https://bugs.kde.org/show_bug.cgi?id=522093

--- Comment #1 from [email protected] ---
# KRdp NoNewPrivileges workaround — applied 2026-06-23

Local workaround for the regression described in
`krdp-nonewprivileges-bug-report.md` (filed upstream at bugs.kde.org, Product
KRdp, corroborated by other reporters).

## Problem

krdp 6.7.0 added `NoNewPrivileges=true` to `app-org.kde.krdpserver.service`.
This blocks the setuid-root `unix_chkpwd` helper that PAM needs to check a real
Linux account password, so `SystemUserEnabled=true` RDP login fails on every
attempt, even with the correct password.

## Changes made

1. `~/.config/krdpserverrc` — added `SystemUserEnabled=true` under `[General]`.
2. New file
`~/.config/systemd/user/app-org.kde.krdpserver.service.d/override.conf`:
   ```ini
   [Service]
   NoNewPrivileges=false
   ```
3. `systemctl --user daemon-reload && systemctl --user restart
app-org.kde.krdpserver.service`

Both changes are user-level config (`~/.config/...`), so they persist across
reboots without further action.

## Verified

- `systemctl --user show app-org.kde.krdpserver.service -p NoNewPrivileges` →
`NoNewPrivileges=no`
- Service active and running post-restart.

## Security tradeoff (accepted)

`NoNewPrivileges=true` was added as defense-in-depth against a *future* FreeRDP
RCE being chained into a local privilege escalation via setuid binaries (e.g.
`su`). Disabling it restores that specific theoretical escalation path.
Accepted here because:

- This machine's RDP service is LAN-only, not exposed to the internet.
- The alternative (KRdp's RDP-only credential, stored via KWallet) doesn't work
for unattended/autologin reboots — KWallet requires an interactive GUI unlock
that autologin never triggers, and current KWallet has no
blank-password/no-prompt option.

## Status

This is a local mitigation, not a fix. Tracking the upstream bug report for a
real resolution (e.g. scoping the sandboxing so it doesn't apply when
`SystemUserEnabled=true`, or moving the PAM check to a separate privileged
helper outside the sandboxed process).

-- 
You are receiving this mail because:
You are watching all bug changes.

Reply via email to