.gitignore

@@ -37,6 +37,3 @@ xrdp-cvs-03-17-2010.tar.gz
 /xrdp-0.10.2.tar.gz
 /xrdp-0.10.3.tar.gz
 /xrdp-0.10.4.tar.gz
-/xrdp-0.10.5.tar.gz
-/xrdp-0.10.6.tar.gz
-/xrdp-0.10.6.1.tar.gz

README.md

@@ -1,5 +1,6 @@
 Downgrade from 0.10.x to 0.9.x
 ==
+
 Version 0.10.x requires different permissions of `/run/xrdp` directory than
 version 0.9.x. When 0.10.x is fully uninstalled, this directory is removed
 and subsequent installation of 0.9.x should work fine.
@@ -11,6 +12,7 @@ changed to 1777 beforehand.
 
 Unprivileged xrdp user in 0.10.2 and up
 ==
+
 Recent builds of xrdp (0.10.2 and above) create local unprivileged xrdp user,
 which is used to run xrdp daemon. Script `/usr/share/xrdp/xrdp-chkpriv` checks
 whether `/etc/xrdp/key.pem`, `/etc/xrdp/cert.pem` and `/etc/xrdp/rsakeys.ini`
@@ -25,6 +27,7 @@ permissions.
 
 Restarts
 ==
+
 Service restarts after RPM package upgrades have been disabled on purpose.
 This is to avoid a situation where an update is performed from within a
 session running on xrdp, which can then cause dnf to only perform part of the
@@ -37,12 +40,14 @@ Wayland do.
 
 xorgxrdp
 ==
+
 Note that xorgxrdp is not installed and configured by default. Each build
 depends on specific binary version of Xorg. If you wish to use it, install
 it by hand or its glamor build.
 
 SELinux
 ==
+
 You may need to install xrdp-selinux package in order to get the required
 SELinux policy that will allow xrdp and associated processes to run
 successfully if SELinux is enabled. On versions of Fedora and RHEL that support
@@ -51,23 +56,16 @@ weak dependencies, xrdp-selinux will be a recommended package.
 **WARNING**: The policy module contains a rule that permits
 unconfined_service_t processes to transition into unconfined_t. If xrdp is not
 the only service that runs as unconfined_service_t on your system, this policy
-will allow any other such service to transition as well. This transition is
-exercised on every xrdp session (see below), not just latent in the policy.
+will allow any other such service to transition as well.
 
-The default `/etc/pam.d/xrdp-sesman` configuration invokes `pam_selinux.so`,
-`pam_loginuid.so`, `pam_namespace.so` and `pam_keyinit.so` around the shared
-`password-auth` stack, so session processes get the correct `unconfined_t`
-context instead of remaining `unconfined_service_t` (rhbz#2499948).
-
-If you are running a GNOME session over xrdp, comment out the generic block
-in `/etc/pam.d/xrdp-sesman` and uncomment the Gnome-specific block instead.
-This routes auth/session handling through `gdm-password`, which already
-carries the correct SELinux/session ordering and additionally unlocks GNOME
-Keyring automatically at login, so you won't be prompted to unlock it a
-second time inside the session.
+Default configuration in `/etc/pam.d/xrdp-sesman` uses password-auth for auth,
+account, password and session. This may result in an incorrect context for the
+processes in the session. Please adjust this file to match your desktop
+environment. An example for Gnome desktop is given in the file.
 
 TigerVNC >= 1.8.0
 ==
+
 TigerVNC 1.8.0 enables clipboard support by default (i.e. no need to run
 vncconfig), which may cause disconnections in xrdp. To avoid the issue, these
 can be added to [Xvnc] stanza in `/etc/xrdp/sesman.ini`:
@@ -82,23 +80,19 @@ Of course, cut and paste support will not work with these set.
 
 Runlevel
 ==
+
 If the system is configured to boot into graphical target, you may experience
 problems with xrdp Gnome sessions. In order to avoid this, put the system into
 multi user target. Like this:
 ```
 systemctl set-default multi-user.target
 ```
-Then reboot.
 
-GNOME on X11 is no longer part of Fedora, so GNOME is no longer a supported
-desktop for xrdp sessions on Fedora. If you need RDP access to a GNOME
-desktop, use GNOME's built-in headless GNOME Remote Desktop instead of xrdp -
-it speaks RDP natively, is Wayland-based, and doesn't need any of the
-X11/PAM workarounds this document describes. xrdp remains the right choice
-for XFCE, KDE Plasma, and other X11-based desktops on Fedora.
+Then reboot.
 
 VSOCK
 ==
+
 An example of a how to set up xrdp with VSOCK can be found here:
 
 https://bugzilla.redhat.com/show_bug.cgi?id=1787953#c22
@@ -108,6 +102,7 @@ updates are already shipped, but in a current, JavaScript format.
 
 KDE Plasma
 ==
+
 If you are using plasma-workspace package with xrdp, be sure to install
 plasma-workspace-x11 to get full functionality. See this for more details:
 

sources

@@ -1 +1 @@
-SHA512 (xrdp-0.10.6.1.tar.gz) = 14fc2bdc7d450b0194d48244450fee2dc40d248bf0d7d64538959827919d517bda90cda5985014e6b5adf101cbb584e83cf72e5181adcff78b3131653937e108
+SHA512 (xrdp-0.10.4.tar.gz) = 9f4ba18cd1bf0f610535d6f2ae451e0fba3de4efc23e3049073b087d3f9221026d2817359bfa1d585aeb54fed4d1ac2f5ba7913f271c7c0b30f6d64d6267a1d8

xrdp-0.10.2-sesman-ini.patch

@@ -10,8 +10,8 @@
  
  [Sessions]
 @@ -143,7 +143,7 @@ EnableSyslog=true
- ; Arch Linux                  :  param=/usr/lib/Xorg
- ; FreeBSD (from 2022Q4)       :  param=/usr/local/libexec/Xorg
+ ; CentOS 8              :  param=/usr/libexec/Xorg
+ ; FreeBSD (from 2022Q4) :  param=/usr/local/libexec/Xorg
  ;
 -param=Xorg
 +param=/usr/libexec/Xorg

xrdp-0.10.4-vmconnect.patch

@@ -0,0 +1,19 @@
+--- a/common/xrdp_client_info.h
++++ b/common/xrdp_client_info.h
+@@ -172,7 +172,6 @@ struct xrdp_client_info
+     int require_credentials; /* when true, credentials *must* be passed on cmd line */
+ 
+     int security_layer; /* SECURITY_LAYER_* */
+-    int vmconnect; /* Used when used from inside Hyper-V */
+ 
+     int multimon; /* 0 = deny , 1 = allow */
+     struct display_size_description display_sizes;
+@@ -254,7 +253,7 @@ struct xrdp_client_info
+     // Can we resize the desktop by using a Deactivation-Reactivation Sequence?
+     enum client_resize_mode client_resize_mode;
+ 
+-    int pad1; /* unused; unicode_input_state */
++    int vmconnect; /* Used when used from inside Hyper-V */
+ };
+ 
+ enum xrdp_encoder_flags

xrdp-sesman.pamd

@@ -1,30 +1,13 @@
 #%PAM-1.0
-# Generic Fedora/RHEL config - use this unless you are running xrdp
-# sessions into a GNOME desktop, in which case use the Gnome-specific
-# config below instead, which also unlocks GNOME Keyring automatically.
+# Generic Fedora config
 auth       include      password-auth
 account    include      password-auth
 password   include      password-auth
-
-# pam_selinux.so close must be the first session rule so any
-# prior context is torn down before we set up the new one.
-session    required     pam_selinux.so close
-session    required     pam_loginuid.so
-# pam_selinux.so open must run before any module below that
-# should execute in the user's context. Without this pair,
-# session processes are left running as unconfined_service_t
-# instead of unconfined_t. See rhbz#2499948.
-session    required     pam_selinux.so open
-session    required     pam_namespace.so
-session    optional     pam_keyinit.so force revoke
 session    include      password-auth
+session    required     pam_loginuid.so
 session    optional     pam_lastlog.so silent
 
-# Gnome specific config. Uncomment this block and comment out the
-# generic block above if you are running xrdp sessions into a GNOME
-# desktop. This uses GDM's own PAM stack, which already includes the
-# correct pam_selinux.so/pam_namespace.so ordering and additionally
-# unlocks GNOME Keyring automatically at login.
+# Gnome specific Fedora config
 #auth       include      gdm-password
 #account    include      gdm-password
 #password   include      gdm-password

xrdp.spec

@@ -22,8 +22,8 @@
 Summary:   Open source remote desktop protocol (RDP) server
 Name:      xrdp
 Epoch:     1
-Version:   0.10.6.1
-Release:   3%{?dist}
+Version:   0.10.4
+Release:   2%{?dist}
 # Automatically converted from old format: ASL 2.0 and GPLv2+ and MIT - review is highly recommended.
 License:   Apache-2.0 AND GPL-2.0-or-later AND LicenseRef-Callaway-MIT
 URL:       http://www.xrdp.org/
@@ -38,13 +38,15 @@ Source7:   xrdp-polkit-1.rules
 Source8:   %{name}-tmpfiles.conf
 Source9:   %{name}.sysusers
 Patch0:    xrdp-0.10.2-sesman.patch
+Patch1:    xrdp-0.10.3-xrdp-ini.patch
 Patch2:    xrdp-0.10.1-service.patch
 Patch3:    xrdp-0.10.0-scripts-libexec.patch
 Patch4:    xrdp-0.9.6-script-interpreter.patch
 Patch5:    xrdp-0.9.16-arch.patch
 Patch6:    xrdp-0.9.18-vnc-uninit.patch
+Patch7:    xrdp-0.10.4-vmconnect.patch
 %if 0%{?fedora} >= 32 || 0%{?rhel} >= 8
-Patch8:    xrdp-0.10.5-sesman-ini.patch
+Patch8:    xrdp-0.10.2-sesman-ini.patch
 %endif
 
 BuildRequires: make
@@ -350,38 +352,6 @@ fi
 %{_datadir}/selinux/*/%{name}.pp
 
 %changelog
-* Sat Jul 18 2026 Bojan Smojver <bojan@rexursive.com> - 1:0.10.6.1-3
-- Fix bug #2499948
-
-* Tue Jul 07 2026 Bojan Smojver <bojan@rexursive.com> - 1:0.10.6.1-1
-- Update to 0.10.6.1
-- CVE-2026-41252, CVE-2026-41521, CVE-2026-44178, CVE-2026-42218
-- CVE-2026-44978, CVE-2026-54538, CVE-2026-55238, CVE-2026-55626
-- CVE-2026-55639, CVE-2026-55645
-
-* Sat Jun 13 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 1:0.10.6-3
-- Rebuilt for openssl 4.0
-
-* Fri May 22 2026 Bojan Smojver <bojan@rexursive.com> - 1:0.10.6-2
-- close TCP port in default Xvnc config, Unix domain socket only
-
-* Sat Apr 18 2026 Bojan Smojver <bojan@rexursive.com> - 1:0.10.6-1
-- Update to 0.10.6
-- CVE-2026-32105, CVE-2026-32107, CVE-2026-32623, CVE-2026-32624
-- CVE-2026-33145, CVE-2026-33516, CVE-2026-33689, CVE-2026-35512
-
-* Wed Jan 28 2026 Bojan Smojver <bojan@rexursive.com> - 1:0.10.5-1
-- Update to 0.10.5
-
-* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1:0.10.4-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
-
-* Tue Nov  4 2025 Tom Callaway <spot@fedoraproject.org> - 1:0.10.4-4
-- rebuild for new fuse3
-
-* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1:0.10.4-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
 * Mon Jul  7 2025 Bojan Smojver <bojan@rexursive.com> - 1:0.10.4-2
 - Patch upstream issue #3558, fix by matt335672