From b4317c958937024ba8bee1b1c4cdef3f1d557b41 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 14 Jul 2026 00:26:18 +0000 Subject: [PATCH 1/3] Initial plan From fd5f651f2c24bb19ab5034677b31aaf4d5543bb0 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 14 Jul 2026 00:28:17 +0000 Subject: [PATCH 2/3] fix(rdp): run grdctl --system directly as root, remove runuser/polkit/util-linux Root cause: gnome-remote-desktop-setup.service ran as root but dropped privileges via `runuser -u gnome-remote-desktop`. Non-root grdctl --system attempts authorisation through pkexec. The Nix-store pkexec binary is not setuid, so every system-mode credential call silently failed while the script still printed "configured successfully". GNOME Remote Desktop then started without applied credentials, causing Remmina to loop at the login dialog. Fix: - Remove `runuser -u gnome-remote-desktop --` from grdctl_system helper; the root-run oneshot service can call grdctl --system directly. - Remove pkgs.polkit and pkgs.util-linux from the setup service path as neither polkit nor runuser is needed any more. - Update tests: rename test_setup_runs_grdctl_as_gnome_remote_desktop_user to test_setup_runs_grdctl_directly_as_root and assert that runuser, pkexec, and sudo are absent; add test_privilege_escalation_packages_absent_from_setup_path. All 21 app/tests pass. --- app/tests/test_rdp_module_boot_setup.py | 12 ++++++++++-- modules/rdp.nix | 3 --- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/app/tests/test_rdp_module_boot_setup.py b/app/tests/test_rdp_module_boot_setup.py index 8cb8c8b..bb29820 100644 --- a/app/tests/test_rdp_module_boot_setup.py +++ b/app/tests/test_rdp_module_boot_setup.py @@ -52,9 +52,17 @@ class RdpModuleBootSetupTests(unittest.TestCase): self.assertIn('echo "grdctl command timed out: $*" >&2', self.setup_service) self.assertIn('echo "grdctl command failed (exit $rc): $*" >&2', self.setup_service) - def test_setup_runs_grdctl_as_gnome_remote_desktop_user(self): - self.assertIn("runuser -u gnome-remote-desktop -- \\", self.setup_service) + def test_setup_runs_grdctl_directly_as_root(self): + # The oneshot service already runs as root; system-mode grdctl must be + # invoked directly so it does not attempt pkexec authorisation. self.assertIn('grdctl --system "$@"', self.setup_service) + self.assertNotIn("runuser", self.setup_service) + self.assertNotIn("pkexec", self.setup_service) + self.assertNotIn("sudo", self.setup_service) + + def test_privilege_escalation_packages_absent_from_setup_path(self): + self.assertNotIn("pkgs.polkit", self.setup_service) + self.assertNotIn("pkgs.util-linux", self.setup_service) def test_hub_files_are_the_source_of_truth_for_username_and_password(self): self.assertIn('DEFAULT_USERNAME="sovran"', self.setup_service) diff --git a/modules/rdp.nix b/modules/rdp.nix index 2499491..c658631 100644 --- a/modules/rdp.nix +++ b/modules/rdp.nix @@ -46,9 +46,7 @@ lib.mkIf config.sovran_systemsOS.features.rdp { pkgs.gnome-remote-desktop pkgs.hostname pkgs.openssl - pkgs.polkit pkgs.systemd - pkgs.util-linux ]; script = '' set -euo pipefail @@ -64,7 +62,6 @@ lib.mkIf config.sovran_systemsOS.features.rdp { local rc=0 if timeout --kill-after=5s 10s \ - runuser -u gnome-remote-desktop -- \ grdctl --system "$@"; then return 0 else From 1bb7d1c680cc8cfe11973aac86a5a4deedcba788 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 14 Jul 2026 00:29:26 +0000 Subject: [PATCH 3/3] =?UTF-8?q?style:=20fix=20spelling=20authorisation=20?= =?UTF-8?q?=E2=86=92=20authorization=20in=20test=20comment?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- app/tests/test_rdp_module_boot_setup.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/tests/test_rdp_module_boot_setup.py b/app/tests/test_rdp_module_boot_setup.py index bb29820..c070034 100644 --- a/app/tests/test_rdp_module_boot_setup.py +++ b/app/tests/test_rdp_module_boot_setup.py @@ -54,7 +54,7 @@ class RdpModuleBootSetupTests(unittest.TestCase): def test_setup_runs_grdctl_directly_as_root(self): # The oneshot service already runs as root; system-mode grdctl must be - # invoked directly so it does not attempt pkexec authorisation. + # invoked directly so it does not attempt pkexec authorization. self.assertIn('grdctl --system "$@"', self.setup_service) self.assertNotIn("runuser", self.setup_service) self.assertNotIn("pkexec", self.setup_service)