gnome-remote-desktop user service is always running

This bug was fixed in the package gnome-remote-desktop - 42.1.1-2ubuntu1

---------------
gnome-remote-desktop (42.1.1-2ubuntu1) kinetic; urgency=medium

  * Merge with Debian. Remaining change:
    - Lower gnome-control-center dependency to 41

gnome-remote-desktop (42.1.1-2) unstable; urgency=high

  * Don't automatically enable the systemd user service (LP: #1973028)
  * Add postinst to remove the automatic enabling of the user service
  * debian/control: Lower mutter dependency so that these fixes reach
    Testing sooner

gnome-remote-desktop (42.1.1-1) unstable; urgency=medium

  * New upstream release (LP: #1970662)
    - Fixes black screen with virtio on qemu (LP: #1971195)
  * Drop all patches: applied in new release
  * Depend on libmutter instead of gnome-shell | budgie-desktop
    - This is a more accurate dependency
  * Require libmutter 42.1 for Nvidia fixes
  * Depend on fuse3 (Closes: #998846) (LP: #1970411)

 -- Jeremy Bicha <email address hidden> Thu, 12 May 2022 15:21:47 -0400

I am not sure I agree with the statement that this is "harmless" for the user service to be running if remote desktop sharing is not enabled - on my jammy system I can see the RDP port open thanks to gnome-remote-desktop:

$ ss -tlp | grep gnome-remote
LISTEN 0 10 *:ms-wbt-server *:* users:(("gnome-remote-de",pid=5851,fd=13))

And I have not manually enabled this - so I feel like this is potentially a security issue and should be prioritised as such for jammy.

Please use CVE-2022-1736 for the gnome-remote-desktop user service being enabled on Ubuntu.

The Debian packaging, and derivatives of both Ubuntu and Debian, for gnome-remote-desktop are probably very similar. The Debian policy strongly encourages services to be running by default after installation[1]. Ubuntu, however, strongly discourages open ports by default[2].

So, while there may be identical code in the other distributions, this may or may not be considered a vulnerability by the other distributions, based on their own policies.

Thanks

[1]: https://www.debian.org/doc/debian-policy/ch-opersys.html#managing-the-links
     "The default behaviour is to enable autostarting your package’s daemon"

[2]: https://wiki.ubuntu.com/Security/Features#ports
     "Default installations of Ubuntu must have no listening network services after initial install. Exceptions to this rule [enumerated exceptions elided]"

Hello Jeremy, or anyone else affected,

Accepted gnome-remote-desktop into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/gnome-remote-desktop/42.1.1-0ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

I installed gnome-remote-desktop 42.1.1-0ubuntu1 and verified that the Test Case completes successfully.

The verification of the Stable Release Update for gnome-remote-desktop has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

This bug was fixed in the package gnome-remote-desktop - 42.1.1-0ubuntu1

---------------
gnome-remote-desktop (42.1.1-0ubuntu1) jammy; urgency=medium

  * New upstream release (LP: #1970662)
    - Fixes black screen with virtio on qemu (LP: #1971195)
  * Drop all patches: applied in new release
  * Depend on libmutter instead of gnome-shell | budgie-desktop
    - This is a more accurate dependency
  * Require libmutter 42.1 for Nvidia fixes
  * Depend on fuse3 (Closes: #998846) (LP: #1970411)
  * Don't automatically enable the systemd user service (LP: #1973028)
  * Add postinst to remove the automatic enabling of the user service

 -- Jeremy Bicha <email address hidden> Tue, 17 May 2022 14:27:16 -0400