https://bugs.kde.org/show_bug.cgi?id=522093
--- Comment #1 from [email protected] --- # KRdp NoNewPrivileges workaround — applied 2026-06-23 Local workaround for the regression described in `krdp-nonewprivileges-bug-report.md` (filed upstream at bugs.kde.org, Product KRdp, corroborated by other reporters). ## Problem krdp 6.7.0 added `NoNewPrivileges=true` to `app-org.kde.krdpserver.service`. This blocks the setuid-root `unix_chkpwd` helper that PAM needs to check a real Linux account password, so `SystemUserEnabled=true` RDP login fails on every attempt, even with the correct password. ## Changes made 1. `~/.config/krdpserverrc` — added `SystemUserEnabled=true` under `[General]`. 2. New file `~/.config/systemd/user/app-org.kde.krdpserver.service.d/override.conf`: ```ini [Service] NoNewPrivileges=false ``` 3. `systemctl --user daemon-reload && systemctl --user restart app-org.kde.krdpserver.service` Both changes are user-level config (`~/.config/...`), so they persist across reboots without further action. ## Verified - `systemctl --user show app-org.kde.krdpserver.service -p NoNewPrivileges` → `NoNewPrivileges=no` - Service active and running post-restart. ## Security tradeoff (accepted) `NoNewPrivileges=true` was added as defense-in-depth against a *future* FreeRDP RCE being chained into a local privilege escalation via setuid binaries (e.g. `su`). Disabling it restores that specific theoretical escalation path. Accepted here because: - This machine's RDP service is LAN-only, not exposed to the internet. - The alternative (KRdp's RDP-only credential, stored via KWallet) doesn't work for unattended/autologin reboots — KWallet requires an interactive GUI unlock that autologin never triggers, and current KWallet has no blank-password/no-prompt option. ## Status This is a local mitigation, not a fix. Tracking the upstream bug report for a real resolution (e.g. scoping the sandboxing so it doesn't apply when `SystemUserEnabled=true`, or moving the PAM check to a separate privileged helper outside the sandboxed process). -- You are receiving this mail because: You are watching all bug changes.
