Repository navigation
Conversation
Signed-off-by: mrigbozurike <drbillionbook@gmail.com>
Signed-off-by: mrigbozurike <drbillionbook@gmail.com>
Signed-off-by: mrigbozurike <drbillionbook@gmail.com>
serve: refuse to run as root
Merges #4 (audit: record focused window title and screenshot hash) at 7e07e04. The only conflict is CHANGELOG.md, where #4 and #5 both add an entry under Unreleased; both are kept. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H6FWzFP6qZXMn5TXipJPRw Signed-off-by: Brian Scott <claudeai@bscott.email>
Merges #3 (systemd: sandbox the user unit) at fc66dbf. Conflicts: CHANGELOG.md (each PR adds an entry under Unreleased; all are kept) and docs/setup-linux.md (#3 and #5 add sections at the same place; both are kept, the unit's sandbox section first under Running, then Persistence is opt-in). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H6FWzFP6qZXMn5TXipJPRw Signed-off-by: Brian Scott <claudeai@bscott.email>
Owner
Author
|
Closing. This PR was opened before 0.5.0 was ready: it described only #5, and the release commit (version bump, dated CHANGELOG) wasn't in yet. A new release PR from Generated by Claude Code |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Added a new
privdropmodule that preventsrdc servefrom running with root privileges (real or effective uid 0). The daemon now exits early with a clear error message if started as root, viasudo, or as a setuid binary.rdc doctorreports the current process user and flags root as unhealthy.Why
rdc servenever needs root privileges: the port is unprivileged and all other operations happen within a desktop session. Running with root privileges creates an unnecessary security risk—a remote-control surface should not hold full system privileges. This change enforces that invariant and makes the constraint explicit to users.The implementation checks both real and effective uid, since either one being 0 grants root authority. A process with uid 0 can regain effective uid 0, and a setuid-root binary has effective uid 0 regardless of who ran it.
Tests
Added comprehensive unit tests covering:
All tests pass;
cargo testvalidates the logic without requiring elevated privileges.Ran on
USERNAMEenv varChecklist
cargo testpassescargo fmtandcargo clippy --all-targets -- -D warningspassSECURITY.md,docs/setup-linux.md,README.md)CHANGELOG.mdentry under Unreleasedhttps://claude.ai/code/session_01H6FWzFP6qZXMn5TXipJPRw