Rootless Xorg
The Linux VDA supports running Xorg with non-root user privileges, also known as "rootless" Xorg. Rootless Xorg is a significant security improvement over running as root.
Note:
-
Xorg does not support rootless operation on Amazon Linux 2 or RHEL 7.
-
Rootless Xorg also requires support from the GPU driver. If you are using a Remote PC Access VDA, test and verify that your GPU driver supports Rootless Xorg.
Rootless Xorg is disabled by default. Red Hat has addressed the CVE-2024-31083 security vulnerability that affects Xorg servers.
To maintain Rootless Xorg functionality, ensure MIT-SHM works in ICA® sessions by following these steps:
-
Apply the
cap_ipc_ownercapability directly to the Xorg executable, not a wrapper script, using the following distribution-specific commands:-
Ubuntu, Debian:
sudo setcap 'cap_ipc_owner=+ep' /usr/lib/xorg/Xorg -
RHEL, Rocky:
sudo setcap 'cap_ipc_owner=+ep' /usr/libexec/Xorg -
SUSE:
sudo setcap 'cap_ipc_owner=+ep' /usr/libexec/Xorg /usr/bin/Xorg
-
-
Enable Rootless Xorg using the following command:
sudo /opt/Citrix/VDA/bin/ctxreg create -k "HKLM\System\CurrentControlSet\Control\Citrix\Xorg" -t "REG_DWORD" -v "Rootless" -d "1" --force
To disable Rootless Xorg, if it's already enabled, do the following:
-
Run the following command to disable the feature:
sudo /opt/Citrix/VDA/bin/ctxreg create -k "HKLM\System\CurrentControlSet\Control\Citrix\Xorg" -t "REG_DWORD" -v "Rootless" -d "0" --force -
Remove the
cap_ipc_ownercapability from the Xorg executable using the distribution-specific commands:-
Ubuntu, Debian:
sudo setcap 'cap_ipc_owner=-ep' /usr/lib/xorg/Xorg -
RHEL, Rocky:
sudo setcap 'cap_ipc_owner=-ep' /usr/libexec/Xorg -
SUSE:
sudo setcap 'cap_ipc_owner=-ep' /usr/libexec/Xorg /usr/bin/Xorg
-