.25-2994.patch @@ -0,0 +1,116 @@ +From 14c21566dc83368a2860ecb007896cd4eb546d31 Mon Sep 17 00:00:00 2001 +From: sefler +Date: Mon, 14 Nov 2022 20:13:50 +0800 +Subject: [PATCH 1/2] Disabel touch events on XVNC session + +Fixes: #2993 + +(cherry picked from commit e97a66593bf6f7ef8d8ae567ab53586b6bb54b35) +--- + xrdp/xrdp_mm.c | 1 - + xrdp/xrdp_types.h | 8 ++++++++ + xrdp/xrdp_wm.c | 10 ++++------ + 3 files changed, 12 insertions(+), 7 deletions(-) + +diff --git a/xrdp/xrdp_mm.c b/xrdp/xrdp_mm.c +index c27c2341b..df78dbb07 100644 +--- a/xrdp/xrdp_mm.c ++++ b/xrdp/xrdp_mm.c +@@ -55,7 +55,6 @@ xrdp_mm_chansrv_connect(struct xrdp_mm *self, const char *ip, const char *port); + static void + xrdp_mm_connect_sm(struct xrdp_mm *self); + +- + /*****************************************************************************/ + struct xrdp_mm * + xrdp_mm_create(struct xrdp_wm *owner) +diff --git a/xrdp/xrdp_types.h b/xrdp/xrdp_types.h +index b794890b0..4acaa2363 100644 +--- a/xrdp/xrdp_types.h ++++ b/xrdp/xrdp_types.h +@@ -32,6 +32,14 @@ + #define MAX_NR_CHANNELS 16 + #define MAX_CHANNEL_NAME 16 + ++/* Code values used in 'xrdp_mm->code=' settings */ ++#define XVNC_SESSION_CODE 0 ++#define XRDP_SESSION_CODE 10 ++#define XORG_SESSION_CODE 20 ++ ++/* To check whether touch events has been implemented on session type 'mm' */ ++#define XRDP_MM_IMPLEMENTS_TOUCH(mm) ((mm)->code != XVNC_SESSION_CODE) ++ + struct source_info; + + /* lib */ +diff --git a/xrdp/xrdp_wm.c b/xrdp/xrdp_wm.c +index 97173496d..b95c151ab 100644 +--- a/xrdp/xrdp_wm.c ++++ b/xrdp/xrdp_wm.c +@@ -29,8 +29,6 @@ + #include "log.h" + #include "string_calls.h" + +- +- + /*****************************************************************************/ + struct xrdp_wm * + xrdp_wm_create(struct xrdp_process *owner, +@@ -1806,7 +1804,7 @@ xrdp_wm_process_input_mouse(struct xrdp_wm *self, int device_flags, + * The negative number is represented by complement. + */ + delta = (device_flags & WheelRotationMask) | ~WheelRotationMask; +- if (delta != 0) ++ if (delta != 0 && XRDP_MM_IMPLEMENTS_TOUCH(self->mm)) + { + // Use nature scrolling, up direction is negative. + xrdp_wm_mouse_touch(self, TOUCH_TWO_FINGERS_UP, delta); +@@ -1819,7 +1817,7 @@ xrdp_wm_process_input_mouse(struct xrdp_wm *self, int device_flags, + else + { + delta = device_flags & WheelRotationMask; +- if (delta != 0) ++ if (delta != 0 && XRDP_MM_IMPLEMENTS_TOUCH(self->mm)) + { + xrdp_wm_mouse_touch(self, TOUCH_TWO_FINGERS_DOWN, delta); + } +@@ -1852,7 +1850,7 @@ xrdp_wm_process_input_mouse(struct xrdp_wm *self, int device_flags, + * The negative number is represented by complement. + */ + delta = (device_flags & WheelRotationMask) | ~WheelRotationMask; +- if (delta != 0) ++ if (delta != 0 && XRDP_MM_IMPLEMENTS_TOUCH(self->mm)) + { + // Use nature scrolling, right direction is negative. + xrdp_wm_mouse_touch(self, TOUCH_TWO_FINGERS_RIGHT, delta); +@@ -1865,7 +1863,7 @@ xrdp_wm_process_input_mouse(struct xrdp_wm *self, int device_flags, + else + { + delta = device_flags & WheelRotationMask; +- if (delta != 0) ++ if (delta != 0 && XRDP_MM_IMPLEMENTS_TOUCH(self->mm)) + { + xrdp_wm_mouse_touch(self, TOUCH_TWO_FINGERS_LEFT, delta); + } + +From 82bf205ef511504e20ae1f2bea87feac7080abf1 Mon Sep 17 00:00:00 2001 +From: Koichiro Iwao +Date: Wed, 13 Mar 2024 09:47:02 +0900 +Subject: [PATCH 2/2] Remove XRDP_SESSION_CODE which is no longer used + +--- + xrdp/xrdp_types.h | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/xrdp/xrdp_types.h b/xrdp/xrdp_types.h +index 4acaa2363..1f9a85665 100644 +--- a/xrdp/xrdp_types.h ++++ b/xrdp/xrdp_types.h +@@ -34,7 +34,6 @@ + + /* Code values used in 'xrdp_mm->code=' settings */ + #define XVNC_SESSION_CODE 0 +-#define XRDP_SESSION_CODE 10 + #define XORG_SESSION_CODE 20 + + /* To check whether touch events has been implemented on session type 'mm' */ diff --git a/xrdp.spec b/xrdp.spec index f54d818..1783f89 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -17,7 +17,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.9.25 -Release: 1%{?dist} +Release: 2%{?dist} License: ASL 2.0 and GPLv2+ and MIT URL: http://www.xrdp.org/ Source0: https://github.com/neutrinolabs/xrdp/releases/download/v%{version}/xrdp-%{version}.tar.gz @@ -38,6 +38,7 @@ Patch6: xrdp-0.9.18-vnc-uninit.patch %if 0%{?fedora} >= 32 || 0%{?rhel} >= 8 Patch7: xrdp-0.9.20-sesman-ini.patch %endif +Patch8: xrdp-0.9.25-2994.patch BuildRequires: make BuildRequires: gcc @@ -295,6 +296,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Wed Mar 13 2024 Bojan Smojver - 1:0.9.25-2 +- Add upstream PR 2994 + * Tue Mar 12 2024 Bojan Smojver - 1:0.9.25-1 - Update to 0.9.25 From 9e82f0d656d4c2d6d6c3b007cf1be4f042538aab Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Wed, 3 Apr 2024 11:14:41 +1100 Subject: [PATCH 07/62] Update to 0.10.0-beta.2 --- xrdp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xrdp.spec b/xrdp.spec index 0d38388..6fb8071 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -13,7 +13,7 @@ %global _missing_braces -Wno-error=missing-braces %endif -%global pre_number beta.1 +%global pre_number beta.2 %global pre_release 0.%{pre_number}. %global pre_version -%{pre_number} @@ -300,6 +300,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Wed Apr 03 2024 Bojan Smojver - 1:0.10.0-0.beta.2 +- Update to 0.10.0-beta.2 + * Mon Mar 11 2024 Bojan Smojver - 1:0.10.0-0.beta.1 - Update to 0.10.0-beta.1 From 33857e65c9a13ff836e27f9892259056d280b5a2 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Tue, 14 May 2024 15:23:45 +1000 Subject: [PATCH 08/62] Update to 0.10.0 final, add tmpfiles.conf --- .gitignore | 1 + sources | 2 +- xrdp-tmpfiles.conf | 1 + xrdp.spec | 19 ++++++++++++------- 4 files changed, 15 insertions(+), 8 deletions(-) create mode 100644 xrdp-tmpfiles.conf diff --git a/.gitignore b/.gitignore index d521d95..a726418 100644 --- a/.gitignore +++ b/.gitignore @@ -30,3 +30,4 @@ xrdp-cvs-03-17-2010.tar.gz /xrdp-0.9.23.tar.gz /xrdp-0.9.23.1.tar.gz /xrdp-0.9.24.tar.gz +/xrdp-0.10.0.tar.gz diff --git a/sources b/sources index c2f7c77..e3d5aed 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (xrdp-0.9.24.tar.gz) = fbb79d407878fe12b25b66e86a4d535afa1a9b4794c5ce2ce1f1e37d1e728d3c255c5026ff1c32684f8c3085576b67b81ab55361732959914c3906012fbfec82 +SHA512 (xrdp-0.10.0.tar.gz) = 89708242a872940e692baa67401f8c3de7ff48ef97c7fb1a13d26efae97ba537ca3c4c299fd67f8b7edca757e7b9f5fcbaf6bee9e561bb0ab3e32aa2d584fa76 diff --git a/xrdp-tmpfiles.conf b/xrdp-tmpfiles.conf new file mode 100644 index 0000000..10ffede --- /dev/null +++ b/xrdp-tmpfiles.conf @@ -0,0 +1 @@ +d /run/xrdp 0755 root root - diff --git a/xrdp.spec b/xrdp.spec index 6fb8071..641f80b 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -13,18 +13,14 @@ %global _missing_braces -Wno-error=missing-braces %endif -%global pre_number beta.2 -%global pre_release 0.%{pre_number}. -%global pre_version -%{pre_number} - Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.0 -Release: %{pre_release}1%{?dist} +Release: 1%{?dist} License: ASL 2.0 and GPLv2+ and MIT URL: http://www.xrdp.org/ -Source0: https://github.com/neutrinolabs/xrdp/releases/download/v%{version}%{pre_version}/xrdp-%{version}%{pre_version}.tar.gz +Source0: https://github.com/neutrinolabs/xrdp/releases/download/v%{version}/xrdp-%{version}.tar.gz Source1: xrdp-sesman.pamd Source2: xrdp.sysconfig Source3: xrdp.logrotate @@ -32,6 +28,7 @@ Source4: openssl.conf Source5: README.Fedora Source6: xrdp.te Source7: xrdp-polkit-1.rules +Source8: %{name}-tmpfiles.conf Patch0: xrdp-0.9.9-sesman.patch Patch1: xrdp-0.10.0-xrdp-ini.patch Patch2: xrdp-0.10.0-service.patch @@ -104,7 +101,7 @@ Requires(postun): /usr/sbin/semodule This package contains SELinux policy module necessary to run xrdp. %prep -%autosetup -p1 -n %{name}-%{version}%{pre_version} +%autosetup -p1 -n %{name}-%{version} %{__cp} %{SOURCE5} . # SELinux policy module @@ -157,6 +154,10 @@ cd - #install xrdp.rules /usr/share/polkit-1/rules.d %{__install} -Dp -m 644 %{SOURCE7} %{buildroot}%{_datadir}/polkit-1/rules.d/xrdp.rules +# Temporary files for socket +%{__mkdir_p} %{buildroot}%{_tmpfilesdir} +%{__install} -m 0644 %{SOURCE8} %{buildroot}%{_tmpfilesdir}/%{name}.conf + # SELinux policy module for selinuxvariant in %{selinux_variants} do @@ -227,6 +228,7 @@ fi %dir %{_sysconfdir}/xrdp/pulse %dir %{_datadir}/xrdp %dir %{_libexecdir}/xrdp +%{_tmpfilesdir}/%{name}.conf %config(noreplace) %{_sysconfdir}/xrdp/xrdp.ini %config(noreplace) %{_sysconfdir}/pam.d/xrdp-sesman %config(noreplace) %{_sysconfdir}/logrotate.d/xrdp @@ -300,6 +302,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Tue May 14 2024 Bojan Smojver - 1:0.10.0-1 +- Update to 0.10.0 + * Wed Apr 03 2024 Bojan Smojver - 1:0.10.0-0.beta.2 - Update to 0.10.0-beta.2 From 6b29715e1ac8cfbad95109c4782575909870e3c6 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Tue, 14 May 2024 15:58:57 +1000 Subject: [PATCH 09/62] Revert "Add upstream PR 2994" This reverts commit d09880d4cae6d80c5a0cfcdc5b137776720a0e04. --- xrdp-0.9.25-2994.patch | 116 ----------------------------------------- xrdp.spec | 2 +- 2 files changed, 1 insertion(+), 117 deletions(-) delete mode 100644 xrdp-0.9.25-2994.patch diff --git a/xrdp-0.9.25-2994.patch b/xrdp-0.9.25-2994.patch deleted file mode 100644 index 95bf5c3..0000000 --- a/xrdp-0.9.25-2994.patch +++ /dev/null @@ -1,116 +0,0 @@ -From 14c21566dc83368a2860ecb007896cd4eb546d31 Mon Sep 17 00:00:00 2001 -From: sefler -Date: Mon, 14 Nov 2022 20:13:50 +0800 -Subject: [PATCH 1/2] Disabel touch events on XVNC session - -Fixes: #2993 - -(cherry picked from commit e97a66593bf6f7ef8d8ae567ab53586b6bb54b35) ---- - xrdp/xrdp_mm.c | 1 - - xrdp/xrdp_types.h | 8 ++++++++ - xrdp/xrdp_wm.c | 10 ++++------ - 3 files changed, 12 insertions(+), 7 deletions(-) - -diff --git a/xrdp/xrdp_mm.c b/xrdp/xrdp_mm.c -index c27c2341b..df78dbb07 100644 ---- a/xrdp/xrdp_mm.c -+++ b/xrdp/xrdp_mm.c -@@ -55,7 +55,6 @@ xrdp_mm_chansrv_connect(struct xrdp_mm *self, const char *ip, const char *port); - static void - xrdp_mm_connect_sm(struct xrdp_mm *self); - -- - /*****************************************************************************/ - struct xrdp_mm * - xrdp_mm_create(struct xrdp_wm *owner) -diff --git a/xrdp/xrdp_types.h b/xrdp/xrdp_types.h -index b794890b0..4acaa2363 100644 ---- a/xrdp/xrdp_types.h -+++ b/xrdp/xrdp_types.h -@@ -32,6 +32,14 @@ - #define MAX_NR_CHANNELS 16 - #define MAX_CHANNEL_NAME 16 - -+/* Code values used in 'xrdp_mm->code=' settings */ -+#define XVNC_SESSION_CODE 0 -+#define XRDP_SESSION_CODE 10 -+#define XORG_SESSION_CODE 20 -+ -+/* To check whether touch events has been implemented on session type 'mm' */ -+#define XRDP_MM_IMPLEMENTS_TOUCH(mm) ((mm)->code != XVNC_SESSION_CODE) -+ - struct source_info; - - /* lib */ -diff --git a/xrdp/xrdp_wm.c b/xrdp/xrdp_wm.c -index 97173496d..b95c151ab 100644 ---- a/xrdp/xrdp_wm.c -+++ b/xrdp/xrdp_wm.c -@@ -29,8 +29,6 @@ - #include "log.h" - #include "string_calls.h" - -- -- - /*****************************************************************************/ - struct xrdp_wm * - xrdp_wm_create(struct xrdp_process *owner, -@@ -1806,7 +1804,7 @@ xrdp_wm_process_input_mouse(struct xrdp_wm *self, int device_flags, - * The negative number is represented by complement. - */ - delta = (device_flags & WheelRotationMask) | ~WheelRotationMask; -- if (delta != 0) -+ if (delta != 0 && XRDP_MM_IMPLEMENTS_TOUCH(self->mm)) - { - // Use nature scrolling, up direction is negative. - xrdp_wm_mouse_touch(self, TOUCH_TWO_FINGERS_UP, delta); -@@ -1819,7 +1817,7 @@ xrdp_wm_process_input_mouse(struct xrdp_wm *self, int device_flags, - else - { - delta = device_flags & WheelRotationMask; -- if (delta != 0) -+ if (delta != 0 && XRDP_MM_IMPLEMENTS_TOUCH(self->mm)) - { - xrdp_wm_mouse_touch(self, TOUCH_TWO_FINGERS_DOWN, delta); - } -@@ -1852,7 +1850,7 @@ xrdp_wm_process_input_mouse(struct xrdp_wm *self, int device_flags, - * The negative number is represented by complement. - */ - delta = (device_flags & WheelRotationMask) | ~WheelRotationMask; -- if (delta != 0) -+ if (delta != 0 && XRDP_MM_IMPLEMENTS_TOUCH(self->mm)) - { - // Use nature scrolling, right direction is negative. - xrdp_wm_mouse_touch(self, TOUCH_TWO_FINGERS_RIGHT, delta); -@@ -1865,7 +1863,7 @@ xrdp_wm_process_input_mouse(struct xrdp_wm *self, int device_flags, - else - { - delta = device_flags & WheelRotationMask; -- if (delta != 0) -+ if (delta != 0 && XRDP_MM_IMPLEMENTS_TOUCH(self->mm)) - { - xrdp_wm_mouse_touch(self, TOUCH_TWO_FINGERS_LEFT, delta); - } - -From 82bf205ef511504e20ae1f2bea87feac7080abf1 Mon Sep 17 00:00:00 2001 -From: Koichiro Iwao -Date: Wed, 13 Mar 2024 09:47:02 +0900 -Subject: [PATCH 2/2] Remove XRDP_SESSION_CODE which is no longer used - ---- - xrdp/xrdp_types.h | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/xrdp/xrdp_types.h b/xrdp/xrdp_types.h -index 4acaa2363..1f9a85665 100644 ---- a/xrdp/xrdp_types.h -+++ b/xrdp/xrdp_types.h -@@ -34,7 +34,6 @@ - - /* Code values used in 'xrdp_mm->code=' settings */ - #define XVNC_SESSION_CODE 0 --#define XRDP_SESSION_CODE 10 - #define XORG_SESSION_CODE 20 - - /* To check whether touch events has been implemented on session type 'mm' */ diff --git a/xrdp.spec b/xrdp.spec index 38bcda9..d4aa962 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -39,7 +39,6 @@ Patch6: xrdp-0.9.18-vnc-uninit.patch %if 0%{?fedora} >= 32 || 0%{?rhel} >= 8 Patch7: xrdp-0.9.20-sesman-ini.patch %endif -Patch8: xrdp-0.9.25-2994.patch BuildRequires: make BuildRequires: gcc @@ -305,6 +304,7 @@ fi %changelog * Tue May 14 2024 Bojan Smojver - 1:0.10.0-1 - Update to 0.10.0 +- Revert PR 2994 * Wed Apr 03 2024 Bojan Smojver - 1:0.10.0-0.beta.2 - Update to 0.10.0-beta.2 From 60542e6e4c9af39ff828cd53819079cb86c16cc6 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Tue, 14 May 2024 18:37:45 +1000 Subject: [PATCH 10/62] Explicitly run systemd-tmpfiles --remove on package removal --- xrdp-tmpfiles.conf | 1 + xrdp.spec | 7 ++++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/xrdp-tmpfiles.conf b/xrdp-tmpfiles.conf index 10ffede..ad34a3c 100644 --- a/xrdp-tmpfiles.conf +++ b/xrdp-tmpfiles.conf @@ -1 +1,2 @@ d /run/xrdp 0755 root root - +R /run/xrdp 0755 root root - diff --git a/xrdp.spec b/xrdp.spec index d4aa962..bf4c7a2 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -17,7 +17,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.0 -Release: 1%{?dist} +Release: 2%{?dist} License: ASL 2.0 and GPLv2+ and MIT URL: http://www.xrdp.org/ Source0: https://github.com/neutrinolabs/xrdp/releases/download/v%{version}/xrdp-%{version}.tar.gz @@ -73,6 +73,7 @@ Requires(post): systemd-sysv Requires(post): /sbin/ldconfig Requires(posttrans): openssl Requires(preun): systemd +Requires(preun): systemd-tmpfiles Requires(posttrans): systemd @@ -176,6 +177,7 @@ done if [ $1 -eq 0 ]; then # Stop services on package removal (see bug 1349083) systemctl stop xrdp.service > /dev/null 2>&1 || : + systemd-tmpfiles --remove %{name}.conf fi %triggerun -- xrdp < 0.6.0-1 @@ -302,6 +304,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Tue May 14 2024 Bojan Smojver - 1:0.10.0-2 +- Explicitly run systemd-tmpfiles --remove on package removal BZ#2279775 + * Tue May 14 2024 Bojan Smojver - 1:0.10.0-1 - Update to 0.10.0 - Revert PR 2994 From bdb793303a550573a03b6c52265d3e26c5667e96 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Tue, 14 May 2024 19:41:17 +1000 Subject: [PATCH 11/62] Fix changelog order --- xrdp.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/xrdp.spec b/xrdp.spec index bf4c7a2..0bd01f4 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -314,15 +314,15 @@ fi * Wed Apr 03 2024 Bojan Smojver - 1:0.10.0-0.beta.2 - Update to 0.10.0-beta.2 -* Mon Mar 11 2024 Bojan Smojver - 1:0.10.0-0.beta.1 -- Update to 0.10.0-beta.1 - * Wed Mar 13 2024 Bojan Smojver - 1:0.9.25-2 - Add upstream PR 2994 * Tue Mar 12 2024 Bojan Smojver - 1:0.9.25-1 - Update to 0.9.25 +* Mon Mar 11 2024 Bojan Smojver - 1:0.10.0-0.beta.1 +- Update to 0.10.0-beta.1 + * Sat Jan 27 2024 Fedora Release Engineering - 1:0.9.24-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 61320c3a122a1e22ed44a66cf6123183abc60c58 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Tue, 14 May 2024 22:56:21 +1000 Subject: [PATCH 12/62] Only require systemd-tmpfiles on Fedora --- xrdp.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/xrdp.spec b/xrdp.spec index 0bd01f4..e110fe2 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -73,7 +73,9 @@ Requires(post): systemd-sysv Requires(post): /sbin/ldconfig Requires(posttrans): openssl Requires(preun): systemd +%if 0%{?fedora} Requires(preun): systemd-tmpfiles +%endif Requires(posttrans): systemd From 3bbe3491d80cc81a200e49fd925441892f05aab7 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Tue, 14 May 2024 22:58:03 +1000 Subject: [PATCH 13/62] Bump release for rebuild --- xrdp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xrdp.spec b/xrdp.spec index e110fe2..a2d5d90 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -17,7 +17,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.0 -Release: 2%{?dist} +Release: 3%{?dist} License: ASL 2.0 and GPLv2+ and MIT URL: http://www.xrdp.org/ Source0: https://github.com/neutrinolabs/xrdp/releases/download/v%{version}/xrdp-%{version}.tar.gz @@ -306,6 +306,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Tue May 14 2024 Bojan Smojver - 1:0.10.0-3 +- Only require systemd-tmpfiles on Fedora + * Tue May 14 2024 Bojan Smojver - 1:0.10.0-2 - Explicitly run systemd-tmpfiles --remove on package removal BZ#2279775 From 5004123f256197572f4963912a95be4cd17d7784 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Tue, 14 May 2024 23:18:28 +1000 Subject: [PATCH 14/62] Do not fail if systemd-tmpfiles fails --- xrdp.spec | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/xrdp.spec b/xrdp.spec index a2d5d90..315b1ad 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -178,21 +178,21 @@ done %systemd_preun xrdp.service if [ $1 -eq 0 ]; then # Stop services on package removal (see bug 1349083) - systemctl stop xrdp.service > /dev/null 2>&1 || : - systemd-tmpfiles --remove %{name}.conf + systemctl stop xrdp.service &>/dev/null || : + systemd-tmpfiles --remove %{name}.conf &>/dev/null || : fi %triggerun -- xrdp < 0.6.0-1 -systemd-sysv-convert --save xrdp >/dev/null 2>&1 ||: +systemd-sysv-convert --save xrdp &>/dev/null || : # If the package is allowed to autostart: -systemctl preset xrdp.service >/dev/null 2>&1 ||: +systemctl preset xrdp.service &>/dev/null || : # Run these because the SysV package being removed won't do them -/sbin/chkconfig --del xrdp >/dev/null 2>&1 || : +/sbin/chkconfig --del xrdp &>/dev/null || : if [ "`systemctl is-active xrdp.service`" = 'active' ]; then - systemctl stop xrdp.service >/dev/null 2>&1 || : - systemctl start xrdp.service >/dev/null 2>&1 || : + systemctl stop xrdp.service &>/dev/null || : + systemctl start xrdp.service &>/dev/null || : fi %ldconfig_postun @@ -206,7 +206,7 @@ if [ ! -s %{_sysconfdir}/xrdp/cert.pem ]; then (umask 377; openssl req -x509 -newkey rsa:2048 -sha256 -nodes -days 3652 \ -keyout %{_sysconfdir}/xrdp/key.pem \ -out %{_sysconfdir}/xrdp/cert.pem \ - -config %{_sysconfdir}/xrdp/openssl.conf >/dev/null 2>&1) + -config %{_sysconfdir}/xrdp/openssl.conf &>/dev/null) fi %post selinux From 0ab794b1a642c43131a2e3e4a8297364c41640d8 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Sat, 1 Jun 2024 20:21:07 +1000 Subject: [PATCH 15/62] Explain downgrades from 0.10.x to 0.9.x in README.Fedora --- README.Fedora | 12 ++++++++++++ xrdp.spec | 5 ++++- 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/README.Fedora b/README.Fedora index ae1f2a8..2ab9553 100644 --- a/README.Fedora +++ b/README.Fedora @@ -1,3 +1,15 @@ +Downgrade from 0.10.x to 0.9.x +============================== + +Version 0.10.x requires different permissions of /run/xrdp directory than +version 0.9.x. When 0.10.x is fully uninstalled, this directory is removed +and subsequent installation of 0.9.x should work fine. + +However, if 0.10.x is downgraded to 0.9.x, the directory is preserved, +because we could have xrdp and its sessions still running, so subsequent start +or restart will fail, unless the permissions of /run/xrdp directory are +changed to 1777 beforehand. + Restarts ======== diff --git a/xrdp.spec b/xrdp.spec index 315b1ad..52f9627 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -17,7 +17,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.0 -Release: 3%{?dist} +Release: 5%{?dist} License: ASL 2.0 and GPLv2+ and MIT URL: http://www.xrdp.org/ Source0: https://github.com/neutrinolabs/xrdp/releases/download/v%{version}/xrdp-%{version}.tar.gz @@ -306,6 +306,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Sat Jun 1 2024 Bojan Smojver - 1:0.10.0-4 +- Explain downgrades from 0.10.x to 0.9.x in README.Fedora + * Tue May 14 2024 Bojan Smojver - 1:0.10.0-3 - Only require systemd-tmpfiles on Fedora From e33983fa06170c2318df0f0cd00b2dff85e5904c Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Sat, 1 Jun 2024 20:23:12 +1000 Subject: [PATCH 16/62] Fix release number --- xrdp.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xrdp.spec b/xrdp.spec index 52f9627..83b89b8 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -17,7 +17,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.0 -Release: 5%{?dist} +Release: 4%{?dist} License: ASL 2.0 and GPLv2+ and MIT URL: http://www.xrdp.org/ Source0: https://github.com/neutrinolabs/xrdp/releases/download/v%{version}/xrdp-%{version}.tar.gz From 25fb61557ce50664f6bbe43874030367e9d99721 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jul 2024 10:26:46 +0000 Subject: [PATCH 17/62] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- xrdp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xrdp.spec b/xrdp.spec index 83b89b8..25112c1 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -17,7 +17,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.0 -Release: 4%{?dist} +Release: 5%{?dist} License: ASL 2.0 and GPLv2+ and MIT URL: http://www.xrdp.org/ Source0: https://github.com/neutrinolabs/xrdp/releases/download/v%{version}/xrdp-%{version}.tar.gz @@ -306,6 +306,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Sat Jul 20 2024 Fedora Release Engineering - 1:0.10.0-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Sat Jun 1 2024 Bojan Smojver - 1:0.10.0-4 - Explain downgrades from 0.10.x to 0.9.x in README.Fedora From 6548d8b7d35621fdb88b3d6a9cef53f60d808055 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Thu, 1 Aug 2024 00:09:28 +1000 Subject: [PATCH 18/62] Update to 0.10.1 --- .gitignore | 1 + sources | 2 +- xrdp-0.10.0-service.patch | 23 ----------------------- xrdp-0.10.1-service.patch | 13 +++++++++++++ xrdp.spec | 9 ++++++--- 5 files changed, 21 insertions(+), 27 deletions(-) delete mode 100644 xrdp-0.10.0-service.patch create mode 100644 xrdp-0.10.1-service.patch diff --git a/.gitignore b/.gitignore index fac08fa..89965ae 100644 --- a/.gitignore +++ b/.gitignore @@ -32,3 +32,4 @@ xrdp-cvs-03-17-2010.tar.gz /xrdp-0.9.24.tar.gz /xrdp-0.9.25.tar.gz /xrdp-0.10.0.tar.gz +/xrdp-0.10.1.tar.gz diff --git a/sources b/sources index e3d5aed..898050c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (xrdp-0.10.0.tar.gz) = 89708242a872940e692baa67401f8c3de7ff48ef97c7fb1a13d26efae97ba537ca3c4c299fd67f8b7edca757e7b9f5fcbaf6bee9e561bb0ab3e32aa2d584fa76 +SHA512 (xrdp-0.10.1.tar.gz) = 9fc424b23d2efec8674b6f64fb490f37929b3afdaee306ec3a104ea828a3662cfd83cad08cf2d1780a04989f2c00800bf7b99b961bbe960f98f511fc7386c955 diff --git a/xrdp-0.10.0-service.patch b/xrdp-0.10.0-service.patch deleted file mode 100644 index 4dd9f76..0000000 --- a/xrdp-0.10.0-service.patch +++ /dev/null @@ -1,23 +0,0 @@ ---- xrdp-0.10.0-beta.1/instfiles/xrdp.service.in.o 2024-03-10 02:06:29.000000000 +1100 -+++ xrdp-0.10.0-beta.1/instfiles/xrdp.service.in 2024-03-11 14:10:31.607973918 +1100 -@@ -2,7 +2,7 @@ - Description=xrdp daemon - Documentation=man:xrdp(8) man:xrdp.ini(5) - Requires=xrdp-sesman.service --After=network.target xrdp-sesman.service -+After=xrdp-sesman.service - - [Service] - Type=exec ---- xrdp-0.10.0-beta.1/instfiles/xrdp-sesman.service.in.o 2024-03-11 14:14:12.510062559 +1100 -+++ xrdp-0.10.0-beta.1/instfiles/xrdp-sesman.service.in 2024-03-11 14:11:27.817255389 +1100 -@@ -1,7 +1,8 @@ - [Unit] - Description=xrdp session manager - Documentation=man:xrdp-sesman(8) man:sesman.ini(5) --After=network.target -+Wants=network-online.target nss-lookup.target nss-user-lookup.target -+After=network-online.target nss-lookup.target nss-user-lookup.target - StopWhenUnneeded=true - BindsTo=xrdp.service - diff --git a/xrdp-0.10.1-service.patch b/xrdp-0.10.1-service.patch new file mode 100644 index 0000000..1e822dd --- /dev/null +++ b/xrdp-0.10.1-service.patch @@ -0,0 +1,13 @@ +diff -ruNp xrdp-0.10.1-v/instfiles/xrdp-sesman.service.in xrdp-0.10.1/instfiles/xrdp-sesman.service.in +--- xrdp-0.10.1-v/instfiles/xrdp-sesman.service.in 2024-07-31 22:55:03.000000000 +1000 ++++ xrdp-0.10.1/instfiles/xrdp-sesman.service.in 2024-07-31 23:58:48.247323165 +1000 +@@ -1,7 +1,8 @@ + [Unit] + Description=xrdp session manager + Documentation=man:xrdp-sesman(8) man:sesman.ini(5) +-After=network.target ++Wants=network-online.target nss-lookup.target nss-user-lookup.target ++After=network-online.target nss-lookup.target nss-user-lookup.target + StopWhenUnneeded=true + BindsTo=xrdp.service + diff --git a/xrdp.spec b/xrdp.spec index 25112c1..980fdb7 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -16,8 +16,8 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 -Version: 0.10.0 -Release: 5%{?dist} +Version: 0.10.1 +Release: 1%{?dist} License: ASL 2.0 and GPLv2+ and MIT URL: http://www.xrdp.org/ Source0: https://github.com/neutrinolabs/xrdp/releases/download/v%{version}/xrdp-%{version}.tar.gz @@ -31,7 +31,7 @@ Source7: xrdp-polkit-1.rules Source8: %{name}-tmpfiles.conf Patch0: xrdp-0.9.9-sesman.patch Patch1: xrdp-0.10.0-xrdp-ini.patch -Patch2: xrdp-0.10.0-service.patch +Patch2: xrdp-0.10.1-service.patch Patch3: xrdp-0.10.0-scripts-libexec.patch Patch4: xrdp-0.9.6-script-interpreter.patch Patch5: xrdp-0.9.16-arch.patch @@ -306,6 +306,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Wed Jul 31 2024 Bojan Smojver - 1:0.10.1-1 +- Update to 0.10.1 + * Sat Jul 20 2024 Fedora Release Engineering - 1:0.10.0-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From ee4d59ab85faf8be1e34b96009470377a425bd2b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Such=C3=BD?= Date: Wed, 4 Sep 2024 22:57:36 +0200 Subject: [PATCH 19/62] convert license to SPDX This is part of https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_4 --- xrdp.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/xrdp.spec b/xrdp.spec index 980fdb7..5d49a1f 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -17,8 +17,9 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.1 -Release: 1%{?dist} -License: ASL 2.0 and GPLv2+ and MIT +Release: 2%{?dist} +# Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. +License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ Source0: https://github.com/neutrinolabs/xrdp/releases/download/v%{version}/xrdp-%{version}.tar.gz Source1: xrdp-sesman.pamd @@ -306,6 +307,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Wed Sep 4 2024 Miroslav Suchý - 1:0.10.1-2 +- convert license to SPDX + * Wed Jul 31 2024 Bojan Smojver - 1:0.10.1-1 - Update to 0.10.1 From a9de146d1705d53dc91f994fb954e7be7c0de268 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Tue, 24 Dec 2024 08:13:31 +1100 Subject: [PATCH 20/62] Update to 0.10.2-rc.1 --- .gitignore | 1 + sources | 2 +- ...-ini.patch => xrdp-0.10.2-sesman-ini.patch | 7 ++--- xrdp-0.10.2-sesman.patch | 11 +++++++ ...dp-ini.patch => xrdp-0.10.2-xrdp-ini.patch | 23 +++++++++----- xrdp-0.9.9-sesman.patch | 12 -------- xrdp.spec | 30 +++++++++++++------ 7 files changed, 52 insertions(+), 34 deletions(-) rename xrdp-0.9.20-sesman-ini.patch => xrdp-0.10.2-sesman-ini.patch (52%) create mode 100644 xrdp-0.10.2-sesman.patch rename xrdp-0.10.0-xrdp-ini.patch => xrdp-0.10.2-xrdp-ini.patch (57%) delete mode 100644 xrdp-0.9.9-sesman.patch diff --git a/.gitignore b/.gitignore index 89965ae..d8bb2cf 100644 --- a/.gitignore +++ b/.gitignore @@ -33,3 +33,4 @@ xrdp-cvs-03-17-2010.tar.gz /xrdp-0.9.25.tar.gz /xrdp-0.10.0.tar.gz /xrdp-0.10.1.tar.gz +/xrdp-0.10.2-rc.1.tar.gz diff --git a/sources b/sources index 898050c..d038381 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (xrdp-0.10.1.tar.gz) = 9fc424b23d2efec8674b6f64fb490f37929b3afdaee306ec3a104ea828a3662cfd83cad08cf2d1780a04989f2c00800bf7b99b961bbe960f98f511fc7386c955 +SHA512 (xrdp-0.10.2-rc.1.tar.gz) = d1aa417b6b343bf2f988a00d8deec4b08319b0bd013b17b3fc1d6b55e0eb2b4b297a45867058d6843561ea887ae8cfbadce2fb3a89a34718f2a0f1f660f7e6ee diff --git a/xrdp-0.9.20-sesman-ini.patch b/xrdp-0.10.2-sesman-ini.patch similarity index 52% rename from xrdp-0.9.20-sesman-ini.patch rename to xrdp-0.10.2-sesman-ini.patch index 2717f23..43fd3b8 100644 --- a/xrdp-0.9.20-sesman-ini.patch +++ b/xrdp-0.10.2-sesman-ini.patch @@ -1,7 +1,6 @@ -diff -ruN xrdp-0.9.20-v/sesman/sesman.ini xrdp-0.9.20/sesman/sesman.ini ---- xrdp-0.9.20-v/sesman/sesman.ini 2022-09-15 15:59:55.000000000 +1000 -+++ xrdp-0.9.20/sesman/sesman.ini 2022-09-15 17:40:10.032704634 +1000 -@@ -111,7 +111,7 @@ +--- xrdp-0.10.2-rc.1/sesman/sesman.ini.in.org 2024-12-24 07:11:02.643702480 +1100 ++++ xrdp-0.10.2-rc.1/sesman/sesman.ini.in 2024-12-24 07:12:42.372540720 +1100 +@@ -143,7 +143,7 @@ EnableSyslog=true ; CentOS 8 : param=/usr/libexec/Xorg ; FreeBSD (from 2022Q4) : param=/usr/local/libexec/Xorg ; diff --git a/xrdp-0.10.2-sesman.patch b/xrdp-0.10.2-sesman.patch new file mode 100644 index 0000000..cc60021 --- /dev/null +++ b/xrdp-0.10.2-sesman.patch @@ -0,0 +1,11 @@ +--- xrdp-0.10.2-rc.1/sesman/sesman.ini.in.org 2024-12-24 00:36:22.000000000 +1100 ++++ xrdp-0.10.2-rc.1/sesman/sesman.ini.in 2024-12-24 07:06:20.309329448 +1100 +@@ -7,7 +7,7 @@ EnableUserWindowManager=true + ; Give in relative path to user's home directory + UserWindowManager=startwm.sh + ; Give in full path or relative path to @sesmansysconfdir@ +-DefaultWindowManager=startwm.sh ++DefaultWindowManager=startwm-bash.sh + ; Give in full path or relative path to @sesmansysconfdir@ + ReconnectScript=reconnectwm.sh + diff --git a/xrdp-0.10.0-xrdp-ini.patch b/xrdp-0.10.2-xrdp-ini.patch similarity index 57% rename from xrdp-0.10.0-xrdp-ini.patch rename to xrdp-0.10.2-xrdp-ini.patch index 0492918..ebafbaa 100644 --- a/xrdp-0.10.0-xrdp-ini.patch +++ b/xrdp-0.10.2-xrdp-ini.patch @@ -1,40 +1,47 @@ ---- xrdp-0.10.0-beta.1/xrdp/xrdp.ini.o 2024-03-11 13:59:30.562337578 +1100 -+++ xrdp-0.10.0-beta.1/xrdp/xrdp.ini 2024-03-11 14:01:38.713716136 +1100 -@@ -231,13 +231,13 @@ xrdpvr=true +--- xrdp-0.10.2-rc.1/xrdp/xrdp.ini.in.org 2024-12-24 00:36:22.000000000 +1100 ++++ xrdp-0.10.2-rc.1/xrdp/xrdp.ini.in 2024-12-24 07:09:51.329103064 +1100 +@@ -241,17 +241,17 @@ xrdpvr=true ; Some session types such as Xorg and Xvnc start a display server. ; Startup command-line parameters for the display server are configured ; in sesman.ini. See and configure also sesman.ini. -[Xorg] -name=Xorg --lib=libxup.so +-lib=libxup.@lib_extension@ -username=ask -password=ask -port=-1 -code=20 +#[Xorg] +#name=Xorg -+#lib=libxup.so ++#lib=libxup.@lib_extension@ +#username=ask +#password=ask +#port=-1 +#code=20 + ; Frame capture interval (milliseconds) +-h264_frame_interval=16 +-rfx_frame_interval=32 +-normal_frame_interval=40 ++#h264_frame_interval=16 ++#rfx_frame_interval=32 ++#normal_frame_interval=40 [Xvnc] name=Xvnc -@@ -259,13 +259,13 @@ port=-1 +@@ -269,13 +269,13 @@ port=-1 ; Generic VNC Proxy ; Tailor this to specific hosts and VNC instances by specifying an ip ; and port and setting a suitable name. -[vnc-any] -name=vnc-any --lib=libvnc.so +-lib=libvnc.@lib_extension@ -ip=ask -port=ask5900 -username=na -password=ask +#[vnc-any] +#name=vnc-any -+#lib=libvnc.so ++#lib=libvnc.@lib_extension@ +#ip=ask +#port=ask5900 +#username=na diff --git a/xrdp-0.9.9-sesman.patch b/xrdp-0.9.9-sesman.patch deleted file mode 100644 index 5d58523..0000000 --- a/xrdp-0.9.9-sesman.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -ruN xrdp-0.9.9-v/sesman/sesman.ini xrdp-0.9.9/sesman/sesman.ini ---- xrdp-0.9.9-v/sesman/sesman.ini 2018-12-25 15:49:32.000000000 +1100 -+++ xrdp-0.9.9/sesman/sesman.ini 2019-01-11 19:19:42.253947862 +1100 -@@ -7,7 +7,7 @@ - ; Give in relative path to user's home directory - UserWindowManager=startwm.sh - ; Give in full path or relative path to /etc/xrdp --DefaultWindowManager=startwm.sh -+DefaultWindowManager=startwm-bash.sh - ; Give in full path or relative path to /etc/xrdp - ReconnectScript=reconnectwm.sh - diff --git a/xrdp.spec b/xrdp.spec index 5d49a1f..1708e3c 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -1,3 +1,5 @@ +%global prerelease -rc.1 + %global _hardened_build 1 %global selinux_types %(%{__awk} '/^#[[:space:]]*SELINUXTYPE=/,/^[^#]/ { if ($3 == "-") printf "%s ", $2 }' /etc/selinux/config 2>/dev/null) @@ -13,15 +15,19 @@ %global _missing_braces -Wno-error=missing-braces %endif +%ifarch %{ix86} +%global _file_offset_bits -D_FILE_OFFSET_BITS=64 +%endif + Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 -Version: 0.10.1 -Release: 2%{?dist} +Version: 0.10.2 +Release: 0.rc1.1%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ -Source0: https://github.com/neutrinolabs/xrdp/releases/download/v%{version}/xrdp-%{version}.tar.gz +Source0: https://github.com/neutrinolabs/xrdp/releases/download/v%{version}%{?prerelease}/xrdp-%{version}%{?prerelease}.tar.gz Source1: xrdp-sesman.pamd Source2: xrdp.sysconfig Source3: xrdp.logrotate @@ -30,15 +36,15 @@ Source5: README.Fedora Source6: xrdp.te Source7: xrdp-polkit-1.rules Source8: %{name}-tmpfiles.conf -Patch0: xrdp-0.9.9-sesman.patch -Patch1: xrdp-0.10.0-xrdp-ini.patch +Patch0: xrdp-0.10.2-sesman.patch +Patch1: xrdp-0.10.2-xrdp-ini.patch Patch2: xrdp-0.10.1-service.patch Patch3: xrdp-0.10.0-scripts-libexec.patch Patch4: xrdp-0.9.6-script-interpreter.patch Patch5: xrdp-0.9.16-arch.patch Patch6: xrdp-0.9.18-vnc-uninit.patch %if 0%{?fedora} >= 32 || 0%{?rhel} >= 8 -Patch7: xrdp-0.9.20-sesman-ini.patch +Patch7: xrdp-0.10.2-sesman-ini.patch %endif BuildRequires: make @@ -50,7 +56,7 @@ BuildRequires: libXrandr-devel BuildRequires: imlib2-devel BuildRequires: openssl BuildRequires: pam-devel -BuildRequires: pkgconfig(fuse) +BuildRequires: pkgconfig(fuse3) BuildRequires: pkgconfig(openssl) BuildRequires: pkgconfig(pixman-1) BuildRequires: pkgconfig(systemd) @@ -105,7 +111,7 @@ Requires(postun): /usr/sbin/semodule This package contains SELinux policy module necessary to run xrdp. %prep -%autosetup -p1 -n %{name}-%{version} +%autosetup -p1 -n %{name}-%{version}%{?prerelease} %{__cp} %{SOURCE5} . # SELinux policy module @@ -118,7 +124,7 @@ echo '#!/bin/bash -l %build autoreconf -vif -CFLAGS="$RPM_OPT_FLAGS %{?_missing_braces}" \ +CFLAGS="$RPM_OPT_FLAGS %{?_missing_braces} %{?_file_offset_bits}" \ %configure --enable-fuse --enable-pixman --enable-painter --enable-vsock \ --enable-ipv6 --with-socketdir=%{_rundir}/%{name} --with-imlib2 %make_build @@ -242,6 +248,7 @@ fi %config(noreplace) %{_sysconfdir}/xrdp/km*.ini %config(noreplace) %{_sysconfdir}/xrdp/openssl.conf %config(noreplace) %{_sysconfdir}/xrdp/xrdp_keyboard.ini +%config(noreplace) %{_sysconfdir}/xrdp/gfx.toml %config(noreplace) %{_sysconfdir}/xrdp/pulse/default.pa %exclude %ghost %{_sysconfdir}/xrdp/*.pem %exclude %ghost %{_sysconfdir}/xrdp/rsakeys.ini @@ -249,6 +256,7 @@ fi %{_libexecdir}/xrdp/reconnectwm.sh %{_libexecdir}/xrdp/waitforx %{_libexecdir}/xrdp/xrdp-sesexec +%{_libexecdir}/xrdp/xrdp-droppriv %{_bindir}/xrdp-genkeymap %{_bindir}/xrdp-sesadmin %{_bindir}/xrdp-keygen @@ -268,6 +276,7 @@ fi %{_datadir}/xrdp/xrdp24b.bmp %{_datadir}/xrdp/xrdp_logo.bmp %{_datadir}/xrdp/xrdp_logo.png +%{_datadir}/xrdp/xrdp-chkpriv %{_datadir}/xrdp/README.logo %{_datadir}/polkit-1/rules.d/xrdp.rules %{_mandir}/man5/* @@ -307,6 +316,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Tue Dec 24 2024 Bojan Smojver - 1:0.10.2~0.rc1.1 +- Update to 0.10.2-rc.1 + * Wed Sep 4 2024 Miroslav Suchý - 1:0.10.1-2 - convert license to SPDX From a26ce0ad01b4a8ec86651a14bbc88f958fc3d3a3 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Wed, 25 Dec 2024 07:37:18 +1100 Subject: [PATCH 21/62] Update to 0.10.2 --- .gitignore | 1 + sources | 2 +- xrdp.spec | 7 +++++-- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index d8bb2cf..1d544d8 100644 --- a/.gitignore +++ b/.gitignore @@ -34,3 +34,4 @@ xrdp-cvs-03-17-2010.tar.gz /xrdp-0.10.0.tar.gz /xrdp-0.10.1.tar.gz /xrdp-0.10.2-rc.1.tar.gz +/xrdp-0.10.2.tar.gz diff --git a/sources b/sources index d038381..24b5170 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (xrdp-0.10.2-rc.1.tar.gz) = d1aa417b6b343bf2f988a00d8deec4b08319b0bd013b17b3fc1d6b55e0eb2b4b297a45867058d6843561ea887ae8cfbadce2fb3a89a34718f2a0f1f660f7e6ee +SHA512 (xrdp-0.10.2.tar.gz) = fc5060af808d4647dba439259ab4be5f5820ac855eb5f3f82e1a5fe841693009df6760737d0da914206a9dd04ec4aca8e52c69e36143e4b24a3194ea4d4bbcf3 diff --git a/xrdp.spec b/xrdp.spec index 1708e3c..1f48dc4 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -1,4 +1,4 @@ -%global prerelease -rc.1 +#%global prerelease -rc.1 %global _hardened_build 1 @@ -23,7 +23,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.2 -Release: 0.rc1.1%{?dist} +Release: 1%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ @@ -316,6 +316,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Wed Dec 25 2024 Bojan Smojver - 1:0.10.2~1 +- Update to 0.10.2 + * Tue Dec 24 2024 Bojan Smojver - 1:0.10.2~0.rc1.1 - Update to 0.10.2-rc.1 From b51e0d04c7813171a831ee553b387274f8453a0f Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Wed, 25 Dec 2024 07:39:32 +1100 Subject: [PATCH 22/62] Do not expand macro in comment --- xrdp.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xrdp.spec b/xrdp.spec index 1f48dc4..8a1826b 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -1,4 +1,4 @@ -#%global prerelease -rc.1 +#%%global prerelease -rc.1 %global _hardened_build 1 From c80b7cb47c9a5f0514422d4d54efc741de3733e9 Mon Sep 17 00:00:00 2001 From: Koichiro Iwao Date: Wed, 25 Dec 2024 06:15:04 +0000 Subject: [PATCH 23/62] Enable OpenH264 --- xrdp.spec | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/xrdp.spec b/xrdp.spec index 8a1826b..b5aa3cd 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -23,7 +23,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.2 -Release: 1%{?dist} +Release: 2%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ @@ -61,6 +61,7 @@ BuildRequires: pkgconfig(openssl) BuildRequires: pkgconfig(pixman-1) BuildRequires: pkgconfig(systemd) BuildRequires: nasm +BuildRequires: noopenh264-devel BuildRequires: checkpolicy, selinux-policy-devel BuildRequires: %{_hardlink} @@ -70,6 +71,7 @@ BuildRequires: %{_hardlink} Requires: tigervnc-server-minimal Requires: xorg-x11-xinit Requires: util-linux +Requires: openh264 %if 0%{?fedora} || 0%{?rhel} >= 8 Recommends: %{name}-selinux = %{epoch}:%{version}-%{release} @@ -126,7 +128,8 @@ echo '#!/bin/bash -l autoreconf -vif CFLAGS="$RPM_OPT_FLAGS %{?_missing_braces} %{?_file_offset_bits}" \ %configure --enable-fuse --enable-pixman --enable-painter --enable-vsock \ - --enable-ipv6 --with-socketdir=%{_rundir}/%{name} --with-imlib2 + --enable-ipv6 --with-socketdir=%{_rundir}/%{name} --with-imlib2 \ + --enable-openh264 %make_build # SELinux policy module @@ -316,6 +319,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Wed Dec 25 2024 Koichiro Iwao - 1:0.10.2-2 +- Enable OpenH264 + * Wed Dec 25 2024 Bojan Smojver - 1:0.10.2~1 - Update to 0.10.2 From bbe715feef2a06e6bbb4531e75cb28f731d78e5e Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Wed, 25 Dec 2024 22:41:32 +1100 Subject: [PATCH 24/62] Run as unprivileged user --- xrdp-0.10.2-sesman-ini.patch | 9 +++++++++ xrdp-0.10.2-xrdp-ini.patch | 11 +++++++++++ xrdp.spec | 30 ++++++++++++++++++++++++------ 3 files changed, 44 insertions(+), 6 deletions(-) diff --git a/xrdp-0.10.2-sesman-ini.patch b/xrdp-0.10.2-sesman-ini.patch index 43fd3b8..d1691f7 100644 --- a/xrdp-0.10.2-sesman-ini.patch +++ b/xrdp-0.10.2-sesman-ini.patch @@ -1,5 +1,14 @@ --- xrdp-0.10.2-rc.1/sesman/sesman.ini.in.org 2024-12-24 07:11:02.643702480 +1100 +++ xrdp-0.10.2-rc.1/sesman/sesman.ini.in 2024-12-24 07:12:42.372540720 +1100 +@@ -48,7 +48,7 @@ RestrictInboundClipboard=none + ; local sockets for the session are created. + ; This MUST be the same as runtime_group in xrdp.ini, or xrdp will not + ; be able to connect to your sessions. +-#SessionSockdirGroup=xrdp ++SessionSockdirGroup=xrdp + + + [Sessions] @@ -143,7 +143,7 @@ EnableSyslog=true ; CentOS 8 : param=/usr/libexec/Xorg ; FreeBSD (from 2022Q4) : param=/usr/local/libexec/Xorg diff --git a/xrdp-0.10.2-xrdp-ini.patch b/xrdp-0.10.2-xrdp-ini.patch index ebafbaa..91e53a1 100644 --- a/xrdp-0.10.2-xrdp-ini.patch +++ b/xrdp-0.10.2-xrdp-ini.patch @@ -1,5 +1,16 @@ --- xrdp-0.10.2-rc.1/xrdp/xrdp.ini.in.org 2024-12-24 00:36:22.000000000 +1100 +++ xrdp-0.10.2-rc.1/xrdp/xrdp.ini.in 2024-12-24 07:09:51.329103064 +1100 +@@ -30,8 +30,8 @@ use_vsock=false + ; Unprivileged User name and group to run the xrdp daemon. + ; It is HIGHLY RECOMMENDED you set these values. See the xrdp.ini(5) + ; manpage for more information on setting and checking these. +-#runtime_user=xrdp +-#runtime_group=xrdp ++runtime_user=xrdp ++runtime_group=xrdp + + ; regulate if the listening socket use socket option tcp_nodelay + ; no buffering will be performed in the TCP stack @@ -241,17 +241,17 @@ xrdpvr=true ; Some session types such as Xorg and Xvnc start a display server. ; Startup command-line parameters for the display server are configured diff --git a/xrdp.spec b/xrdp.spec index b5aa3cd..f247e9c 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -23,7 +23,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.2 -Release: 2%{?dist} +Release: 3%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ @@ -36,6 +36,7 @@ Source5: README.Fedora Source6: xrdp.te Source7: xrdp-polkit-1.rules Source8: %{name}-tmpfiles.conf +Source9: %{name}.sysusers Patch0: xrdp-0.10.2-sesman.patch Patch1: xrdp-0.10.2-xrdp-ini.patch Patch2: xrdp-0.10.1-service.patch @@ -66,6 +67,9 @@ BuildRequires: noopenh264-devel BuildRequires: checkpolicy, selinux-policy-devel BuildRequires: %{_hardlink} +BuildRequires: systemd-rpm-macros +%{?sysusers_requires_compat} + # tigervnc-server-minimal provides Xvnc (default for now) # xorgxrdp is another back end, depends on specific Xorg binary, omit Requires: tigervnc-server-minimal @@ -180,6 +184,11 @@ do done %{_hardlink} -cv %{buildroot}%{_datadir}/selinux +%{__install} -p -D -m 0644 %{SOURCE9} %{buildroot}%{_sysusersdir}/xrdp.conf + +%pre +%sysusers_create_compat %{SOURCE9} + %post %{?ldconfig} %systemd_post xrdp.service @@ -209,14 +218,20 @@ fi %posttrans if [ ! -s %{_sysconfdir}/xrdp/rsakeys.ini ]; then - (umask 377; touch %{_sysconfdir}/xrdp/rsakeys.ini; %{_bindir}/xrdp-keygen xrdp %{_sysconfdir}/xrdp/rsakeys.ini &>/dev/null) + (umask 0137 + %{_bindir}/xrdp-keygen xrdp %{_sysconfdir}/xrdp/rsakeys.ini &>/dev/null + chgrp xrdp %{_sysconfdir}/xrdp/rsakeys.ini + chmod g+r %{_sysconfdir}/xrdp/rsakeys.ini) fi if [ ! -s %{_sysconfdir}/xrdp/cert.pem ]; then - (umask 377; openssl req -x509 -newkey rsa:2048 -sha256 -nodes -days 3652 \ - -keyout %{_sysconfdir}/xrdp/key.pem \ - -out %{_sysconfdir}/xrdp/cert.pem \ - -config %{_sysconfdir}/xrdp/openssl.conf &>/dev/null) + (umask 0337 + openssl req -x509 -newkey rsa:2048 -nodes -days 3652 \ + -keyout %{_sysconfdir}/xrdp/key.pem \ + -out %{_sysconfdir}/xrdp/cert.pem \ + -config %{_sysconfdir}/xrdp/openssl.conf &>/dev/null; + chgrp xrdp %{_sysconfdir}/xrdp/{key,cert}.pem + chmod g+r %{_sysconfdir}/xrdp/{key,cert}.pem) fi %post selinux @@ -319,6 +334,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Wed Dec 25 2024 Bojan Smojver - 1:0.10.2~3 +- Run as unprivileged user + * Wed Dec 25 2024 Koichiro Iwao - 1:0.10.2-2 - Enable OpenH264 From 2d02bc5324e9687b4f1bc8f03b2773114c490692 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Wed, 25 Dec 2024 22:43:39 +1100 Subject: [PATCH 25/62] Add xrdp sysusers --- xrdp.sysusers | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 xrdp.sysusers diff --git a/xrdp.sysusers b/xrdp.sysusers new file mode 100644 index 0000000..d405819 --- /dev/null +++ b/xrdp.sysusers @@ -0,0 +1,2 @@ +#Type Name ID GECOS Home directory Shell +u xrdp - "Unprivileged xrdp user" /run/xrdp /sbin/nologin From 52c98619316f8c901b73cefda02386ddcc14314a Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Wed, 25 Dec 2024 22:58:17 +1100 Subject: [PATCH 26/62] Add sysusers file, do not build with H264 on EPEL8 --- xrdp.spec | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/xrdp.spec b/xrdp.spec index f247e9c..624b49c 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -62,7 +62,9 @@ BuildRequires: pkgconfig(openssl) BuildRequires: pkgconfig(pixman-1) BuildRequires: pkgconfig(systemd) BuildRequires: nasm +%if 0%{?fedora} || 0%{?rhel} > 8 BuildRequires: noopenh264-devel +%endif BuildRequires: checkpolicy, selinux-policy-devel BuildRequires: %{_hardlink} @@ -75,7 +77,9 @@ BuildRequires: systemd-rpm-macros Requires: tigervnc-server-minimal Requires: xorg-x11-xinit Requires: util-linux +%if 0%{?fedora} || 0%{?rhel} > 8 Requires: openh264 +%endif %if 0%{?fedora} || 0%{?rhel} >= 8 Recommends: %{name}-selinux = %{epoch}:%{version}-%{release} @@ -131,9 +135,17 @@ echo '#!/bin/bash -l %build autoreconf -vif CFLAGS="$RPM_OPT_FLAGS %{?_missing_braces} %{?_file_offset_bits}" \ -%configure --enable-fuse --enable-pixman --enable-painter --enable-vsock \ - --enable-ipv6 --with-socketdir=%{_rundir}/%{name} --with-imlib2 \ - --enable-openh264 +%configure --enable-fuse \ + --enable-pixman \ + --enable-painter \ + --enable-vsock \ + --enable-ipv6 \ +%if 0%{?fedora} || 0%{?rhel} > 8 + --enable-openh264 \ +%endif + --with-socketdir=%{_rundir}/%{name} \ + --with-imlib2 + %make_build # SELinux policy module @@ -258,6 +270,7 @@ fi %dir %{_datadir}/xrdp %dir %{_libexecdir}/xrdp %{_tmpfilesdir}/%{name}.conf +%{_sysusersdir}/xrdp.conf %config(noreplace) %{_sysconfdir}/xrdp/xrdp.ini %config(noreplace) %{_sysconfdir}/pam.d/xrdp-sesman %config(noreplace) %{_sysconfdir}/logrotate.d/xrdp From 7f62e9d274b2500b24c5204d0192fe115b20c821 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Thu, 26 Dec 2024 15:56:21 +1100 Subject: [PATCH 27/62] Add unprivileged user section to README file --- README.Fedora | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/README.Fedora b/README.Fedora index 2ab9553..f71cc24 100644 --- a/README.Fedora +++ b/README.Fedora @@ -10,6 +10,20 @@ because we could have xrdp and its sessions still running, so subsequent start or restart will fail, unless the permissions of /run/xrdp directory are changed to 1777 beforehand. +Unprivileged xrdp user in 0.10.2 and up +======================================= + +Recent builds of xrdp (0.10.2 and above) create local unprivileged xrdp user, +which is used to run xrdp daemon. Script /usr/share/xrdp/xrdp-chkpriv checks +whether /etc/xrdp/key.pem, /etc/xrdp/cert.pem and /etc/xrdp/rsakeys.ini files +have correct ownership and permissions. It also makes sure /etc/xrdp/xrdp.ini +and /etc/xrdp/sesman.ini agree on which group is used for unprivileged user. + +If you are upgrading from previous version of xrdp and you already have all +these files, you may need to adjust them by hand after running this script. +For clean installs, these files should be created with correct ownership and +permissions. + Restarts ======== From 00ae909eea7c6ad5939c8c2b467e4c4e06fd4308 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Thu, 26 Dec 2024 16:55:06 +1100 Subject: [PATCH 28/62] If openh264 is not present, require noopenh264 instead --- xrdp.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/xrdp.spec b/xrdp.spec index 624b49c..17ac336 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -23,7 +23,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.2 -Release: 3%{?dist} +Release: 4%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ @@ -78,7 +78,7 @@ Requires: tigervnc-server-minimal Requires: xorg-x11-xinit Requires: util-linux %if 0%{?fedora} || 0%{?rhel} > 8 -Requires: openh264 +Requires: (openh264 or noopenh264) %endif %if 0%{?fedora} || 0%{?rhel} >= 8 @@ -347,6 +347,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Thu Dec 26 2024 Bojan Smojver - 1:0.10.2~4 +- If openh264 is not present, require noopenh264 instead + * Wed Dec 25 2024 Bojan Smojver - 1:0.10.2~3 - Run as unprivileged user From 7ee2e171cd34680df48b5932bf0cc98239a75428 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Fri, 27 Dec 2024 07:26:15 +1100 Subject: [PATCH 29/62] Adjust ownership/permissions of certs/keys for unprivileged user --- README.Fedora => README.md | 67 ++++++++++++++++++++------------------ xrdp.spec | 19 ++++++----- 2 files changed, 46 insertions(+), 40 deletions(-) rename README.Fedora => README.md (58%) diff --git a/README.Fedora b/README.md similarity index 58% rename from README.Fedora rename to README.md index f71cc24..d647ec7 100644 --- a/README.Fedora +++ b/README.md @@ -1,7 +1,7 @@ Downgrade from 0.10.x to 0.9.x -============================== +== -Version 0.10.x requires different permissions of /run/xrdp directory than +Version 0.10.x requires different permissions of `/run/xrdp` directory than version 0.9.x. When 0.10.x is fully uninstalled, this directory is removed and subsequent installation of 0.9.x should work fine. @@ -11,13 +11,14 @@ or restart will fail, unless the permissions of /run/xrdp directory are changed to 1777 beforehand. Unprivileged xrdp user in 0.10.2 and up -======================================= +== Recent builds of xrdp (0.10.2 and above) create local unprivileged xrdp user, -which is used to run xrdp daemon. Script /usr/share/xrdp/xrdp-chkpriv checks -whether /etc/xrdp/key.pem, /etc/xrdp/cert.pem and /etc/xrdp/rsakeys.ini files -have correct ownership and permissions. It also makes sure /etc/xrdp/xrdp.ini -and /etc/xrdp/sesman.ini agree on which group is used for unprivileged user. +which is used to run xrdp daemon. Script `/usr/share/xrdp/xrdp-chkpriv` checks +whether `/etc/xrdp/key.pem`, `/etc/xrdp/cert.pem` and `/etc/xrdp/rsakeys.ini` +files have correct ownership and permissions. It also makes sure +`/etc/xrdp/xrdp.ini` and `/etc/xrdp/sesman.ini` agree on which group is used +for unprivileged user. If you are upgrading from previous version of xrdp and you already have all these files, you may need to adjust them by hand after running this script. @@ -25,7 +26,7 @@ For clean installs, these files should be created with correct ownership and permissions. Restarts -======== +== Service restarts after RPM package upgrades have been disabled on purpose. This is to avoid a situation where an update is performed from within a @@ -38,61 +39,63 @@ package upgrade. This is in line with what other GUI systems like Xorg and Wayland do. xorgxrdp -======== +== Note that xorgxrdp is not installed and configured by default. Each build -depends on specific binary version of Xorg, which tends to create very strict -installation dependencies that can be an inconvenience in EPEL. +depends on specific binary version of Xorg. If you wish to use it, install +it by hand or its glamor build. SELinux -======= +== -Please note that you may need to install xrdp-selinux package in order to get -the required SELinux policy that will allow xrdp and associated processes to -run successfully if SELinux is enabled. On versions of Fedora and RHEL that -support weak dependencies, xrdp-selinux will be a recommended package. +You may need to install xrdp-selinux package in order to get the required +SELinux policy that will allow xrdp and associated processes to run +successfully if SELinux is enabled. On versions of Fedora and RHEL that support +weak dependencies, xrdp-selinux will be a recommended package. -WARNING: The policy module contains a rule that permits unconfined_service_t -processes to transition into unconfined_t. If xrdp is not the only service -that runs as unconfined_service_t on your system, this policy will allow any -other such service to transition as well. +**WARNING**: The policy module contains a rule that permits +unconfined_service_t processes to transition into unconfined_t. If xrdp is not +the only service that runs as unconfined_service_t on your system, this policy +will allow any other such service to transition as well. -Default configuration in /etc/pam.d/xrdp-sesman uses password-auth for auth, -account, password and session. This may result in an incorrect context for -the processes in the session. Please adjust this file to match your desktop +Default configuration in `/etc/pam.d/xrdp-sesman` uses password-auth for auth, +account, password and session. This may result in an incorrect context for the +processes in the session. Please adjust this file to match your desktop environment. An example for Gnome desktop is given in the file. TigerVNC >= 1.8.0 -================= +== TigerVNC 1.8.0 enables clipboard support by default (i.e. no need to run vncconfig), which may cause disconnections in xrdp. To avoid the issue, these -can be added to [Xvnc] stanza in /etc/xrdp/sesman.ini: - +can be added to [Xvnc] stanza in `/etc/xrdp/sesman.ini`: +``` param=-AcceptCutText=0 param=-SendCutText=0 param=-SendPrimary=0 param=-SetPrimary=0 +``` Of course, cut and paste support will not work with these set. Runlevel -======== +== If the system is configured to boot into graphical target, you may experience problems with xrdp Gnome sessions. In order to avoid this, put the system into multi user target. Like this: - +``` systemctl set-default multi-user.target +``` Then reboot. VSOCK -======== +== + An example of a how to set up xrdp with VSOCK can be found here: https://bugzilla.redhat.com/show_bug.cgi?id=1787953#c22 -Please note that polkit rules for active sessions, allowing access to colord -and repository updates are already shipped, but in a current, JavaScript -format. +Polkit rules for active sessions, allowing access to colord and repository +updates are already shipped, but in a current, JavaScript format. diff --git a/xrdp.spec b/xrdp.spec index 17ac336..98415d1 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -23,7 +23,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.2 -Release: 4%{?dist} +Release: 5%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ @@ -231,9 +231,7 @@ fi %posttrans if [ ! -s %{_sysconfdir}/xrdp/rsakeys.ini ]; then (umask 0137 - %{_bindir}/xrdp-keygen xrdp %{_sysconfdir}/xrdp/rsakeys.ini &>/dev/null - chgrp xrdp %{_sysconfdir}/xrdp/rsakeys.ini - chmod g+r %{_sysconfdir}/xrdp/rsakeys.ini) + %{_bindir}/xrdp-keygen xrdp %{_sysconfdir}/xrdp/rsakeys.ini &>/dev/null) fi if [ ! -s %{_sysconfdir}/xrdp/cert.pem ]; then @@ -241,11 +239,12 @@ if [ ! -s %{_sysconfdir}/xrdp/cert.pem ]; then openssl req -x509 -newkey rsa:2048 -nodes -days 3652 \ -keyout %{_sysconfdir}/xrdp/key.pem \ -out %{_sysconfdir}/xrdp/cert.pem \ - -config %{_sysconfdir}/xrdp/openssl.conf &>/dev/null; - chgrp xrdp %{_sysconfdir}/xrdp/{key,cert}.pem - chmod g+r %{_sysconfdir}/xrdp/{key,cert}.pem) + -config %{_sysconfdir}/xrdp/openssl.conf &>/dev/null) fi +chgrp xrdp %{_sysconfdir}/xrdp/{rsakeys.ini,{key,cert}.pem} +chmod g+r %{_sysconfdir}/xrdp/{rsakeys.ini,{key,cert}.pem} + %post selinux for selinuxvariant in %{selinux_variants} do @@ -263,7 +262,7 @@ fi %files -%doc COPYING README.Fedora +%doc COPYING README.md %dir %{_libdir}/xrdp %dir %{_sysconfdir}/xrdp %dir %{_sysconfdir}/xrdp/pulse @@ -347,6 +346,10 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Fri Dec 27 2024 Bojan Smojver - 1:0.10.2~5 +- Move README.Fedora to README.md +- Adjust ownership/permissions of certs/keys for unprivileged user + * Thu Dec 26 2024 Bojan Smojver - 1:0.10.2~4 - If openh264 is not present, require noopenh264 instead From a6aced6f4090d03040850451c405b12b6207fcf5 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Fri, 27 Dec 2024 07:39:27 +1100 Subject: [PATCH 30/62] Correct README.md source --- xrdp.spec | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/xrdp.spec b/xrdp.spec index 98415d1..7773825 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -32,7 +32,7 @@ Source1: xrdp-sesman.pamd Source2: xrdp.sysconfig Source3: xrdp.logrotate Source4: openssl.conf -Source5: README.Fedora +Source5: README.md Source6: xrdp.te Source7: xrdp-polkit-1.rules Source8: %{name}-tmpfiles.conf @@ -113,7 +113,9 @@ talk to xrdp. Summary: SELinux policy module required tu run xrdp Requires: %{name} = %{epoch}:%{version}-%{release} +%if "%{_selinux_policy_version}" != "" Requires: selinux-policy >= %{_selinux_policy_version} +%endif Requires(post): /usr/sbin/semodule Requires(postun): /usr/sbin/semodule From 9bea9029697b142173ec7bf6662d1904bdf1c389 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Sun, 5 Jan 2025 14:13:43 +1100 Subject: [PATCH 31/62] Remove noopenh264 dep, adjust permissions of SSL related files --- xrdp.spec | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/xrdp.spec b/xrdp.spec index 7773825..95b9215 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -23,7 +23,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.2 -Release: 5%{?dist} +Release: 6%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ @@ -77,9 +77,6 @@ BuildRequires: systemd-rpm-macros Requires: tigervnc-server-minimal Requires: xorg-x11-xinit Requires: util-linux -%if 0%{?fedora} || 0%{?rhel} > 8 -Requires: (openh264 or noopenh264) -%endif %if 0%{?fedora} || 0%{?rhel} >= 8 Recommends: %{name}-selinux = %{epoch}:%{version}-%{release} @@ -245,7 +242,7 @@ if [ ! -s %{_sysconfdir}/xrdp/cert.pem ]; then fi chgrp xrdp %{_sysconfdir}/xrdp/{rsakeys.ini,{key,cert}.pem} -chmod g+r %{_sysconfdir}/xrdp/{rsakeys.ini,{key,cert}.pem} +chmod 0640 %{_sysconfdir}/xrdp/{rsakeys.ini,{key,cert}.pem} %post selinux for selinuxvariant in %{selinux_variants} @@ -348,6 +345,10 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Sun Jan 5 2025 Bojan Smojver - 1:0.10.2~6 +- Set permissions of cert, key and rsakeys.ini to 0640 +- Revert optional dependency on noopenh264, library dependency exists + * Fri Dec 27 2024 Bojan Smojver - 1:0.10.2~5 - Move README.Fedora to README.md - Adjust ownership/permissions of certs/keys for unprivileged user From 0fb0287ee9a32761aae46804b99332c5c830d771 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Sun, 5 Jan 2025 21:21:58 +1100 Subject: [PATCH 32/62] Comment out generic RDP proxy in xrdp.ini --- xrdp-0.10.2-xrdp-ini.patch | 27 +++++++++++++++++++++++++-- xrdp.spec | 5 ++++- 2 files changed, 29 insertions(+), 3 deletions(-) diff --git a/xrdp-0.10.2-xrdp-ini.patch b/xrdp-0.10.2-xrdp-ini.patch index 91e53a1..a3ba022 100644 --- a/xrdp-0.10.2-xrdp-ini.patch +++ b/xrdp-0.10.2-xrdp-ini.patch @@ -1,5 +1,5 @@ ---- xrdp-0.10.2-rc.1/xrdp/xrdp.ini.in.org 2024-12-24 00:36:22.000000000 +1100 -+++ xrdp-0.10.2-rc.1/xrdp/xrdp.ini.in 2024-12-24 07:09:51.329103064 +1100 +--- xrdp-0.10.2/xrdp/xrdp.ini.in.org 2024-12-25 00:09:57.000000000 +1100 ++++ xrdp-0.10.2/xrdp/xrdp.ini.in 2025-01-05 21:20:01.983691029 +1100 @@ -30,8 +30,8 @@ use_vsock=false ; Unprivileged User name and group to run the xrdp daemon. ; It is HIGHLY RECOMMENDED you set these values. See the xrdp.ini(5) @@ -60,3 +60,26 @@ #pamusername=asksame #pampassword=asksame #delay_ms=2000 +@@ -292,15 +292,15 @@ password=ask + ; Generic RDP proxy using NeutrinoRDP + ; Tailor this to specific hosts by specifying an ip and port and setting + ; a suitable name. +-[neutrinordp-any] +-name=neutrinordp-any ++#[neutrinordp-any] ++#name=neutrinordp-any + ; To use this section, you should build xrdp with configure option + ; --enable-neutrinordp. +-lib=libxrdpneutrinordp.@lib_extension@ +-ip=ask +-port=ask3389 +-username=ask +-password=ask ++#lib=libxrdpneutrinordp.@lib_extension@ ++#ip=ask ++#port=ask3389 ++#username=ask ++#password=ask + ; Uncomment the following lines to enable PAM authentication for proxy + ; connections. + #pamusername=ask diff --git a/xrdp.spec b/xrdp.spec index 95b9215..0a4fa8e 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -23,7 +23,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.2 -Release: 6%{?dist} +Release: 7%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ @@ -345,6 +345,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Sun Jan 5 2025 Bojan Smojver - 1:0.10.2~7 +- Comment out generic RDP proxy in xrdp.ini + * Sun Jan 5 2025 Bojan Smojver - 1:0.10.2~6 - Set permissions of cert, key and rsakeys.ini to 0640 - Revert optional dependency on noopenh264, library dependency exists From 301178bcb78e1b7a9ba0c070acd48a5f8f046bf1 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 19 Jan 2025 16:16:31 +0000 Subject: [PATCH 33/62] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- xrdp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xrdp.spec b/xrdp.spec index 0a4fa8e..630eddb 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -23,7 +23,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.2 -Release: 7%{?dist} +Release: 8%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ @@ -345,6 +345,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Sun Jan 19 2025 Fedora Release Engineering - 1:0.10.2-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Sun Jan 5 2025 Bojan Smojver - 1:0.10.2~7 - Comment out generic RDP proxy in xrdp.ini From 0a6bb02d7a058a794a023f0cf76d56ed597c16dd Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Sat, 25 Jan 2025 16:27:06 +1100 Subject: [PATCH 34/62] Document KDE Plasma specific info --- README.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index d647ec7..6d28731 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ and subsequent installation of 0.9.x should work fine. However, if 0.10.x is downgraded to 0.9.x, the directory is preserved, because we could have xrdp and its sessions still running, so subsequent start -or restart will fail, unless the permissions of /run/xrdp directory are +or restart will fail, unless the permissions of `/run/xrdp` directory are changed to 1777 beforehand. Unprivileged xrdp user in 0.10.2 and up @@ -99,3 +99,11 @@ https://bugzilla.redhat.com/show_bug.cgi?id=1787953#c22 Polkit rules for active sessions, allowing access to colord and repository updates are already shipped, but in a current, JavaScript format. + +KDE Plasma +== + +If you are using plasma-workspace package with xrdp, be sure to install +plasma-workspace-x11 to get full functionality. See this for more details: + +https://github.com/neutrinolabs/xrdp/issues/3395 From 560f7a200368ef154f88a911ba9ab0357ca0617c Mon Sep 17 00:00:00 2001 From: mlewissmith Date: Mon, 27 Jan 2025 13:10:31 +0000 Subject: [PATCH 35/62] Add utmp support Addresses RHBZ#2339004 - Backport https://github.com/neutrinolabs/xrdp/pull/3400 - Build with necessary build flag '--enable-utmp' - Update xrdp-sesman.pamd accordingly --- xrdp-0.10.2-utmpfix.patch | 816 ++++++++++++++++++++++++++++++++++++++ xrdp-sesman.pamd | 2 + xrdp.spec | 2 + 3 files changed, 820 insertions(+) create mode 100644 xrdp-0.10.2-utmpfix.patch diff --git a/xrdp-0.10.2-utmpfix.patch b/xrdp-0.10.2-utmpfix.patch new file mode 100644 index 0000000..fd3908d --- /dev/null +++ b/xrdp-0.10.2-utmpfix.patch @@ -0,0 +1,816 @@ +commit 4c119d18e1d5d8c2b36fe4d7fe7b95511d72f7e7 +Author: mlewissmith +Date: Fri Jan 17 14:28:13 2025 +0000 + + Add utmp/wtmp support + + Cherry-pick 28f175b9..2ff3edd0 + + See: + * PR #2745 "Add utmp/wtmp support" + https://github.com/neutrinolabs/xrdp/pull/2745 + * Discussion #2744 "utmp/wtmp/btmp/lastlog" + https://github.com/neutrinolabs/xrdp/discussions/2744 + +diff --git a/common/os_calls.c b/common/os_calls.c +index 1060934a..580ed050 100644 +--- a/common/os_calls.c ++++ b/common/os_calls.c +@@ -3329,10 +3329,10 @@ g_set_allusercontext(int uid) + /*****************************************************************************/ + /* does not work in win32 + returns pid of process that exits or zero if signal occurred +- an exit_status struct can optionally be passed in to get the ++ a proc_exit_status struct can optionally be passed in to get the + exit status of the child */ + int +-g_waitchild(struct exit_status *e) ++g_waitchild(struct proc_exit_status *e) + { + #if defined(_WIN32) + return 0; +@@ -3340,14 +3340,14 @@ g_waitchild(struct exit_status *e) + int wstat; + int rv; + +- struct exit_status dummy; ++ struct proc_exit_status dummy; + + if (e == NULL) + { + e = &dummy; // Set this, then throw it away + } + +- e->reason = E_XR_UNEXPECTED; ++ e->reason = E_PXR_UNEXPECTED; + e->val = 0; + + rv = waitpid(-1, &wstat, WNOHANG); +@@ -3362,12 +3362,12 @@ g_waitchild(struct exit_status *e) + } + else if (WIFEXITED(wstat)) + { +- e->reason = E_XR_STATUS_CODE; ++ e->reason = E_PXR_STATUS_CODE; + e->val = WEXITSTATUS(wstat); + } + else if (WIFSIGNALED(wstat)) + { +- e->reason = E_XR_SIGNAL; ++ e->reason = E_PXR_SIGNAL; + e->val = WTERMSIG(wstat); + } + +@@ -3408,10 +3408,14 @@ g_waitpid(int pid) + + Note that signal handlers are established with BSD-style semantics, + so this call is NOT interrupted by a signal */ +-struct exit_status ++struct proc_exit_status + g_waitpid_status(int pid) + { +- struct exit_status exit_status = {.reason = E_XR_UNEXPECTED, .val = 0}; ++ struct proc_exit_status exit_status = ++ { ++ .reason = E_PXR_UNEXPECTED, ++ .val = 0 ++ }; + + #if !defined(_WIN32) + if (pid > 0) +@@ -3426,12 +3430,12 @@ g_waitpid_status(int pid) + { + if (WIFEXITED(status)) + { +- exit_status.reason = E_XR_STATUS_CODE; ++ exit_status.reason = E_PXR_STATUS_CODE; + exit_status.val = WEXITSTATUS(status); + } + if (WIFSIGNALED(status)) + { +- exit_status.reason = E_XR_SIGNAL; ++ exit_status.reason = E_PXR_SIGNAL; + exit_status.val = WTERMSIG(status); + } + } +diff --git a/common/os_calls.h b/common/os_calls.h +index cf4dc17d..be06b07b 100644 +--- a/common/os_calls.h ++++ b/common/os_calls.h +@@ -23,16 +23,16 @@ + + #include "arch.h" + +-enum exit_reason ++enum proc_exit_reason + { +- E_XR_STATUS_CODE = 0, ///< 'val' contains exit status +- E_XR_SIGNAL, ///< 'val' contains a signal number +- E_XR_UNEXPECTED ++ E_PXR_STATUS_CODE = 0, ///< 'val' contains exit status ++ E_PXR_SIGNAL, ///< 'val' contains a signal number ++ E_PXR_UNEXPECTED + }; + +-struct exit_status ++struct proc_exit_status + { +- enum exit_reason reason; ++ enum proc_exit_reason reason; + int val; + }; + +@@ -353,9 +353,9 @@ int g_setlogin(const char *name); + */ + int g_set_allusercontext(int uid); + #endif +-int g_waitchild(struct exit_status *e); ++int g_waitchild(struct proc_exit_status *e); + int g_waitpid(int pid); +-struct exit_status g_waitpid_status(int pid); ++struct proc_exit_status g_waitpid_status(int pid); + /* + * Sets the process group ID of the indicated process to the specified value. + * (POSIX.1) +diff --git a/configure.ac b/configure.ac +index 9b43c2ce..bf3cff9f 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -6,6 +6,7 @@ AC_DEFINE([VERSION_YEAR], 2025, [Copyright year]) + AC_CONFIG_HEADERS(config_ac.h:config_ac-h.in) + AM_INIT_AUTOMAKE([1.7.2 foreign]) + AC_CONFIG_MACRO_DIR([m4]) ++AC_USE_SYSTEM_EXTENSIONS + AC_PROG_CC + AC_PROG_CXX + AC_C_CONST +@@ -190,6 +191,11 @@ AC_ARG_ENABLE(rdpsndaudin, AS_HELP_STRING([--enable-rdpsndaudin], + [], [enable_rdpsndaudin=no]) + AM_CONDITIONAL(XRDP_RDPSNDAUDIN, [test x$enable_rdpsndaudin = xyes]) + ++AC_ARG_ENABLE(utmp, AS_HELP_STRING([--enable-utmp], ++ [Update utmp (default: no)]), ++ [], [enable_utmp=no]) ++AM_CONDITIONAL(XRDP_UTMP, [test x$enable_utmp = xyes]) ++ + AC_ARG_WITH(imlib2, AS_HELP_STRING([--with-imlib2=ARG], [imlib2 library to use for non-BMP backgrounds (ARG=yes/no/)]),,) + + AC_ARG_WITH(freetype2, AS_HELP_STRING([--with-freetype2=ARG], [freetype2 library to use for rendering fonts (ARG=yes/no/)]),,) +@@ -526,6 +532,15 @@ AC_CHECK_HEADER([X11/extensions/Xrandr.h], [], + [AC_MSG_ERROR([please install libxrandr-dev or libXrandr-devel])], + [#include ]) + ++if test "x$enable_utmp" = "xyes" ++then ++ AC_CHECK_HEADERS(utmp.h utmpx.h) ++ ++ # Test for non-standard extensions in struct utmpx ++ AXRDP_CHECK_UTMPX_MEMBER_EXISTS([ut_host], [HAVE_UTMPX_UT_HOST]) ++ AXRDP_CHECK_UTMPX_MEMBER_EXISTS([ut_exit], [HAVE_UTMPX_UT_EXIT]) ++fi ++ + CFLAGS="$save_CFLAGS" + + # perform unit tests if libcheck and libmocka found +@@ -652,6 +667,12 @@ echo " ipv6only $enable_ipv6only" + echo " vsock $enable_vsock" + echo " auth mechanism $auth_mech" + echo " rdpsndaudin $enable_rdpsndaudin" ++echo " utmp support $enable_utmp" ++if test x$enable_utmp = xyes; then ++ echo " utmpx.ut_host $ac_cv_utmpx_has_ut_host" ++ echo " utmpx.ut_exit $ac_cv_utmpx_has_ut_exit" ++fi ++ + echo + echo " with imlib2 $use_imlib2" + echo " with freetype2 $use_freetype2" +diff --git a/instfiles/pam.d/xrdp-sesman.arch b/instfiles/pam.d/xrdp-sesman.arch +index 2763612e..7b4a3616 100644 +--- a/instfiles/pam.d/xrdp-sesman.arch ++++ b/instfiles/pam.d/xrdp-sesman.arch +@@ -1,4 +1,3 @@ +-#%PAM-1.0 + auth include system-remote-login + -auth optional pam_gnome_keyring.so + -auth optional pam_kwallet5.so +@@ -8,5 +7,8 @@ account include system-remote-login + password include system-remote-login + + session include system-remote-login ++# For wtmp/lastlog support uncomment one of the following lines:- ++#session optional pam_lastlog.so quiet ++#session optional pam_lastlog2.so silent + -session optional pam_gnome_keyring.so auto_start + -session optional pam_kwallet5.so auto_start +diff --git a/instfiles/pam.d/xrdp-sesman.debian b/instfiles/pam.d/xrdp-sesman.debian +index cc692726..b97711bb 100644 +--- a/instfiles/pam.d/xrdp-sesman.debian ++++ b/instfiles/pam.d/xrdp-sesman.debian +@@ -11,6 +11,10 @@ auth required pam_env.so readenv=1 envfile=/etc/default/locale + + # Ensure resource limits are applied + session required pam_limits.so ++# Set the loginuid process attribute. ++session required pam_loginuid.so ++# Update wtmp/lastlog ++session optional pam_lastlog.so quiet + @include common-session + -session optional pam_gnome_keyring.so auto_start + -session optional pam_kwallet5.so auto_start +diff --git a/instfiles/pam.d/xrdp-sesman.redhat b/instfiles/pam.d/xrdp-sesman.redhat +index 9da2690b..02c0ed97 100644 +--- a/instfiles/pam.d/xrdp-sesman.redhat ++++ b/instfiles/pam.d/xrdp-sesman.redhat +@@ -1,5 +1,11 @@ + #%PAM-1.0 + auth include password-auth + account include password-auth ++ ++# Set the loginuid process attribute. ++session required pam_loginuid.so ++# Update wtmp/lastlog ++session optional pam_lastlog.so quiet ++ + session include password-auth + password include password-auth +diff --git a/instfiles/pam.d/xrdp-sesman.suse b/instfiles/pam.d/xrdp-sesman.suse +index a7c7836c..87d40780 100644 +--- a/instfiles/pam.d/xrdp-sesman.suse ++++ b/instfiles/pam.d/xrdp-sesman.suse +@@ -1,5 +1,11 @@ + #%PAM-1.0 + auth include common-auth + account include common-account ++ ++# Set the loginuid process attribute. ++session required pam_loginuid.so ++# Update lastlog database ++session optional pam_lastlog2.so silent ++ + session include common-session + password include common-password +diff --git a/instfiles/pam.d/xrdp-sesman.system b/instfiles/pam.d/xrdp-sesman.system +index 5025a0f9..172360c6 100644 +--- a/instfiles/pam.d/xrdp-sesman.system ++++ b/instfiles/pam.d/xrdp-sesman.system +@@ -2,4 +2,8 @@ + auth include system-auth + account include system-auth + password include system-auth ++ ++# For wtmp/lastlog support uncomment one of the following lines:- ++#session optional pam_lastlog.so quiet ++#session optional pam_lastlog2.so silent + session include system-auth +diff --git a/m4/axrdp.m4 b/m4/axrdp.m4 +new file mode 100644 +index 00000000..4ba87e5d +--- /dev/null ++++ b/m4/axrdp.m4 +@@ -0,0 +1,43 @@ ++# SYNOPSIS ++# ++# AXRDP_CHECK_UTMPX_MEMBER_EXISTS(MEMBER, COMPILE-DEFINE) ++# ++# EXAMPLE ++# ++# AXRDP_CHECK_UTMPX_MEMBER_EXISTS([ut_exit], [HAVE_UTMPX_UT_EXIT]) ++# ++# DESCRIPTION ++# ++# If the member MEMBER exists in the utmpx struct, the COMPILE-DEFINE ++# is set for the C compiler. ++# ++# The shell variable 'ac_cv_utmpx_has_$MEMBER' is set to 'yes' or 'no' ++# and cached ++# ++AC_DEFUN([AXRDP_CHECK_UTMPX_MEMBER_EXISTS], ++[ ++ AS_VAR_PUSHDEF([x_var], [ac_cv_utmpx_has_$1]) ++ AS_VAR_PUSHDEF([x_define], [$2]) ++ AC_CACHE_CHECK( ++ [for $1 in struct utmpx], ++ [x_var], ++ [AC_COMPILE_IFELSE( ++ [AC_LANG_SOURCE([[ ++# include ++# include ++ int main() ++ { ++ return offsetof(struct utmpx,$1); ++ }]])], ++ [AS_VAR_SET([x_var], [yes])], ++ [AS_VAR_SET([x_var], [no])])] ++ ) ++ AS_VAR_IF( ++ [x_var], ++ [yes], ++ [AC_DEFINE([x_define], [1], [Define if '$1' is in struct utmpx.])]) ++ AS_VAR_POPDEF([x_var]) ++ AS_VAR_POPDEF([x_define]) ++]) ++ ++ +diff --git a/sesman/sesexec/Makefile.am b/sesman/sesexec/Makefile.am +index a41d335b..1eae19cb 100644 +--- a/sesman/sesexec/Makefile.am ++++ b/sesman/sesexec/Makefile.am +@@ -9,6 +9,10 @@ AM_CPPFLAGS = \ + + SESEXEC_EXTRA_LIBS = + ++if XRDP_UTMP ++ AM_CPPFLAGS += -DUSE_UTMP ++endif ++ + pkglibexec_PROGRAMS = \ + xrdp-sesexec + +@@ -25,6 +29,8 @@ xrdp_sesexec_SOURCES = \ + env.h \ + login_info.c \ + login_info.h \ ++ sessionrecord.c \ ++ sessionrecord.h \ + xauth.c \ + xauth.h \ + xwait.c \ +diff --git a/sesman/sesexec/sesexec.c b/sesman/sesexec/sesexec.c +index 3e9763dd..67b493e8 100644 +--- a/sesman/sesexec/sesexec.c ++++ b/sesman/sesexec/sesexec.c +@@ -241,7 +241,7 @@ sesexec_terminate_main_loop(int status) + static void + process_sigchld_event(void) + { +- struct exit_status e; ++ struct proc_exit_status e; + int pid; + + // Check for any finished children +diff --git a/sesman/sesexec/session.c b/sesman/sesexec/session.c +index a4950973..f9c40820 100644 +--- a/sesman/sesexec/session.c ++++ b/sesman/sesexec/session.c +@@ -47,6 +47,7 @@ + #include "login_info.h" + #include "os_calls.h" + #include "sesexec.h" ++#include "sessionrecord.h" + #include "string_calls.h" + #include "xauth.h" + #include "xwait.h" +@@ -656,6 +657,7 @@ session_start_wrapped(struct login_info *login_info, + } + else + { ++ utmp_login(window_manager_pid, s->display, login_info); + LOG(LOG_LEVEL_INFO, + "Starting the xrdp channel server for display :%d", + s->display); +@@ -807,11 +809,11 @@ cleanup_sockets(int uid, int display) + + /******************************************************************************/ + static void +-exit_status_to_str(const struct exit_status *e, char buff[], int bufflen) ++exit_status_to_str(const struct proc_exit_status *e, char buff[], int bufflen) + { + switch (e->reason) + { +- case E_XR_STATUS_CODE: ++ case E_PXR_STATUS_CODE: + if (e->val == 0) + { + g_snprintf(buff, bufflen, "exit code zero"); +@@ -822,7 +824,7 @@ exit_status_to_str(const struct exit_status *e, char buff[], int bufflen) + } + break; + +- case E_XR_SIGNAL: ++ case E_PXR_SIGNAL: + { + char sigstr[MAXSTRSIGLEN]; + g_snprintf(buff, bufflen, "signal %s", +@@ -840,7 +842,7 @@ exit_status_to_str(const struct exit_status *e, char buff[], int bufflen) + void + session_process_child_exit(struct session_data *sd, + int pid, +- const struct exit_status *e) ++ const struct proc_exit_status *e) + { + if (pid == sd->x_server) + { +@@ -860,7 +862,7 @@ session_process_child_exit(struct session_data *sd, + { + int wm_wait_time = g_time1() - sd->start_time; + +- if (e->reason == E_XR_STATUS_CODE && e->val == 0) ++ if (e->reason == E_PXR_STATUS_CODE && e->val == 0) + { + LOG(LOG_LEVEL_INFO, + "Window manager (pid %d, display %d) " +@@ -886,6 +888,7 @@ session_process_child_exit(struct session_data *sd, + sd->win_mgr, sd->params.display, wm_wait_time); + } + ++ utmp_logout(sd->win_mgr, sd->params.display, e); + sd->win_mgr = -1; + + if (sd->x_server > 0) +diff --git a/sesman/sesexec/session.h b/sesman/sesexec/session.h +index dee9fe36..5cfab140 100644 +--- a/sesman/sesexec/session.h ++++ b/sesman/sesexec/session.h +@@ -35,7 +35,7 @@ + #include "xrdp_constants.h" + + struct login_info; +-struct exit_status; ++struct proc_exit_status; + + /** + * Information used to start a session +@@ -89,7 +89,7 @@ session_start(struct login_info *login_info, + void + session_process_child_exit(struct session_data *sd, + int pid, +- const struct exit_status *e); ++ const struct proc_exit_status *e); + + /** + * Returns a count of active processes in the session +diff --git a/sesman/sesexec/sessionrecord.c b/sesman/sesexec/sessionrecord.c +new file mode 100644 +index 00000000..d9dce5a4 +--- /dev/null ++++ b/sesman/sesexec/sessionrecord.c +@@ -0,0 +1,200 @@ ++/** ++ * xrdp: A Remote Desktop Protocol server. ++ * ++ * Copyright (C) Emmanuel Blindauer 2017 ++ * ++ * Licensed under the Apache License, Version 2.0 (the "License"); ++ * you may not use this file except in compliance with the License. ++ * You may obtain a copy of the License at ++ * ++ * http://www.apache.org/licenses/LICENSE-2.0 ++ * ++ * Unless required by applicable law or agreed to in writing, software ++ * distributed under the License is distributed on an "AS IS" BASIS, ++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. ++ * See the License for the specific language governing permissions and ++ * limitations under the License. ++ * ++ * str2memcpy() is taken from util-linux/include/strutils.h v2.39 which ++ * has the following header:- ++ * ++ * No copyright is claimed. This code is in the public domain; do with ++ * it what you wish. ++ */ ++ ++/** ++ * ++ * @file sessionrecord.c ++ * @brief utmp handling code ++ * ++ * wtmp/lastlog/btmp is handled by PAM or (on FreeBSD) UTX ++ * ++ * Idea: Only implement actual utmp, i.e. utmpx for 99%. ++ * See http://80386.nl/unix/utmpx/ ++ */ ++ ++#if defined(HAVE_CONFIG_H) ++#include ++#endif ++ ++#include "sessionrecord.h" ++#include "login_info.h" ++#include "log.h" ++ ++// Operational mode of add_xtmp_entry() ++// ++// We can't use USER_PROCESS/DEAD_PROCESS directly, as they ++// won't be available for platforms without USE_UTMP ++enum add_xtmp_mode ++{ ++ MODE_LOGIN, ++ MODE_LOGOUT ++}; ++ ++#ifdef USE_UTMP ++ ++#include ++#include ++#include ++ ++#ifdef HAVE_UTMPX_H ++#include ++typedef struct utmpx _utmp; ++#else ++#include ++typedef struct utmp _utmp; ++#endif ++ ++#include "os_calls.h" ++#include "string_calls.h" ++ ++#define XRDP_LINE_FORMAT "xrdp:%d" ++// ut_id is a very small field on some platforms, so use the display ++// number in hex ++#define XRDP_ID_FORMAT ":%x" ++ ++/******************************************************************************/ ++/** ++ * utmp-specific strncpy() replacement ++ * ++ * @param dest Destination pointer ++ * @param src Source pointer ++ * @param n bytes to copy ++ * ++ * This is like strncpy(), but based on memcpy(), so compilers and static ++ * analyzers do not complain when sizeof(destination) is the same as 'n' and ++ * result is not terminated by zero. ++ * ++ * ONLY use this function to copy string to logs with fixed sizes ++ * (wtmp/utmp. ...) where string terminator is optional. ++ */ ++static inline void *__attribute__((nonnull (1))) ++str2memcpy(void *dest, const char *src, size_t n) ++{ ++ size_t bytes = strlen(src) + 1; ++ ++ if (bytes > n) ++ { ++ bytes = n; ++ } ++ ++ memcpy(dest, src, bytes); ++ return dest; ++} ++ ++/******************************************************************************/ ++/** ++ * Prepare the utmp struct and write it. ++ * ++ * @param pid PID of session manager ++ * @param display Display number of session ++ * @param login_info Login info (NULL for MODE_LOGOUT) ++ * @param mode see enum add_xtmp_mode ++ * @param e Exit status (NULL unless MODE_LOGOUT) ++ */ ++ ++static void ++add_xtmp_entry(int pid, int display, const struct login_info *login_info, ++ enum add_xtmp_mode mode, const struct proc_exit_status *e) ++{ ++ char idbuff[16]; ++ char str_display[16]; ++ ++ _utmp ut; ++ struct timeval tv; ++ ++ g_memset(&ut, 0, sizeof(ut)); ++ g_snprintf(str_display, sizeof(str_display), XRDP_LINE_FORMAT, display); ++ g_snprintf(idbuff, sizeof(idbuff), XRDP_ID_FORMAT, display); ++ gettimeofday(&tv, NULL); ++ ++ ut.ut_type = (mode == MODE_LOGIN) ? USER_PROCESS : DEAD_PROCESS; ++ ut.ut_pid = pid; ++ str2memcpy(ut.ut_id, idbuff, sizeof(ut.ut_id)); ++ ++ // Linux utmp(5) suggests ut_line, ut_time, ut_user, and ut_host ++ // are not set for a DEAD_PROCESS ++ if (ut.ut_type != DEAD_PROCESS) ++ { ++ ut.ut_tv.tv_sec = tv.tv_sec; ++ ut.ut_tv.tv_usec = tv.tv_usec; ++ str2memcpy(ut.ut_line, str_display, sizeof(ut.ut_line)); ++ if (login_info != NULL) ++ { ++ str2memcpy(ut.ut_user, login_info->username, sizeof(ut.ut_user)); ++#ifdef HAVE_UTMPX_UT_HOST ++ str2memcpy(ut.ut_host, login_info->ip_addr, sizeof(ut.ut_host)); ++#endif ++ } ++ } ++ ++#ifdef HAVE_UTMPX_UT_EXIT ++ if (e != NULL && e->reason == E_PXR_STATUS_CODE) ++ { ++ ut.ut_exit.e_exit = e->val; ++ } ++ else if (e != NULL && e->reason == E_PXR_SIGNAL) ++ { ++ ut.ut_exit.e_termination = e->val; ++ } ++#endif ++ ++ /* update the utmp file */ ++ /* open utmp */ ++ setutxent(); ++ /* add the computed entry */ ++ pututxline(&ut); ++ /* closes utmp */ ++ endutxent(); ++ ++} ++#else // USE_UTMP ++static void ++add_xtmp_entry(int pid, int display, const struct login_info *login_info, ++ short state, const struct proc_exit_status *e) ++{ ++} ++#endif ++ ++ ++/******************************************************************************/ ++void ++utmp_login(int pid, int display, const struct login_info *login_info) ++{ ++ log_message(LOG_LEVEL_DEBUG, ++ "adding login info for utmp: %d - %d - %s - %s", ++ pid, display, login_info->username, login_info->ip_addr); ++ ++ add_xtmp_entry(pid, display, login_info, MODE_LOGIN, NULL); ++} ++ ++/******************************************************************************/ ++void ++utmp_logout(int pid, int display, const struct proc_exit_status *exit_status) ++{ ++ ++ log_message(LOG_LEVEL_DEBUG, "adding logout info for utmp: %d - %d", ++ pid, display); ++ ++ add_xtmp_entry(pid, display, NULL, MODE_LOGOUT, exit_status); ++} +diff --git a/sesman/sesexec/sessionrecord.h b/sesman/sesexec/sessionrecord.h +new file mode 100644 +index 00000000..d5478771 +--- /dev/null ++++ b/sesman/sesexec/sessionrecord.h +@@ -0,0 +1,52 @@ ++/** ++ * xrdp: A Remote Desktop Protocol server. ++ * ++ * Copyright (C) Emmanuel Blindauer 2017 ++ * ++ * Licensed under the Apache License, Version 2.0 (the "License"); ++ * you may not use this file except in compliance with the License. ++ * You may obtain a copy of the License at ++ * ++ * http://www.apache.org/licenses/LICENSE-2.0 ++ * ++ * Unless required by applicable law or agreed to in writing, software ++ * distributed under the License is distributed on an "AS IS" BASIS, ++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. ++ * See the License for the specific language governing permissions and ++ * limitations under the License. ++ */ ++ ++/** ++ * ++ * @file sessionrecord.h ++ * @brief utmp handling code ++ * ++ */ ++ ++#ifndef SESSIONRECORD_H ++#define SESSIONRECORD_H ++ ++struct login_info; ++struct proc_exit_status; ++ ++/** ++ * @brief Record login in utmp ++ * ++ * @param pid PID of window manager ++ * @param display Display number ++ * @param login_info Information about logged in user ++ */ ++void ++utmp_login(int pid, int display, const struct login_info *login_info); ++ ++/** ++ * @brief Record logout in utmp ++ * ++ * @param pid PID of window manager ++ * @param display Display number ++ * @param exit_status Exit status of process ++ */ ++void ++utmp_logout(int pid, int display, const struct proc_exit_status *exit_status); ++ ++#endif +diff --git a/sesman/sesexec/xwait.c b/sesman/sesexec/xwait.c +index 9a7bd376..7531d451 100644 +--- a/sesman/sesexec/xwait.c ++++ b/sesman/sesexec/xwait.c +@@ -142,7 +142,7 @@ wait_for_xserver(uid_t uid, + } + else + { +- struct exit_status e; ++ struct proc_exit_status e; + + fd[0] = -1; // File descriptor closed by fclose() + log_waitforx_messages(dp); +@@ -150,11 +150,11 @@ wait_for_xserver(uid_t uid, + e = g_waitpid_status(pid); + switch (e.reason) + { +- case E_XR_STATUS_CODE: ++ case E_PXR_STATUS_CODE: + rv = (enum xwait_status)e.val; + break; + +- case E_XR_SIGNAL: ++ case E_PXR_SIGNAL: + { + char sigstr[MAXSTRSIGLEN]; + LOG(LOG_LEVEL_ERROR, +diff --git a/tests/common/test_os_calls_signals.c b/tests/common/test_os_calls_signals.c +index 8028f895..4470e27a 100644 +--- a/tests/common/test_os_calls_signals.c ++++ b/tests/common/test_os_calls_signals.c +@@ -79,7 +79,7 @@ END_TEST + /******************************************************************************/ + START_TEST(test_g_signal_child_stop_1) + { +- struct exit_status e; ++ struct proc_exit_status e; + + g_reset_wait_obj(g_wobj1); + ck_assert_int_eq(g_is_wait_obj_set(g_wobj1), 0); +@@ -98,7 +98,7 @@ START_TEST(test_g_signal_child_stop_1) + + e = g_waitpid_status(pid); + +- ck_assert_int_eq(e.reason, E_XR_STATUS_CODE); ++ ck_assert_int_eq(e.reason, E_PXR_STATUS_CODE); + ck_assert_int_eq(e.val, 45); + + // Try another one to make sure the signal handler is still in place. +@@ -119,7 +119,7 @@ START_TEST(test_g_signal_child_stop_1) + + e = g_waitpid_status(pid); + +- ck_assert_int_eq(e.reason, E_XR_SIGNAL); ++ ck_assert_int_eq(e.reason, E_PXR_SIGNAL); + ck_assert_int_eq(e.val, SIGSEGV); + + // Clean up +@@ -136,7 +136,7 @@ START_TEST(test_g_signal_child_stop_2) + int pids[CHILD_COUNT]; + unsigned int i; + +- struct exit_status e; ++ struct proc_exit_status e; + + g_reset_wait_obj(g_wobj1); + ck_assert_int_eq(g_is_wait_obj_set(g_wobj1), 0); +@@ -160,7 +160,7 @@ START_TEST(test_g_signal_child_stop_2) + for (i = 0 ; i < CHILD_COUNT; ++i) + { + e = g_waitpid_status(pids[i]); +- ck_assert_int_eq(e.reason, E_XR_STATUS_CODE); ++ ck_assert_int_eq(e.reason, E_PXR_STATUS_CODE); + ck_assert_int_eq(e.val, (i + 1)); + } + +@@ -249,12 +249,12 @@ START_TEST(test_waitpid_not_interrupted_by_sig) + g_reset_wait_obj(g_wobj1); + g_set_alarm(set_wobj1, 1); + +- struct exit_status e = g_waitpid_status(child_pid); ++ struct proc_exit_status e = g_waitpid_status(child_pid); + // We should have had the alarm... + ck_assert_int_ne(g_is_wait_obj_set(g_wobj1), 0); + + // ..and got the status of the child +- ck_assert_int_eq(e.reason, E_XR_STATUS_CODE); ++ ck_assert_int_eq(e.reason, E_PXR_STATUS_CODE); + ck_assert_int_eq(e.val, 42); + + // Clean up +diff --git a/xrdp/xrdp_listen.c b/xrdp/xrdp_listen.c +index e06b8ec3..f7740ce5 100644 +--- a/xrdp/xrdp_listen.c ++++ b/xrdp/xrdp_listen.c +@@ -768,12 +768,12 @@ xrdp_listen_conn_in(struct trans *self, struct trans *new_self) + static void + process_pending_sigchld_events(void) + { +- struct exit_status e; ++ struct proc_exit_status e; + int pid; + + while ((pid = g_waitchild(&e)) > 0) + { +- if (e.reason == E_XR_SIGNAL) ++ if (e.reason == E_PXR_SIGNAL) + { + char sigstr[MAXSTRSIGLEN]; + LOG(LOG_LEVEL_ERROR, diff --git a/xrdp-sesman.pamd b/xrdp-sesman.pamd index b773813..a23efb0 100644 --- a/xrdp-sesman.pamd +++ b/xrdp-sesman.pamd @@ -4,6 +4,8 @@ auth include password-auth account include password-auth password include password-auth session include password-auth +session required pam_loginuid.so +session optional pam_lastlog.so silent # Gnome specific Fedora config #auth include gdm-password diff --git a/xrdp.spec b/xrdp.spec index 630eddb..b9e7d3f 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -47,6 +47,7 @@ Patch6: xrdp-0.9.18-vnc-uninit.patch %if 0%{?fedora} >= 32 || 0%{?rhel} >= 8 Patch7: xrdp-0.10.2-sesman-ini.patch %endif +Patch8: xrdp-0.10.2-utmpfix.patch BuildRequires: make BuildRequires: gcc @@ -142,6 +143,7 @@ CFLAGS="$RPM_OPT_FLAGS %{?_missing_braces} %{?_file_offset_bits}" \ %if 0%{?fedora} || 0%{?rhel} > 8 --enable-openh264 \ %endif + --enable-utmp \ --with-socketdir=%{_rundir}/%{name} \ --with-imlib2 From bb831b9e36d2ef204cb5f9fae981f917e33a94b7 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Thu, 6 Feb 2025 11:46:11 +1100 Subject: [PATCH 36/62] Add utmp support contributed upstream by Magnus Lewis-Smith --- xrdp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xrdp.spec b/xrdp.spec index b9e7d3f..5adcf4c 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -23,7 +23,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.2 -Release: 8%{?dist} +Release: 9%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ @@ -347,6 +347,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Thu Feb 6 2025 Bojan Smojver - 1:0.10.2~9 +- Add utmp support contributed upstream by Magnus Lewis-Smith + * Sun Jan 19 2025 Fedora Release Engineering - 1:0.10.2-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From 63cd7fae8e9f2e7ba69479a4f4fd2222df47f755 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 11 Feb 2025 18:03:12 +0100 Subject: [PATCH 37/62] Drop call to %sysusers_create_compat After https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers, rpm will handle account creation automatically. --- xrdp.spec | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/xrdp.spec b/xrdp.spec index 5adcf4c..5b16582 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -23,7 +23,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.2 -Release: 9%{?dist} +Release: 10%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ @@ -71,7 +71,6 @@ BuildRequires: checkpolicy, selinux-policy-devel BuildRequires: %{_hardlink} BuildRequires: systemd-rpm-macros -%{?sysusers_requires_compat} # tigervnc-server-minimal provides Xvnc (default for now) # xorgxrdp is another back end, depends on specific Xorg binary, omit @@ -199,8 +198,6 @@ done %{__install} -p -D -m 0644 %{SOURCE9} %{buildroot}%{_sysusersdir}/xrdp.conf -%pre -%sysusers_create_compat %{SOURCE9} %post %{?ldconfig} @@ -347,6 +344,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 1:0.10.2-10 +- Drop call to %sysusers_create_compat + * Thu Feb 6 2025 Bojan Smojver - 1:0.10.2~9 - Add utmp support contributed upstream by Magnus Lewis-Smith From 48c3c0c869662b8304fd7658b12829ecc0e0a61a Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Thu, 6 Mar 2025 15:20:41 +1100 Subject: [PATCH 38/62] Add fuse3 dependency --- xrdp.spec | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/xrdp.spec b/xrdp.spec index 5b16582..c888332 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -23,7 +23,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.2 -Release: 10%{?dist} +Release: 11%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ @@ -71,12 +71,16 @@ BuildRequires: checkpolicy, selinux-policy-devel BuildRequires: %{_hardlink} BuildRequires: systemd-rpm-macros +%if 0%{?fedora} < 42 || 0%{?rhel} +%{?sysusers_requires_compat} +%endif # tigervnc-server-minimal provides Xvnc (default for now) # xorgxrdp is another back end, depends on specific Xorg binary, omit Requires: tigervnc-server-minimal Requires: xorg-x11-xinit Requires: util-linux +Requires: fuse3 %if 0%{?fedora} || 0%{?rhel} >= 8 Recommends: %{name}-selinux = %{epoch}:%{version}-%{release} @@ -198,6 +202,10 @@ done %{__install} -p -D -m 0644 %{SOURCE9} %{buildroot}%{_sysusersdir}/xrdp.conf +%if 0%{?fedora} < 42 || 0%{?rhel} +%pre +%sysusers_create_compat %{SOURCE9} +%endif %post %{?ldconfig} @@ -344,6 +352,10 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Thu Mar 6 2025 Bojan Smojver - 1:0.10.2-11 +- Drop call to %sysusers_create_compat only in Fedora 42 and above +- Add fuse3 dependency BZ#2350108 + * Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 1:0.10.2-10 - Drop call to %sysusers_create_compat From be9a73e597f9e7ab14e13515f4aa508ab63db725 Mon Sep 17 00:00:00 2001 From: Fabio Valentini Date: Thu, 13 Mar 2025 18:49:20 +0100 Subject: [PATCH 39/62] Rebuild for noopenh264 2.6.0 --- xrdp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xrdp.spec b/xrdp.spec index c888332..0e07f52 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -23,7 +23,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.2 -Release: 11%{?dist} +Release: 12%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ @@ -352,6 +352,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Thu Mar 13 2025 Fabio Valentini - 1:0.10.2-12 +- Rebuild for noopenh264 2.6.0 + * Thu Mar 6 2025 Bojan Smojver - 1:0.10.2-11 - Drop call to %sysusers_create_compat only in Fedora 42 and above - Add fuse3 dependency BZ#2350108 From 253e64e7cadda9cfd78c5e025902ef7b8c7ac7ca Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Wed, 26 Mar 2025 06:29:12 +1100 Subject: [PATCH 40/62] Rebuild for noopenh264 2.6.0, once more --- xrdp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xrdp.spec b/xrdp.spec index 0e07f52..8feab94 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -23,7 +23,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.2 -Release: 12%{?dist} +Release: 13%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ @@ -352,6 +352,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Wed Mar 26 2025 Bojan Smojver - 1:0.10.2-13 +- Rebuild for noopenh264 2.6.0, once more + * Thu Mar 13 2025 Fabio Valentini - 1:0.10.2-12 - Rebuild for noopenh264 2.6.0 From 8631180d0be3cf03813970df70bf1316e5b5e6f0 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Tue, 1 Apr 2025 21:00:15 +1100 Subject: [PATCH 41/62] Update to 0.10.3 --- .gitignore | 1 + sources | 2 +- xrdp-0.10.2-utmpfix.patch | 816 -------------------------------------- xrdp.spec | 22 +- 4 files changed, 14 insertions(+), 827 deletions(-) delete mode 100644 xrdp-0.10.2-utmpfix.patch diff --git a/.gitignore b/.gitignore index 1d544d8..cbc99e2 100644 --- a/.gitignore +++ b/.gitignore @@ -35,3 +35,4 @@ xrdp-cvs-03-17-2010.tar.gz /xrdp-0.10.1.tar.gz /xrdp-0.10.2-rc.1.tar.gz /xrdp-0.10.2.tar.gz +/xrdp-0.10.3.tar.gz diff --git a/sources b/sources index 24b5170..e625699 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (xrdp-0.10.2.tar.gz) = fc5060af808d4647dba439259ab4be5f5820ac855eb5f3f82e1a5fe841693009df6760737d0da914206a9dd04ec4aca8e52c69e36143e4b24a3194ea4d4bbcf3 +SHA512 (xrdp-0.10.3.tar.gz) = 2d6152c115c52539d543697f3bdb68ecf859597e05e95fb9799cc266ebf8fd897f466a29d6f0a4fc695aefe52cf3cc89b7e08e057332579ffe851882705ac424 diff --git a/xrdp-0.10.2-utmpfix.patch b/xrdp-0.10.2-utmpfix.patch deleted file mode 100644 index fd3908d..0000000 --- a/xrdp-0.10.2-utmpfix.patch +++ /dev/null @@ -1,816 +0,0 @@ -commit 4c119d18e1d5d8c2b36fe4d7fe7b95511d72f7e7 -Author: mlewissmith -Date: Fri Jan 17 14:28:13 2025 +0000 - - Add utmp/wtmp support - - Cherry-pick 28f175b9..2ff3edd0 - - See: - * PR #2745 "Add utmp/wtmp support" - https://github.com/neutrinolabs/xrdp/pull/2745 - * Discussion #2744 "utmp/wtmp/btmp/lastlog" - https://github.com/neutrinolabs/xrdp/discussions/2744 - -diff --git a/common/os_calls.c b/common/os_calls.c -index 1060934a..580ed050 100644 ---- a/common/os_calls.c -+++ b/common/os_calls.c -@@ -3329,10 +3329,10 @@ g_set_allusercontext(int uid) - /*****************************************************************************/ - /* does not work in win32 - returns pid of process that exits or zero if signal occurred -- an exit_status struct can optionally be passed in to get the -+ a proc_exit_status struct can optionally be passed in to get the - exit status of the child */ - int --g_waitchild(struct exit_status *e) -+g_waitchild(struct proc_exit_status *e) - { - #if defined(_WIN32) - return 0; -@@ -3340,14 +3340,14 @@ g_waitchild(struct exit_status *e) - int wstat; - int rv; - -- struct exit_status dummy; -+ struct proc_exit_status dummy; - - if (e == NULL) - { - e = &dummy; // Set this, then throw it away - } - -- e->reason = E_XR_UNEXPECTED; -+ e->reason = E_PXR_UNEXPECTED; - e->val = 0; - - rv = waitpid(-1, &wstat, WNOHANG); -@@ -3362,12 +3362,12 @@ g_waitchild(struct exit_status *e) - } - else if (WIFEXITED(wstat)) - { -- e->reason = E_XR_STATUS_CODE; -+ e->reason = E_PXR_STATUS_CODE; - e->val = WEXITSTATUS(wstat); - } - else if (WIFSIGNALED(wstat)) - { -- e->reason = E_XR_SIGNAL; -+ e->reason = E_PXR_SIGNAL; - e->val = WTERMSIG(wstat); - } - -@@ -3408,10 +3408,14 @@ g_waitpid(int pid) - - Note that signal handlers are established with BSD-style semantics, - so this call is NOT interrupted by a signal */ --struct exit_status -+struct proc_exit_status - g_waitpid_status(int pid) - { -- struct exit_status exit_status = {.reason = E_XR_UNEXPECTED, .val = 0}; -+ struct proc_exit_status exit_status = -+ { -+ .reason = E_PXR_UNEXPECTED, -+ .val = 0 -+ }; - - #if !defined(_WIN32) - if (pid > 0) -@@ -3426,12 +3430,12 @@ g_waitpid_status(int pid) - { - if (WIFEXITED(status)) - { -- exit_status.reason = E_XR_STATUS_CODE; -+ exit_status.reason = E_PXR_STATUS_CODE; - exit_status.val = WEXITSTATUS(status); - } - if (WIFSIGNALED(status)) - { -- exit_status.reason = E_XR_SIGNAL; -+ exit_status.reason = E_PXR_SIGNAL; - exit_status.val = WTERMSIG(status); - } - } -diff --git a/common/os_calls.h b/common/os_calls.h -index cf4dc17d..be06b07b 100644 ---- a/common/os_calls.h -+++ b/common/os_calls.h -@@ -23,16 +23,16 @@ - - #include "arch.h" - --enum exit_reason -+enum proc_exit_reason - { -- E_XR_STATUS_CODE = 0, ///< 'val' contains exit status -- E_XR_SIGNAL, ///< 'val' contains a signal number -- E_XR_UNEXPECTED -+ E_PXR_STATUS_CODE = 0, ///< 'val' contains exit status -+ E_PXR_SIGNAL, ///< 'val' contains a signal number -+ E_PXR_UNEXPECTED - }; - --struct exit_status -+struct proc_exit_status - { -- enum exit_reason reason; -+ enum proc_exit_reason reason; - int val; - }; - -@@ -353,9 +353,9 @@ int g_setlogin(const char *name); - */ - int g_set_allusercontext(int uid); - #endif --int g_waitchild(struct exit_status *e); -+int g_waitchild(struct proc_exit_status *e); - int g_waitpid(int pid); --struct exit_status g_waitpid_status(int pid); -+struct proc_exit_status g_waitpid_status(int pid); - /* - * Sets the process group ID of the indicated process to the specified value. - * (POSIX.1) -diff --git a/configure.ac b/configure.ac -index 9b43c2ce..bf3cff9f 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -6,6 +6,7 @@ AC_DEFINE([VERSION_YEAR], 2025, [Copyright year]) - AC_CONFIG_HEADERS(config_ac.h:config_ac-h.in) - AM_INIT_AUTOMAKE([1.7.2 foreign]) - AC_CONFIG_MACRO_DIR([m4]) -+AC_USE_SYSTEM_EXTENSIONS - AC_PROG_CC - AC_PROG_CXX - AC_C_CONST -@@ -190,6 +191,11 @@ AC_ARG_ENABLE(rdpsndaudin, AS_HELP_STRING([--enable-rdpsndaudin], - [], [enable_rdpsndaudin=no]) - AM_CONDITIONAL(XRDP_RDPSNDAUDIN, [test x$enable_rdpsndaudin = xyes]) - -+AC_ARG_ENABLE(utmp, AS_HELP_STRING([--enable-utmp], -+ [Update utmp (default: no)]), -+ [], [enable_utmp=no]) -+AM_CONDITIONAL(XRDP_UTMP, [test x$enable_utmp = xyes]) -+ - AC_ARG_WITH(imlib2, AS_HELP_STRING([--with-imlib2=ARG], [imlib2 library to use for non-BMP backgrounds (ARG=yes/no/)]),,) - - AC_ARG_WITH(freetype2, AS_HELP_STRING([--with-freetype2=ARG], [freetype2 library to use for rendering fonts (ARG=yes/no/)]),,) -@@ -526,6 +532,15 @@ AC_CHECK_HEADER([X11/extensions/Xrandr.h], [], - [AC_MSG_ERROR([please install libxrandr-dev or libXrandr-devel])], - [#include ]) - -+if test "x$enable_utmp" = "xyes" -+then -+ AC_CHECK_HEADERS(utmp.h utmpx.h) -+ -+ # Test for non-standard extensions in struct utmpx -+ AXRDP_CHECK_UTMPX_MEMBER_EXISTS([ut_host], [HAVE_UTMPX_UT_HOST]) -+ AXRDP_CHECK_UTMPX_MEMBER_EXISTS([ut_exit], [HAVE_UTMPX_UT_EXIT]) -+fi -+ - CFLAGS="$save_CFLAGS" - - # perform unit tests if libcheck and libmocka found -@@ -652,6 +667,12 @@ echo " ipv6only $enable_ipv6only" - echo " vsock $enable_vsock" - echo " auth mechanism $auth_mech" - echo " rdpsndaudin $enable_rdpsndaudin" -+echo " utmp support $enable_utmp" -+if test x$enable_utmp = xyes; then -+ echo " utmpx.ut_host $ac_cv_utmpx_has_ut_host" -+ echo " utmpx.ut_exit $ac_cv_utmpx_has_ut_exit" -+fi -+ - echo - echo " with imlib2 $use_imlib2" - echo " with freetype2 $use_freetype2" -diff --git a/instfiles/pam.d/xrdp-sesman.arch b/instfiles/pam.d/xrdp-sesman.arch -index 2763612e..7b4a3616 100644 ---- a/instfiles/pam.d/xrdp-sesman.arch -+++ b/instfiles/pam.d/xrdp-sesman.arch -@@ -1,4 +1,3 @@ --#%PAM-1.0 - auth include system-remote-login - -auth optional pam_gnome_keyring.so - -auth optional pam_kwallet5.so -@@ -8,5 +7,8 @@ account include system-remote-login - password include system-remote-login - - session include system-remote-login -+# For wtmp/lastlog support uncomment one of the following lines:- -+#session optional pam_lastlog.so quiet -+#session optional pam_lastlog2.so silent - -session optional pam_gnome_keyring.so auto_start - -session optional pam_kwallet5.so auto_start -diff --git a/instfiles/pam.d/xrdp-sesman.debian b/instfiles/pam.d/xrdp-sesman.debian -index cc692726..b97711bb 100644 ---- a/instfiles/pam.d/xrdp-sesman.debian -+++ b/instfiles/pam.d/xrdp-sesman.debian -@@ -11,6 +11,10 @@ auth required pam_env.so readenv=1 envfile=/etc/default/locale - - # Ensure resource limits are applied - session required pam_limits.so -+# Set the loginuid process attribute. -+session required pam_loginuid.so -+# Update wtmp/lastlog -+session optional pam_lastlog.so quiet - @include common-session - -session optional pam_gnome_keyring.so auto_start - -session optional pam_kwallet5.so auto_start -diff --git a/instfiles/pam.d/xrdp-sesman.redhat b/instfiles/pam.d/xrdp-sesman.redhat -index 9da2690b..02c0ed97 100644 ---- a/instfiles/pam.d/xrdp-sesman.redhat -+++ b/instfiles/pam.d/xrdp-sesman.redhat -@@ -1,5 +1,11 @@ - #%PAM-1.0 - auth include password-auth - account include password-auth -+ -+# Set the loginuid process attribute. -+session required pam_loginuid.so -+# Update wtmp/lastlog -+session optional pam_lastlog.so quiet -+ - session include password-auth - password include password-auth -diff --git a/instfiles/pam.d/xrdp-sesman.suse b/instfiles/pam.d/xrdp-sesman.suse -index a7c7836c..87d40780 100644 ---- a/instfiles/pam.d/xrdp-sesman.suse -+++ b/instfiles/pam.d/xrdp-sesman.suse -@@ -1,5 +1,11 @@ - #%PAM-1.0 - auth include common-auth - account include common-account -+ -+# Set the loginuid process attribute. -+session required pam_loginuid.so -+# Update lastlog database -+session optional pam_lastlog2.so silent -+ - session include common-session - password include common-password -diff --git a/instfiles/pam.d/xrdp-sesman.system b/instfiles/pam.d/xrdp-sesman.system -index 5025a0f9..172360c6 100644 ---- a/instfiles/pam.d/xrdp-sesman.system -+++ b/instfiles/pam.d/xrdp-sesman.system -@@ -2,4 +2,8 @@ - auth include system-auth - account include system-auth - password include system-auth -+ -+# For wtmp/lastlog support uncomment one of the following lines:- -+#session optional pam_lastlog.so quiet -+#session optional pam_lastlog2.so silent - session include system-auth -diff --git a/m4/axrdp.m4 b/m4/axrdp.m4 -new file mode 100644 -index 00000000..4ba87e5d ---- /dev/null -+++ b/m4/axrdp.m4 -@@ -0,0 +1,43 @@ -+# SYNOPSIS -+# -+# AXRDP_CHECK_UTMPX_MEMBER_EXISTS(MEMBER, COMPILE-DEFINE) -+# -+# EXAMPLE -+# -+# AXRDP_CHECK_UTMPX_MEMBER_EXISTS([ut_exit], [HAVE_UTMPX_UT_EXIT]) -+# -+# DESCRIPTION -+# -+# If the member MEMBER exists in the utmpx struct, the COMPILE-DEFINE -+# is set for the C compiler. -+# -+# The shell variable 'ac_cv_utmpx_has_$MEMBER' is set to 'yes' or 'no' -+# and cached -+# -+AC_DEFUN([AXRDP_CHECK_UTMPX_MEMBER_EXISTS], -+[ -+ AS_VAR_PUSHDEF([x_var], [ac_cv_utmpx_has_$1]) -+ AS_VAR_PUSHDEF([x_define], [$2]) -+ AC_CACHE_CHECK( -+ [for $1 in struct utmpx], -+ [x_var], -+ [AC_COMPILE_IFELSE( -+ [AC_LANG_SOURCE([[ -+# include -+# include -+ int main() -+ { -+ return offsetof(struct utmpx,$1); -+ }]])], -+ [AS_VAR_SET([x_var], [yes])], -+ [AS_VAR_SET([x_var], [no])])] -+ ) -+ AS_VAR_IF( -+ [x_var], -+ [yes], -+ [AC_DEFINE([x_define], [1], [Define if '$1' is in struct utmpx.])]) -+ AS_VAR_POPDEF([x_var]) -+ AS_VAR_POPDEF([x_define]) -+]) -+ -+ -diff --git a/sesman/sesexec/Makefile.am b/sesman/sesexec/Makefile.am -index a41d335b..1eae19cb 100644 ---- a/sesman/sesexec/Makefile.am -+++ b/sesman/sesexec/Makefile.am -@@ -9,6 +9,10 @@ AM_CPPFLAGS = \ - - SESEXEC_EXTRA_LIBS = - -+if XRDP_UTMP -+ AM_CPPFLAGS += -DUSE_UTMP -+endif -+ - pkglibexec_PROGRAMS = \ - xrdp-sesexec - -@@ -25,6 +29,8 @@ xrdp_sesexec_SOURCES = \ - env.h \ - login_info.c \ - login_info.h \ -+ sessionrecord.c \ -+ sessionrecord.h \ - xauth.c \ - xauth.h \ - xwait.c \ -diff --git a/sesman/sesexec/sesexec.c b/sesman/sesexec/sesexec.c -index 3e9763dd..67b493e8 100644 ---- a/sesman/sesexec/sesexec.c -+++ b/sesman/sesexec/sesexec.c -@@ -241,7 +241,7 @@ sesexec_terminate_main_loop(int status) - static void - process_sigchld_event(void) - { -- struct exit_status e; -+ struct proc_exit_status e; - int pid; - - // Check for any finished children -diff --git a/sesman/sesexec/session.c b/sesman/sesexec/session.c -index a4950973..f9c40820 100644 ---- a/sesman/sesexec/session.c -+++ b/sesman/sesexec/session.c -@@ -47,6 +47,7 @@ - #include "login_info.h" - #include "os_calls.h" - #include "sesexec.h" -+#include "sessionrecord.h" - #include "string_calls.h" - #include "xauth.h" - #include "xwait.h" -@@ -656,6 +657,7 @@ session_start_wrapped(struct login_info *login_info, - } - else - { -+ utmp_login(window_manager_pid, s->display, login_info); - LOG(LOG_LEVEL_INFO, - "Starting the xrdp channel server for display :%d", - s->display); -@@ -807,11 +809,11 @@ cleanup_sockets(int uid, int display) - - /******************************************************************************/ - static void --exit_status_to_str(const struct exit_status *e, char buff[], int bufflen) -+exit_status_to_str(const struct proc_exit_status *e, char buff[], int bufflen) - { - switch (e->reason) - { -- case E_XR_STATUS_CODE: -+ case E_PXR_STATUS_CODE: - if (e->val == 0) - { - g_snprintf(buff, bufflen, "exit code zero"); -@@ -822,7 +824,7 @@ exit_status_to_str(const struct exit_status *e, char buff[], int bufflen) - } - break; - -- case E_XR_SIGNAL: -+ case E_PXR_SIGNAL: - { - char sigstr[MAXSTRSIGLEN]; - g_snprintf(buff, bufflen, "signal %s", -@@ -840,7 +842,7 @@ exit_status_to_str(const struct exit_status *e, char buff[], int bufflen) - void - session_process_child_exit(struct session_data *sd, - int pid, -- const struct exit_status *e) -+ const struct proc_exit_status *e) - { - if (pid == sd->x_server) - { -@@ -860,7 +862,7 @@ session_process_child_exit(struct session_data *sd, - { - int wm_wait_time = g_time1() - sd->start_time; - -- if (e->reason == E_XR_STATUS_CODE && e->val == 0) -+ if (e->reason == E_PXR_STATUS_CODE && e->val == 0) - { - LOG(LOG_LEVEL_INFO, - "Window manager (pid %d, display %d) " -@@ -886,6 +888,7 @@ session_process_child_exit(struct session_data *sd, - sd->win_mgr, sd->params.display, wm_wait_time); - } - -+ utmp_logout(sd->win_mgr, sd->params.display, e); - sd->win_mgr = -1; - - if (sd->x_server > 0) -diff --git a/sesman/sesexec/session.h b/sesman/sesexec/session.h -index dee9fe36..5cfab140 100644 ---- a/sesman/sesexec/session.h -+++ b/sesman/sesexec/session.h -@@ -35,7 +35,7 @@ - #include "xrdp_constants.h" - - struct login_info; --struct exit_status; -+struct proc_exit_status; - - /** - * Information used to start a session -@@ -89,7 +89,7 @@ session_start(struct login_info *login_info, - void - session_process_child_exit(struct session_data *sd, - int pid, -- const struct exit_status *e); -+ const struct proc_exit_status *e); - - /** - * Returns a count of active processes in the session -diff --git a/sesman/sesexec/sessionrecord.c b/sesman/sesexec/sessionrecord.c -new file mode 100644 -index 00000000..d9dce5a4 ---- /dev/null -+++ b/sesman/sesexec/sessionrecord.c -@@ -0,0 +1,200 @@ -+/** -+ * xrdp: A Remote Desktop Protocol server. -+ * -+ * Copyright (C) Emmanuel Blindauer 2017 -+ * -+ * Licensed under the Apache License, Version 2.0 (the "License"); -+ * you may not use this file except in compliance with the License. -+ * You may obtain a copy of the License at -+ * -+ * http://www.apache.org/licenses/LICENSE-2.0 -+ * -+ * Unless required by applicable law or agreed to in writing, software -+ * distributed under the License is distributed on an "AS IS" BASIS, -+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -+ * See the License for the specific language governing permissions and -+ * limitations under the License. -+ * -+ * str2memcpy() is taken from util-linux/include/strutils.h v2.39 which -+ * has the following header:- -+ * -+ * No copyright is claimed. This code is in the public domain; do with -+ * it what you wish. -+ */ -+ -+/** -+ * -+ * @file sessionrecord.c -+ * @brief utmp handling code -+ * -+ * wtmp/lastlog/btmp is handled by PAM or (on FreeBSD) UTX -+ * -+ * Idea: Only implement actual utmp, i.e. utmpx for 99%. -+ * See http://80386.nl/unix/utmpx/ -+ */ -+ -+#if defined(HAVE_CONFIG_H) -+#include -+#endif -+ -+#include "sessionrecord.h" -+#include "login_info.h" -+#include "log.h" -+ -+// Operational mode of add_xtmp_entry() -+// -+// We can't use USER_PROCESS/DEAD_PROCESS directly, as they -+// won't be available for platforms without USE_UTMP -+enum add_xtmp_mode -+{ -+ MODE_LOGIN, -+ MODE_LOGOUT -+}; -+ -+#ifdef USE_UTMP -+ -+#include -+#include -+#include -+ -+#ifdef HAVE_UTMPX_H -+#include -+typedef struct utmpx _utmp; -+#else -+#include -+typedef struct utmp _utmp; -+#endif -+ -+#include "os_calls.h" -+#include "string_calls.h" -+ -+#define XRDP_LINE_FORMAT "xrdp:%d" -+// ut_id is a very small field on some platforms, so use the display -+// number in hex -+#define XRDP_ID_FORMAT ":%x" -+ -+/******************************************************************************/ -+/** -+ * utmp-specific strncpy() replacement -+ * -+ * @param dest Destination pointer -+ * @param src Source pointer -+ * @param n bytes to copy -+ * -+ * This is like strncpy(), but based on memcpy(), so compilers and static -+ * analyzers do not complain when sizeof(destination) is the same as 'n' and -+ * result is not terminated by zero. -+ * -+ * ONLY use this function to copy string to logs with fixed sizes -+ * (wtmp/utmp. ...) where string terminator is optional. -+ */ -+static inline void *__attribute__((nonnull (1))) -+str2memcpy(void *dest, const char *src, size_t n) -+{ -+ size_t bytes = strlen(src) + 1; -+ -+ if (bytes > n) -+ { -+ bytes = n; -+ } -+ -+ memcpy(dest, src, bytes); -+ return dest; -+} -+ -+/******************************************************************************/ -+/** -+ * Prepare the utmp struct and write it. -+ * -+ * @param pid PID of session manager -+ * @param display Display number of session -+ * @param login_info Login info (NULL for MODE_LOGOUT) -+ * @param mode see enum add_xtmp_mode -+ * @param e Exit status (NULL unless MODE_LOGOUT) -+ */ -+ -+static void -+add_xtmp_entry(int pid, int display, const struct login_info *login_info, -+ enum add_xtmp_mode mode, const struct proc_exit_status *e) -+{ -+ char idbuff[16]; -+ char str_display[16]; -+ -+ _utmp ut; -+ struct timeval tv; -+ -+ g_memset(&ut, 0, sizeof(ut)); -+ g_snprintf(str_display, sizeof(str_display), XRDP_LINE_FORMAT, display); -+ g_snprintf(idbuff, sizeof(idbuff), XRDP_ID_FORMAT, display); -+ gettimeofday(&tv, NULL); -+ -+ ut.ut_type = (mode == MODE_LOGIN) ? USER_PROCESS : DEAD_PROCESS; -+ ut.ut_pid = pid; -+ str2memcpy(ut.ut_id, idbuff, sizeof(ut.ut_id)); -+ -+ // Linux utmp(5) suggests ut_line, ut_time, ut_user, and ut_host -+ // are not set for a DEAD_PROCESS -+ if (ut.ut_type != DEAD_PROCESS) -+ { -+ ut.ut_tv.tv_sec = tv.tv_sec; -+ ut.ut_tv.tv_usec = tv.tv_usec; -+ str2memcpy(ut.ut_line, str_display, sizeof(ut.ut_line)); -+ if (login_info != NULL) -+ { -+ str2memcpy(ut.ut_user, login_info->username, sizeof(ut.ut_user)); -+#ifdef HAVE_UTMPX_UT_HOST -+ str2memcpy(ut.ut_host, login_info->ip_addr, sizeof(ut.ut_host)); -+#endif -+ } -+ } -+ -+#ifdef HAVE_UTMPX_UT_EXIT -+ if (e != NULL && e->reason == E_PXR_STATUS_CODE) -+ { -+ ut.ut_exit.e_exit = e->val; -+ } -+ else if (e != NULL && e->reason == E_PXR_SIGNAL) -+ { -+ ut.ut_exit.e_termination = e->val; -+ } -+#endif -+ -+ /* update the utmp file */ -+ /* open utmp */ -+ setutxent(); -+ /* add the computed entry */ -+ pututxline(&ut); -+ /* closes utmp */ -+ endutxent(); -+ -+} -+#else // USE_UTMP -+static void -+add_xtmp_entry(int pid, int display, const struct login_info *login_info, -+ short state, const struct proc_exit_status *e) -+{ -+} -+#endif -+ -+ -+/******************************************************************************/ -+void -+utmp_login(int pid, int display, const struct login_info *login_info) -+{ -+ log_message(LOG_LEVEL_DEBUG, -+ "adding login info for utmp: %d - %d - %s - %s", -+ pid, display, login_info->username, login_info->ip_addr); -+ -+ add_xtmp_entry(pid, display, login_info, MODE_LOGIN, NULL); -+} -+ -+/******************************************************************************/ -+void -+utmp_logout(int pid, int display, const struct proc_exit_status *exit_status) -+{ -+ -+ log_message(LOG_LEVEL_DEBUG, "adding logout info for utmp: %d - %d", -+ pid, display); -+ -+ add_xtmp_entry(pid, display, NULL, MODE_LOGOUT, exit_status); -+} -diff --git a/sesman/sesexec/sessionrecord.h b/sesman/sesexec/sessionrecord.h -new file mode 100644 -index 00000000..d5478771 ---- /dev/null -+++ b/sesman/sesexec/sessionrecord.h -@@ -0,0 +1,52 @@ -+/** -+ * xrdp: A Remote Desktop Protocol server. -+ * -+ * Copyright (C) Emmanuel Blindauer 2017 -+ * -+ * Licensed under the Apache License, Version 2.0 (the "License"); -+ * you may not use this file except in compliance with the License. -+ * You may obtain a copy of the License at -+ * -+ * http://www.apache.org/licenses/LICENSE-2.0 -+ * -+ * Unless required by applicable law or agreed to in writing, software -+ * distributed under the License is distributed on an "AS IS" BASIS, -+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -+ * See the License for the specific language governing permissions and -+ * limitations under the License. -+ */ -+ -+/** -+ * -+ * @file sessionrecord.h -+ * @brief utmp handling code -+ * -+ */ -+ -+#ifndef SESSIONRECORD_H -+#define SESSIONRECORD_H -+ -+struct login_info; -+struct proc_exit_status; -+ -+/** -+ * @brief Record login in utmp -+ * -+ * @param pid PID of window manager -+ * @param display Display number -+ * @param login_info Information about logged in user -+ */ -+void -+utmp_login(int pid, int display, const struct login_info *login_info); -+ -+/** -+ * @brief Record logout in utmp -+ * -+ * @param pid PID of window manager -+ * @param display Display number -+ * @param exit_status Exit status of process -+ */ -+void -+utmp_logout(int pid, int display, const struct proc_exit_status *exit_status); -+ -+#endif -diff --git a/sesman/sesexec/xwait.c b/sesman/sesexec/xwait.c -index 9a7bd376..7531d451 100644 ---- a/sesman/sesexec/xwait.c -+++ b/sesman/sesexec/xwait.c -@@ -142,7 +142,7 @@ wait_for_xserver(uid_t uid, - } - else - { -- struct exit_status e; -+ struct proc_exit_status e; - - fd[0] = -1; // File descriptor closed by fclose() - log_waitforx_messages(dp); -@@ -150,11 +150,11 @@ wait_for_xserver(uid_t uid, - e = g_waitpid_status(pid); - switch (e.reason) - { -- case E_XR_STATUS_CODE: -+ case E_PXR_STATUS_CODE: - rv = (enum xwait_status)e.val; - break; - -- case E_XR_SIGNAL: -+ case E_PXR_SIGNAL: - { - char sigstr[MAXSTRSIGLEN]; - LOG(LOG_LEVEL_ERROR, -diff --git a/tests/common/test_os_calls_signals.c b/tests/common/test_os_calls_signals.c -index 8028f895..4470e27a 100644 ---- a/tests/common/test_os_calls_signals.c -+++ b/tests/common/test_os_calls_signals.c -@@ -79,7 +79,7 @@ END_TEST - /******************************************************************************/ - START_TEST(test_g_signal_child_stop_1) - { -- struct exit_status e; -+ struct proc_exit_status e; - - g_reset_wait_obj(g_wobj1); - ck_assert_int_eq(g_is_wait_obj_set(g_wobj1), 0); -@@ -98,7 +98,7 @@ START_TEST(test_g_signal_child_stop_1) - - e = g_waitpid_status(pid); - -- ck_assert_int_eq(e.reason, E_XR_STATUS_CODE); -+ ck_assert_int_eq(e.reason, E_PXR_STATUS_CODE); - ck_assert_int_eq(e.val, 45); - - // Try another one to make sure the signal handler is still in place. -@@ -119,7 +119,7 @@ START_TEST(test_g_signal_child_stop_1) - - e = g_waitpid_status(pid); - -- ck_assert_int_eq(e.reason, E_XR_SIGNAL); -+ ck_assert_int_eq(e.reason, E_PXR_SIGNAL); - ck_assert_int_eq(e.val, SIGSEGV); - - // Clean up -@@ -136,7 +136,7 @@ START_TEST(test_g_signal_child_stop_2) - int pids[CHILD_COUNT]; - unsigned int i; - -- struct exit_status e; -+ struct proc_exit_status e; - - g_reset_wait_obj(g_wobj1); - ck_assert_int_eq(g_is_wait_obj_set(g_wobj1), 0); -@@ -160,7 +160,7 @@ START_TEST(test_g_signal_child_stop_2) - for (i = 0 ; i < CHILD_COUNT; ++i) - { - e = g_waitpid_status(pids[i]); -- ck_assert_int_eq(e.reason, E_XR_STATUS_CODE); -+ ck_assert_int_eq(e.reason, E_PXR_STATUS_CODE); - ck_assert_int_eq(e.val, (i + 1)); - } - -@@ -249,12 +249,12 @@ START_TEST(test_waitpid_not_interrupted_by_sig) - g_reset_wait_obj(g_wobj1); - g_set_alarm(set_wobj1, 1); - -- struct exit_status e = g_waitpid_status(child_pid); -+ struct proc_exit_status e = g_waitpid_status(child_pid); - // We should have had the alarm... - ck_assert_int_ne(g_is_wait_obj_set(g_wobj1), 0); - - // ..and got the status of the child -- ck_assert_int_eq(e.reason, E_XR_STATUS_CODE); -+ ck_assert_int_eq(e.reason, E_PXR_STATUS_CODE); - ck_assert_int_eq(e.val, 42); - - // Clean up -diff --git a/xrdp/xrdp_listen.c b/xrdp/xrdp_listen.c -index e06b8ec3..f7740ce5 100644 ---- a/xrdp/xrdp_listen.c -+++ b/xrdp/xrdp_listen.c -@@ -768,12 +768,12 @@ xrdp_listen_conn_in(struct trans *self, struct trans *new_self) - static void - process_pending_sigchld_events(void) - { -- struct exit_status e; -+ struct proc_exit_status e; - int pid; - - while ((pid = g_waitchild(&e)) > 0) - { -- if (e.reason == E_XR_SIGNAL) -+ if (e.reason == E_PXR_SIGNAL) - { - char sigstr[MAXSTRSIGLEN]; - LOG(LOG_LEVEL_ERROR, diff --git a/xrdp.spec b/xrdp.spec index 8feab94..1dda321 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -22,8 +22,8 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 -Version: 0.10.2 -Release: 13%{?dist} +Version: 0.10.3 +Release: 1%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ @@ -47,7 +47,6 @@ Patch6: xrdp-0.9.18-vnc-uninit.patch %if 0%{?fedora} >= 32 || 0%{?rhel} >= 8 Patch7: xrdp-0.10.2-sesman-ini.patch %endif -Patch8: xrdp-0.10.2-utmpfix.patch BuildRequires: make BuildRequires: gcc @@ -352,6 +351,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Tue Apr 1 2025 Bojan Smojver - 1:0.10.3-1 +- Update to 0.10.3 + * Wed Mar 26 2025 Bojan Smojver - 1:0.10.2-13 - Rebuild for noopenh264 2.6.0, once more @@ -365,33 +367,33 @@ fi * Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 1:0.10.2-10 - Drop call to %sysusers_create_compat -* Thu Feb 6 2025 Bojan Smojver - 1:0.10.2~9 +* Thu Feb 6 2025 Bojan Smojver - 1:0.10.2-9 - Add utmp support contributed upstream by Magnus Lewis-Smith * Sun Jan 19 2025 Fedora Release Engineering - 1:0.10.2-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild -* Sun Jan 5 2025 Bojan Smojver - 1:0.10.2~7 +* Sun Jan 5 2025 Bojan Smojver - 1:0.10.2-7 - Comment out generic RDP proxy in xrdp.ini -* Sun Jan 5 2025 Bojan Smojver - 1:0.10.2~6 +* Sun Jan 5 2025 Bojan Smojver - 1:0.10.2-6 - Set permissions of cert, key and rsakeys.ini to 0640 - Revert optional dependency on noopenh264, library dependency exists -* Fri Dec 27 2024 Bojan Smojver - 1:0.10.2~5 +* Fri Dec 27 2024 Bojan Smojver - 1:0.10.2-5 - Move README.Fedora to README.md - Adjust ownership/permissions of certs/keys for unprivileged user -* Thu Dec 26 2024 Bojan Smojver - 1:0.10.2~4 +* Thu Dec 26 2024 Bojan Smojver - 1:0.10.2-4 - If openh264 is not present, require noopenh264 instead -* Wed Dec 25 2024 Bojan Smojver - 1:0.10.2~3 +* Wed Dec 25 2024 Bojan Smojver - 1:0.10.2-3 - Run as unprivileged user * Wed Dec 25 2024 Koichiro Iwao - 1:0.10.2-2 - Enable OpenH264 -* Wed Dec 25 2024 Bojan Smojver - 1:0.10.2~1 +* Wed Dec 25 2024 Bojan Smojver - 1:0.10.2-1 - Update to 0.10.2 * Tue Dec 24 2024 Bojan Smojver - 1:0.10.2~0.rc1.1 From 58d96b27c696e26aaf51a5752f61208c97dce604 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Tue, 1 Apr 2025 21:15:51 +1100 Subject: [PATCH 42/62] Enable Xvnc over Unix domain socket --- ...dp-ini.patch => xrdp-0.10.3-xrdp-ini.patch | 27 +++++++++++++++---- xrdp.spec | 3 ++- 2 files changed, 24 insertions(+), 6 deletions(-) rename xrdp-0.10.2-xrdp-ini.patch => xrdp-0.10.3-xrdp-ini.patch (74%) diff --git a/xrdp-0.10.2-xrdp-ini.patch b/xrdp-0.10.3-xrdp-ini.patch similarity index 74% rename from xrdp-0.10.2-xrdp-ini.patch rename to xrdp-0.10.3-xrdp-ini.patch index a3ba022..f32cd19 100644 --- a/xrdp-0.10.2-xrdp-ini.patch +++ b/xrdp-0.10.3-xrdp-ini.patch @@ -1,5 +1,5 @@ ---- xrdp-0.10.2/xrdp/xrdp.ini.in.org 2024-12-25 00:09:57.000000000 +1100 -+++ xrdp-0.10.2/xrdp/xrdp.ini.in 2025-01-05 21:20:01.983691029 +1100 +--- xrdp-0.10.3/xrdp/xrdp.ini.in.org 2025-04-01 21:11:30.997621951 +1100 ++++ xrdp-0.10.3/xrdp/xrdp.ini.in 2025-04-01 21:13:18.881162132 +1100 @@ -30,8 +30,8 @@ use_vsock=false ; Unprivileged User name and group to run the xrdp daemon. ; It is HIGHLY RECOMMENDED you set these values. See the xrdp.ini(5) @@ -11,7 +11,7 @@ ; regulate if the listening socket use socket option tcp_nodelay ; no buffering will be performed in the TCP stack -@@ -241,17 +241,17 @@ xrdpvr=true +@@ -241,24 +241,24 @@ xrdpvr=true ; Some session types such as Xorg and Xvnc start a display server. ; Startup command-line parameters for the display server are configured ; in sesman.ini. See and configure also sesman.ini. @@ -39,7 +39,24 @@ [Xvnc] name=Xvnc -@@ -269,13 +269,13 @@ port=-1 + lib=libvnc.@lib_extension@ + username=ask + password=ask +-ip=127.0.0.1 ++#ip=127.0.0.1 + ; port is -1 (sesman controlled), numeric (TCP connection) or an + ; absolute path (UDS connection). + port=-1 +@@ -277,7 +277,7 @@ port=-1 + ; VNC password files is no longer considered secure by FIPS + ; + ; The default value is 0 on non-FIPS systems, and 1 on FIPS-based systems. +-#code=0 ++code=1 + #xserverbpp=24 + #delay_ms=2000 + ; Disable requested encodings to support buggy VNC servers +@@ -287,13 +287,13 @@ port=-1 ; Generic VNC Proxy ; Tailor this to specific hosts and VNC instances by specifying an ip ; and port and setting a suitable name. @@ -60,7 +77,7 @@ #pamusername=asksame #pampassword=asksame #delay_ms=2000 -@@ -292,15 +292,15 @@ password=ask +@@ -310,15 +310,15 @@ password=ask ; Generic RDP proxy using NeutrinoRDP ; Tailor this to specific hosts by specifying an ip and port and setting ; a suitable name. diff --git a/xrdp.spec b/xrdp.spec index 1dda321..85b2c3e 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -38,7 +38,7 @@ Source7: xrdp-polkit-1.rules Source8: %{name}-tmpfiles.conf Source9: %{name}.sysusers Patch0: xrdp-0.10.2-sesman.patch -Patch1: xrdp-0.10.2-xrdp-ini.patch +Patch1: xrdp-0.10.3-xrdp-ini.patch Patch2: xrdp-0.10.1-service.patch Patch3: xrdp-0.10.0-scripts-libexec.patch Patch4: xrdp-0.9.6-script-interpreter.patch @@ -353,6 +353,7 @@ fi %changelog * Tue Apr 1 2025 Bojan Smojver - 1:0.10.3-1 - Update to 0.10.3 +- Enable Xvnc over Unix domain socket * Wed Mar 26 2025 Bojan Smojver - 1:0.10.2-13 - Rebuild for noopenh264 2.6.0, once more From fc1c271a1fba61b5b4b24841baaeb05cea3a7c65 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Fri, 4 Jul 2025 07:16:35 +1000 Subject: [PATCH 43/62] Update to 0.10.4 --- .gitignore | 1 + sources | 2 +- xrdp.spec | 5 ++++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index cbc99e2..ae9cd3a 100644 --- a/.gitignore +++ b/.gitignore @@ -36,3 +36,4 @@ xrdp-cvs-03-17-2010.tar.gz /xrdp-0.10.2-rc.1.tar.gz /xrdp-0.10.2.tar.gz /xrdp-0.10.3.tar.gz +/xrdp-0.10.4.tar.gz diff --git a/sources b/sources index e625699..15c021b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (xrdp-0.10.3.tar.gz) = 2d6152c115c52539d543697f3bdb68ecf859597e05e95fb9799cc266ebf8fd897f466a29d6f0a4fc695aefe52cf3cc89b7e08e057332579ffe851882705ac424 +SHA512 (xrdp-0.10.4.tar.gz) = 9f4ba18cd1bf0f610535d6f2ae451e0fba3de4efc23e3049073b087d3f9221026d2817359bfa1d585aeb54fed4d1ac2f5ba7913f271c7c0b30f6d64d6267a1d8 diff --git a/xrdp.spec b/xrdp.spec index 85b2c3e..9d9d3de 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -22,7 +22,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 -Version: 0.10.3 +Version: 0.10.4 Release: 1%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT @@ -351,6 +351,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Thu Jul 3 2025 Bojan Smojver - 1:0.10.4-1 +- Update to 0.10.4 + * Tue Apr 1 2025 Bojan Smojver - 1:0.10.3-1 - Update to 0.10.3 - Enable Xvnc over Unix domain socket From a468304b666cac63db840def11cbf9b7b1f23495 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Mon, 7 Jul 2025 20:33:56 +1000 Subject: [PATCH 44/62] Patch upstream issue #3558, fix by matt335672 --- xrdp.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/xrdp.spec b/xrdp.spec index 9d9d3de..2d4ebdf 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -23,7 +23,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.4 -Release: 1%{?dist} +Release: 2%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ @@ -44,8 +44,9 @@ Patch3: xrdp-0.10.0-scripts-libexec.patch Patch4: xrdp-0.9.6-script-interpreter.patch Patch5: xrdp-0.9.16-arch.patch Patch6: xrdp-0.9.18-vnc-uninit.patch +Patch7: xrdp-0.10.4-vmconnect.patch %if 0%{?fedora} >= 32 || 0%{?rhel} >= 8 -Patch7: xrdp-0.10.2-sesman-ini.patch +Patch8: xrdp-0.10.2-sesman-ini.patch %endif BuildRequires: make @@ -351,6 +352,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Mon Jul 7 2025 Bojan Smojver - 1:0.10.4-2 +- Patch upstream issue #3558, fix by matt335672 + * Thu Jul 3 2025 Bojan Smojver - 1:0.10.4-1 - Update to 0.10.4 From bfa74ff263571d0cbca4b293906a50b2c1880620 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Mon, 7 Jul 2025 20:41:58 +1000 Subject: [PATCH 45/62] Add vmconnect patch --- xrdp-0.10.4-vmconnect.patch | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 xrdp-0.10.4-vmconnect.patch diff --git a/xrdp-0.10.4-vmconnect.patch b/xrdp-0.10.4-vmconnect.patch new file mode 100644 index 0000000..5f9ea2e --- /dev/null +++ b/xrdp-0.10.4-vmconnect.patch @@ -0,0 +1,19 @@ +--- a/common/xrdp_client_info.h ++++ b/common/xrdp_client_info.h +@@ -172,7 +172,6 @@ struct xrdp_client_info + int require_credentials; /* when true, credentials *must* be passed on cmd line */ + + int security_layer; /* SECURITY_LAYER_* */ +- int vmconnect; /* Used when used from inside Hyper-V */ + + int multimon; /* 0 = deny , 1 = allow */ + struct display_size_description display_sizes; +@@ -254,7 +253,7 @@ struct xrdp_client_info + // Can we resize the desktop by using a Deactivation-Reactivation Sequence? + enum client_resize_mode client_resize_mode; + +- int pad1; /* unused; unicode_input_state */ ++ int vmconnect; /* Used when used from inside Hyper-V */ + }; + + enum xrdp_encoder_flags From 8473a1b002a16b25c5d9999e5c5927f97b9e7e30 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 21:03:48 +0000 Subject: [PATCH 46/62] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- xrdp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xrdp.spec b/xrdp.spec index 2d4ebdf..31f5f37 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -23,7 +23,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.4 -Release: 2%{?dist} +Release: 3%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ @@ -352,6 +352,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Fri Jul 25 2025 Fedora Release Engineering - 1:0.10.4-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Mon Jul 7 2025 Bojan Smojver - 1:0.10.4-2 - Patch upstream issue #3558, fix by matt335672 From 31a153d643d5fe618ab389f9eabecddcf9a69b60 Mon Sep 17 00:00:00 2001 From: Tom spot Callaway Date: Tue, 4 Nov 2025 16:52:43 -0500 Subject: [PATCH 47/62] rebuild for new fuse3 --- xrdp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xrdp.spec b/xrdp.spec index 31f5f37..8d83c74 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -23,7 +23,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.4 -Release: 3%{?dist} +Release: 4%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ @@ -352,6 +352,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Tue Nov 4 2025 Tom Callaway - 1:0.10.4-4 +- rebuild for new fuse3 + * Fri Jul 25 2025 Fedora Release Engineering - 1:0.10.4-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From e70d8497499d4ce3dfe9973493fd8afe4c93924a Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 17 Jan 2026 20:52:58 +0000 Subject: [PATCH 48/62] Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild --- xrdp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xrdp.spec b/xrdp.spec index 8d83c74..b8e7bf7 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -23,7 +23,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.4 -Release: 4%{?dist} +Release: 5%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ @@ -352,6 +352,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Sat Jan 17 2026 Fedora Release Engineering - 1:0.10.4-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + * Tue Nov 4 2025 Tom Callaway - 1:0.10.4-4 - rebuild for new fuse3 From 500f161a308d1535ef3d58dc6b6a34646392f048 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Wed, 28 Jan 2026 18:41:05 +1100 Subject: [PATCH 49/62] Update to 0.10.5 --- .gitignore | 1 + sources | 2 +- xrdp-0.10.4-vmconnect.patch | 19 ------------------- ...-ini.patch => xrdp-0.10.5-sesman-ini.patch | 4 ++-- xrdp.spec | 10 ++++++---- 5 files changed, 10 insertions(+), 26 deletions(-) delete mode 100644 xrdp-0.10.4-vmconnect.patch rename xrdp-0.10.2-sesman-ini.patch => xrdp-0.10.5-sesman-ini.patch (84%) diff --git a/.gitignore b/.gitignore index ae9cd3a..1f5fe01 100644 --- a/.gitignore +++ b/.gitignore @@ -37,3 +37,4 @@ xrdp-cvs-03-17-2010.tar.gz /xrdp-0.10.2.tar.gz /xrdp-0.10.3.tar.gz /xrdp-0.10.4.tar.gz +/xrdp-0.10.5.tar.gz diff --git a/sources b/sources index 15c021b..94071ab 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (xrdp-0.10.4.tar.gz) = 9f4ba18cd1bf0f610535d6f2ae451e0fba3de4efc23e3049073b087d3f9221026d2817359bfa1d585aeb54fed4d1ac2f5ba7913f271c7c0b30f6d64d6267a1d8 +SHA512 (xrdp-0.10.5.tar.gz) = 94214754e81ca1775edc839e68ca101ef7c001095894526acf4367be82bcba1c6cbcec8c26a6d2c3161a5bc15dae44f71a8af2db94c98201fd48528cd344dc5d diff --git a/xrdp-0.10.4-vmconnect.patch b/xrdp-0.10.4-vmconnect.patch deleted file mode 100644 index 5f9ea2e..0000000 --- a/xrdp-0.10.4-vmconnect.patch +++ /dev/null @@ -1,19 +0,0 @@ ---- a/common/xrdp_client_info.h -+++ b/common/xrdp_client_info.h -@@ -172,7 +172,6 @@ struct xrdp_client_info - int require_credentials; /* when true, credentials *must* be passed on cmd line */ - - int security_layer; /* SECURITY_LAYER_* */ -- int vmconnect; /* Used when used from inside Hyper-V */ - - int multimon; /* 0 = deny , 1 = allow */ - struct display_size_description display_sizes; -@@ -254,7 +253,7 @@ struct xrdp_client_info - // Can we resize the desktop by using a Deactivation-Reactivation Sequence? - enum client_resize_mode client_resize_mode; - -- int pad1; /* unused; unicode_input_state */ -+ int vmconnect; /* Used when used from inside Hyper-V */ - }; - - enum xrdp_encoder_flags diff --git a/xrdp-0.10.2-sesman-ini.patch b/xrdp-0.10.5-sesman-ini.patch similarity index 84% rename from xrdp-0.10.2-sesman-ini.patch rename to xrdp-0.10.5-sesman-ini.patch index d1691f7..493e758 100644 --- a/xrdp-0.10.2-sesman-ini.patch +++ b/xrdp-0.10.5-sesman-ini.patch @@ -10,8 +10,8 @@ [Sessions] @@ -143,7 +143,7 @@ EnableSyslog=true - ; CentOS 8 : param=/usr/libexec/Xorg - ; FreeBSD (from 2022Q4) : param=/usr/local/libexec/Xorg + ; Arch Linux : param=/usr/lib/Xorg + ; FreeBSD (from 2022Q4) : param=/usr/local/libexec/Xorg ; -param=Xorg +param=/usr/libexec/Xorg diff --git a/xrdp.spec b/xrdp.spec index b8e7bf7..011dc87 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -22,8 +22,8 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 -Version: 0.10.4 -Release: 5%{?dist} +Version: 0.10.5 +Release: 1%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ @@ -44,9 +44,8 @@ Patch3: xrdp-0.10.0-scripts-libexec.patch Patch4: xrdp-0.9.6-script-interpreter.patch Patch5: xrdp-0.9.16-arch.patch Patch6: xrdp-0.9.18-vnc-uninit.patch -Patch7: xrdp-0.10.4-vmconnect.patch %if 0%{?fedora} >= 32 || 0%{?rhel} >= 8 -Patch8: xrdp-0.10.2-sesman-ini.patch +Patch8: xrdp-0.10.5-sesman-ini.patch %endif BuildRequires: make @@ -352,6 +351,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Wed Jan 28 2026 Bojan Smojver - 1:0.10.5-1 +- Update to 0.10.5 + * Sat Jan 17 2026 Fedora Release Engineering - 1:0.10.4-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild From 13a9c73444715deb923c2d16705971f60823db28 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Sat, 18 Apr 2026 08:23:21 +1000 Subject: [PATCH 50/62] Update to 0.10.6 --- .gitignore | 1 + sources | 2 +- xrdp.spec | 7 ++++++- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 1f5fe01..b137fbd 100644 --- a/.gitignore +++ b/.gitignore @@ -38,3 +38,4 @@ xrdp-cvs-03-17-2010.tar.gz /xrdp-0.10.3.tar.gz /xrdp-0.10.4.tar.gz /xrdp-0.10.5.tar.gz +/xrdp-0.10.6.tar.gz diff --git a/sources b/sources index 94071ab..bdcd314 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (xrdp-0.10.5.tar.gz) = 94214754e81ca1775edc839e68ca101ef7c001095894526acf4367be82bcba1c6cbcec8c26a6d2c3161a5bc15dae44f71a8af2db94c98201fd48528cd344dc5d +SHA512 (xrdp-0.10.6.tar.gz) = 4631162f8a35ee358238e52882964819c39067b2337f2affecae28ca53008e4dae455e0b59932724c222af8016c5b8a638bb455d31dfdf0774f6558e79876781 diff --git a/xrdp.spec b/xrdp.spec index 011dc87..45c6ea7 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -22,7 +22,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 -Version: 0.10.5 +Version: 0.10.6 Release: 1%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT @@ -351,6 +351,11 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Sat Apr 18 2026 Bojan Smojver - 1:0.10.6-1 +- Update to 0.10.6 +- CVE-2026-32105, CVE-2026-32107, CVE-2026-32623, CVE-2026-32624 +- CVE-2026-33145, CVE-2026-33516, CVE-2026-33689, CVE-2026-35512 + * Wed Jan 28 2026 Bojan Smojver - 1:0.10.5-1 - Update to 0.10.5 From abcf261e6c9053f70b2aee0978ada17f3347cf05 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Fri, 22 May 2026 05:07:10 +1000 Subject: [PATCH 51/62] Close TCP port in default Xvnc config, Unix domain socket only --- ...sman-ini.patch => xrdp-0.10.6-sesman-ini.patch | 15 +++++++++++++++ xrdp.spec | 5 ++++- 2 files changed, 19 insertions(+), 1 deletion(-) rename xrdp-0.10.5-sesman-ini.patch => xrdp-0.10.6-sesman-ini.patch (63%) diff --git a/xrdp-0.10.5-sesman-ini.patch b/xrdp-0.10.6-sesman-ini.patch similarity index 63% rename from xrdp-0.10.5-sesman-ini.patch rename to xrdp-0.10.6-sesman-ini.patch index 493e758..0b71f1d 100644 --- a/xrdp-0.10.5-sesman-ini.patch +++ b/xrdp-0.10.6-sesman-ini.patch @@ -18,3 +18,18 @@ ; Leave the rest parameters as-is unless you understand what will happen. param=-config param=xrdp/xorg.conf +diff -rupN xrdp-0.10.6-v/sesman/sesman.ini.in xrdp-0.10.6/sesman/sesman.ini.in +--- xrdp-0.10.6-v/sesman/sesman.ini.in 2026-05-22 04:53:40.290862163 +1000 ++++ xrdp-0.10.6/sesman/sesman.ini.in 2026-05-22 04:58:24.490852336 +1000 +@@ -170,7 +170,10 @@ param=Xvnc + param=-bs + param=-nolisten + param=tcp +-param=-localhost ++# Unix domain socket is default, close TCP ++#param=-localhost ++param=-rfbport ++param=-1 + param=-dpi + param=96 + diff --git a/xrdp.spec b/xrdp.spec index 45c6ea7..dc37498 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -23,7 +23,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.6 -Release: 1%{?dist} +Release: 2%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ @@ -351,6 +351,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Fri May 22 2026 Bojan Smojver - 1:0.10.6-2 +- close TCP port in default Xvnc config, Unix domain socket only + * Sat Apr 18 2026 Bojan Smojver - 1:0.10.6-1 - Update to 0.10.6 - CVE-2026-32105, CVE-2026-32107, CVE-2026-32623, CVE-2026-32624 From 9da935c0871ca07c98ee2e9355d520fd338bbc83 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Fri, 22 May 2026 05:15:19 +1000 Subject: [PATCH 52/62] close TCP port in default Xvnc config, Unix domain socket only --- xrdp.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xrdp.spec b/xrdp.spec index dc37498..c4c1b1b 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -45,7 +45,7 @@ Patch4: xrdp-0.9.6-script-interpreter.patch Patch5: xrdp-0.9.16-arch.patch Patch6: xrdp-0.9.18-vnc-uninit.patch %if 0%{?fedora} >= 32 || 0%{?rhel} >= 8 -Patch8: xrdp-0.10.5-sesman-ini.patch +Patch8: xrdp-0.10.6-sesman-ini.patch %endif BuildRequires: make From 15b67bfea5fd6c90d80e519e0556ef8220987b4a Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Fri, 12 Jun 2026 20:08:57 -0400 Subject: [PATCH 53/62] Rebuilt for openssl 4.0 --- xrdp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xrdp.spec b/xrdp.spec index c4c1b1b..4d7acd6 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -23,7 +23,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.6 -Release: 2%{?dist} +Release: 3%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ @@ -351,6 +351,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Sat Jun 13 2026 Yaakov Selkowitz - 1:0.10.6-3 +- Rebuilt for openssl 4.0 + * Fri May 22 2026 Bojan Smojver - 1:0.10.6-2 - close TCP port in default Xvnc config, Unix domain socket only From 5c0c4355e82c796c15b78ddef345ccf0e12ce4c4 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Tue, 7 Jul 2026 19:02:39 +1000 Subject: [PATCH 54/62] Revert "close TCP port in default Xvnc config, Unix domain socket only" This reverts commit 9da935c0871ca07c98ee2e9355d520fd338bbc83. --- xrdp.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xrdp.spec b/xrdp.spec index 4d7acd6..34d455e 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -45,7 +45,7 @@ Patch4: xrdp-0.9.6-script-interpreter.patch Patch5: xrdp-0.9.16-arch.patch Patch6: xrdp-0.9.18-vnc-uninit.patch %if 0%{?fedora} >= 32 || 0%{?rhel} >= 8 -Patch8: xrdp-0.10.6-sesman-ini.patch +Patch8: xrdp-0.10.5-sesman-ini.patch %endif BuildRequires: make From 8206f1cde672387882773e300655ecc1b869eba6 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Tue, 7 Jul 2026 19:18:11 +1000 Subject: [PATCH 55/62] Revert "Close TCP port in default Xvnc config, Unix domain socket only" This reverts commit abcf261e6c9053f70b2aee0978ada17f3347cf05. --- ...sman-ini.patch => xrdp-0.10.5-sesman-ini.patch | 15 --------------- 1 file changed, 15 deletions(-) rename xrdp-0.10.6-sesman-ini.patch => xrdp-0.10.5-sesman-ini.patch (63%) diff --git a/xrdp-0.10.6-sesman-ini.patch b/xrdp-0.10.5-sesman-ini.patch similarity index 63% rename from xrdp-0.10.6-sesman-ini.patch rename to xrdp-0.10.5-sesman-ini.patch index 0b71f1d..493e758 100644 --- a/xrdp-0.10.6-sesman-ini.patch +++ b/xrdp-0.10.5-sesman-ini.patch @@ -18,18 +18,3 @@ ; Leave the rest parameters as-is unless you understand what will happen. param=-config param=xrdp/xorg.conf -diff -rupN xrdp-0.10.6-v/sesman/sesman.ini.in xrdp-0.10.6/sesman/sesman.ini.in ---- xrdp-0.10.6-v/sesman/sesman.ini.in 2026-05-22 04:53:40.290862163 +1000 -+++ xrdp-0.10.6/sesman/sesman.ini.in 2026-05-22 04:58:24.490852336 +1000 -@@ -170,7 +170,10 @@ param=Xvnc - param=-bs - param=-nolisten - param=tcp --param=-localhost -+# Unix domain socket is default, close TCP -+#param=-localhost -+param=-rfbport -+param=-1 - param=-dpi - param=96 - From f339e611760331b79d559f3de70759b18025b445 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Tue, 7 Jul 2026 19:33:24 +1000 Subject: [PATCH 56/62] Update to 0.10.6.1 CVE-2026-41252, CVE-2026-41521, CVE-2026-44178, CVE-2026-42218 CVE-2026-44978, CVE-2026-54538, CVE-2026-55238, CVE-2026-55626 CVE-2026-55639, CVE-2026-55645 --- sources | 2 +- xrdp.spec | 11 ++++++++--- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/sources b/sources index bdcd314..b24fbd2 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (xrdp-0.10.6.tar.gz) = 4631162f8a35ee358238e52882964819c39067b2337f2affecae28ca53008e4dae455e0b59932724c222af8016c5b8a638bb455d31dfdf0774f6558e79876781 +SHA512 (xrdp-0.10.6.1.tar.gz) = 14fc2bdc7d450b0194d48244450fee2dc40d248bf0d7d64538959827919d517bda90cda5985014e6b5adf101cbb584e83cf72e5181adcff78b3131653937e108 diff --git a/xrdp.spec b/xrdp.spec index 34d455e..604f975 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -22,8 +22,8 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 -Version: 0.10.6 -Release: 3%{?dist} +Version: 0.10.6.1 +Release: 1%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ @@ -38,7 +38,6 @@ Source7: xrdp-polkit-1.rules Source8: %{name}-tmpfiles.conf Source9: %{name}.sysusers Patch0: xrdp-0.10.2-sesman.patch -Patch1: xrdp-0.10.3-xrdp-ini.patch Patch2: xrdp-0.10.1-service.patch Patch3: xrdp-0.10.0-scripts-libexec.patch Patch4: xrdp-0.9.6-script-interpreter.patch @@ -351,6 +350,12 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Tue Jul 07 2026 Bojan Smojver - 1:0.10.6.1-1 +- Update to 0.10.6.1 +- CVE-2026-41252, CVE-2026-41521, CVE-2026-44178, CVE-2026-42218 +- CVE-2026-44978, CVE-2026-54538, CVE-2026-55238, CVE-2026-55626 +- CVE-2026-55639, CVE-2026-55645 + * Sat Jun 13 2026 Yaakov Selkowitz - 1:0.10.6-3 - Rebuilt for openssl 4.0 From 94b6f4aba284f366e1a038be18bfa4d8c1c5d82d Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Tue, 7 Jul 2026 19:49:14 +1000 Subject: [PATCH 57/62] Upload new source tarball --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index b137fbd..1719a63 100644 --- a/.gitignore +++ b/.gitignore @@ -39,3 +39,4 @@ xrdp-cvs-03-17-2010.tar.gz /xrdp-0.10.4.tar.gz /xrdp-0.10.5.tar.gz /xrdp-0.10.6.tar.gz +/xrdp-0.10.6.1.tar.gz From 7691357362915e4de2df88c955af8af9fbd02cb5 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Fri, 17 Jul 2026 18:03:54 +1000 Subject: [PATCH 58/62] Fix bug #2499948 Update to 0.10.6.1 CVE-2026-41252, CVE-2026-41521, CVE-2026-44178, CVE-2026-42218 CVE-2026-44978, CVE-2026-54538, CVE-2026-55238, CVE-2026-55626 CVE-2026-55639, CVE-2026-55645 --- README.md | 35 ++++++++++++++++++++--------------- xrdp-sesman.pamd | 23 ++++++++++++++++++++--- xrdp.spec | 2 +- 3 files changed, 41 insertions(+), 19 deletions(-) diff --git a/README.md b/README.md index 6d28731..0002572 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,5 @@ Downgrade from 0.10.x to 0.9.x == - Version 0.10.x requires different permissions of `/run/xrdp` directory than version 0.9.x. When 0.10.x is fully uninstalled, this directory is removed and subsequent installation of 0.9.x should work fine. @@ -12,7 +11,6 @@ changed to 1777 beforehand. Unprivileged xrdp user in 0.10.2 and up == - Recent builds of xrdp (0.10.2 and above) create local unprivileged xrdp user, which is used to run xrdp daemon. Script `/usr/share/xrdp/xrdp-chkpriv` checks whether `/etc/xrdp/key.pem`, `/etc/xrdp/cert.pem` and `/etc/xrdp/rsakeys.ini` @@ -27,7 +25,6 @@ permissions. Restarts == - Service restarts after RPM package upgrades have been disabled on purpose. This is to avoid a situation where an update is performed from within a session running on xrdp, which can then cause dnf to only perform part of the @@ -40,14 +37,12 @@ Wayland do. xorgxrdp == - Note that xorgxrdp is not installed and configured by default. Each build depends on specific binary version of Xorg. If you wish to use it, install it by hand or its glamor build. SELinux == - You may need to install xrdp-selinux package in order to get the required SELinux policy that will allow xrdp and associated processes to run successfully if SELinux is enabled. On versions of Fedora and RHEL that support @@ -56,16 +51,23 @@ weak dependencies, xrdp-selinux will be a recommended package. **WARNING**: The policy module contains a rule that permits unconfined_service_t processes to transition into unconfined_t. If xrdp is not the only service that runs as unconfined_service_t on your system, this policy -will allow any other such service to transition as well. +will allow any other such service to transition as well. This transition is +exercised on every xrdp session (see below), not just latent in the policy. -Default configuration in `/etc/pam.d/xrdp-sesman` uses password-auth for auth, -account, password and session. This may result in an incorrect context for the -processes in the session. Please adjust this file to match your desktop -environment. An example for Gnome desktop is given in the file. +The default `/etc/pam.d/xrdp-sesman` configuration invokes `pam_selinux.so`, +`pam_loginuid.so`, `pam_namespace.so` and `pam_keyinit.so` around the shared +`password-auth` stack, so session processes get the correct `unconfined_t` +context instead of remaining `unconfined_service_t` (rhbz#2499948). + +If you are running a GNOME session over xrdp, comment out the generic block +in `/etc/pam.d/xrdp-sesman` and uncomment the Gnome-specific block instead. +This routes auth/session handling through `gdm-password`, which already +carries the correct SELinux/session ordering and additionally unlocks GNOME +Keyring automatically at login, so you won't be prompted to unlock it a +second time inside the session. TigerVNC >= 1.8.0 == - TigerVNC 1.8.0 enables clipboard support by default (i.e. no need to run vncconfig), which may cause disconnections in xrdp. To avoid the issue, these can be added to [Xvnc] stanza in `/etc/xrdp/sesman.ini`: @@ -80,19 +82,23 @@ Of course, cut and paste support will not work with these set. Runlevel == - If the system is configured to boot into graphical target, you may experience problems with xrdp Gnome sessions. In order to avoid this, put the system into multi user target. Like this: ``` systemctl set-default multi-user.target ``` - Then reboot. +GNOME on X11 is no longer part of Fedora, so GNOME is no longer a supported +desktop for xrdp sessions on Fedora. If you need RDP access to a GNOME +desktop, use GNOME's built-in headless GNOME Remote Desktop instead of xrdp — +it speaks RDP natively, is Wayland-based, and doesn't need any of the +X11/PAM workarounds this document describes. xrdp remains the right choice +for XFCE, KDE Plasma, and other X11-based desktops on Fedora. + VSOCK == - An example of a how to set up xrdp with VSOCK can be found here: https://bugzilla.redhat.com/show_bug.cgi?id=1787953#c22 @@ -102,7 +108,6 @@ updates are already shipped, but in a current, JavaScript format. KDE Plasma == - If you are using plasma-workspace package with xrdp, be sure to install plasma-workspace-x11 to get full functionality. See this for more details: diff --git a/xrdp-sesman.pamd b/xrdp-sesman.pamd index a23efb0..5e791ad 100644 --- a/xrdp-sesman.pamd +++ b/xrdp-sesman.pamd @@ -1,13 +1,30 @@ #%PAM-1.0 -# Generic Fedora config +# Generic Fedora/RHEL config — use this unless you are running xrdp +# sessions into a GNOME desktop, in which case use the Gnome-specific +# config below instead, which also unlocks GNOME Keyring automatically. auth include password-auth account include password-auth password include password-auth -session include password-auth + +# pam_selinux.so close must be the first session rule so any +# prior context is torn down before we set up the new one. +session required pam_selinux.so close session required pam_loginuid.so +# pam_selinux.so open must run before any module below that +# should execute in the user's context. Without this pair, +# session processes are left running as unconfined_service_t +# instead of unconfined_t. See rhbz#2499948. +session required pam_selinux.so open +session required pam_namespace.so +session optional pam_keyinit.so force revoke +session include password-auth session optional pam_lastlog.so silent -# Gnome specific Fedora config +# Gnome specific config. Uncomment this block and comment out the +# generic block above if you are running xrdp sessions into a GNOME +# desktop. This uses GDM's own PAM stack, which already includes the +# correct pam_selinux.so/pam_namespace.so ordering and additionally +# unlocks GNOME Keyring automatically at login. #auth include gdm-password #account include gdm-password #password include gdm-password diff --git a/xrdp.spec b/xrdp.spec index 604f975..0269c4a 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -21,7 +21,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp -Epoch: 1 +Epoch: 2 Version: 0.10.6.1 Release: 1%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. From 840ef696de1e6539fd6a772299ebf4e3ee915996 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Fri, 17 Jul 2026 18:06:43 +1000 Subject: [PATCH 59/62] Fix changelog --- xrdp.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/xrdp.spec b/xrdp.spec index 0269c4a..eedc5c2 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -350,6 +350,9 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog +* Fri Jul 17 2026 Bojan Smojver - 1:0.10.6.1-2 +- Fix bug #2499948 + * Tue Jul 07 2026 Bojan Smojver - 1:0.10.6.1-1 - Update to 0.10.6.1 - CVE-2026-41252, CVE-2026-41521, CVE-2026-44178, CVE-2026-42218 From da773d7b96fb8d6765017f903903232c594897cc Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Fri, 17 Jul 2026 18:13:33 +1000 Subject: [PATCH 60/62] Fix epoch/release bump --- xrdp.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/xrdp.spec b/xrdp.spec index eedc5c2..025ba4c 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -21,9 +21,9 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp -Epoch: 2 +Epoch: 1 Version: 0.10.6.1 -Release: 1%{?dist} +Release: 2%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ From 950bca157255617fa47f6d227e7d2bd2f635d624 Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Sat, 18 Jul 2026 08:06:58 +1000 Subject: [PATCH 61/62] Replace m-dashes with hyphens --- README.md | 2 +- xrdp-sesman.pamd | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 0002572..d834e23 100644 --- a/README.md +++ b/README.md @@ -92,7 +92,7 @@ Then reboot. GNOME on X11 is no longer part of Fedora, so GNOME is no longer a supported desktop for xrdp sessions on Fedora. If you need RDP access to a GNOME -desktop, use GNOME's built-in headless GNOME Remote Desktop instead of xrdp — +desktop, use GNOME's built-in headless GNOME Remote Desktop instead of xrdp - it speaks RDP natively, is Wayland-based, and doesn't need any of the X11/PAM workarounds this document describes. xrdp remains the right choice for XFCE, KDE Plasma, and other X11-based desktops on Fedora. diff --git a/xrdp-sesman.pamd b/xrdp-sesman.pamd index 5e791ad..cf8ef8a 100644 --- a/xrdp-sesman.pamd +++ b/xrdp-sesman.pamd @@ -1,5 +1,5 @@ #%PAM-1.0 -# Generic Fedora/RHEL config — use this unless you are running xrdp +# Generic Fedora/RHEL config - use this unless you are running xrdp # sessions into a GNOME desktop, in which case use the Gnome-specific # config below instead, which also unlocks GNOME Keyring automatically. auth include password-auth From ded6843d0a23a8a76fbc3ecc4e4d3e876f3374de Mon Sep 17 00:00:00 2001 From: Bojan Smojver Date: Sat, 18 Jul 2026 08:09:58 +1000 Subject: [PATCH 62/62] Bump release for rebuild --- xrdp.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/xrdp.spec b/xrdp.spec index 025ba4c..e4066cc 100644 --- a/xrdp.spec +++ b/xrdp.spec @@ -23,7 +23,7 @@ Summary: Open source remote desktop protocol (RDP) server Name: xrdp Epoch: 1 Version: 0.10.6.1 -Release: 2%{?dist} +Release: 3%{?dist} # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended. License: Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT URL: http://www.xrdp.org/ @@ -350,7 +350,7 @@ fi %{_datadir}/selinux/*/%{name}.pp %changelog -* Fri Jul 17 2026 Bojan Smojver - 1:0.10.6.1-2 +* Sat Jul 18 2026 Bojan Smojver - 1:0.10.6.1-3 - Fix bug #2499948 * Tue Jul 07 2026 Bojan Smojver - 1:0.10.6.1-1