DEV Community

Big Mazzy
Big Mazzy

Posted on

Fix colord Color Profile Authentication Popup in xRDP Ubuntu 24.04

#devops #linux #ubuntu #tutorial

TL;DR: Create a colord-users group for the RDP user and add a polkit rule that allows only the specified colord actions in active sessions.

The problem

On Ubuntu 24.04 over xRDP, opening a color setting can show an authentication popup: “Authentication is required to create a color managed device.” It interrupts what should be a routine desktop task and asks for administrator authentication.

This guide applies a scoped fix. It grants the RDP user permission for two color-management actions when their session is active. It does not grant sudo access or broadly remove authentication requirements.

Why it happens

The session matters. Polkit treats a remote session as non-local, and the default colord policy asks for administrator authentication. There is no stock rule covering remote sessions for these colord actions, so the prompt appears.

The rule below checks three conditions: the requested action is one of two colord actions, the user belongs to a dedicated group, and the session is active. If all three conditions match, the action is allowed. Unrelated actions still follow their existing policies.

The session ID, user name, and numeric IDs shown in the examples are placeholders. Use the session ID and RDP user that apply to your system; the sample output illustrates the expected format.

Step-by-step fix

  1. Check the current session ID: 
   echo $XDG_SESSION_ID
Enter fullscreen mode Exit fullscreen mode

Example output:

   4
Enter fullscreen mode Exit fullscreen mode
  1. Inspect the session’s remote status and type. Replace 4 with the session ID from the previous step if needed: 
   loginctl show-session 4 -p Remote -p Type
Enter fullscreen mode Exit fullscreen mode

Example output:

   Remote=yes
   Type=x11
Enter fullscreen mode Exit fullscreen mode

Remote=yes confirms that this session is remote. The output’s session ID and session properties are examples; your values may differ.

  1. Create the dedicated group: 
   sudo groupadd colord-users
Enter fullscreen mode Exit fullscreen mode
  1. Add only the RDP user to that group. Replace rdpuser with the account used to log in over RDP: 
   sudo usermod -aG colord-users rdpuser
Enter fullscreen mode Exit fullscreen mode
  1. Check the account’s group membership: 
   id rdpuser
Enter fullscreen mode Exit fullscreen mode

Example output:

   uid=1002(rdpuser) gid=1002(rdpuser) groups=1002(rdpuser),1004(colord-users)
Enter fullscreen mode Exit fullscreen mode

The numeric IDs and account details in this sample are placeholders. Confirm that colord-users appears in the groups list.

  1. Create /etc/polkit-1/rules.d/50-colord-xrdp.rules with exactly this content: 
   polkit.addRule(function(action, subject) {
   var ok = ["org.freedesktop.color-manager.create-device", "org.freedesktop.color-manager.create-profile"];
   if (ok.indexOf(action.id) != -1 && subject.isInGroup("colord-users") && subject.active)
   return polkit.Result.YES;
   });
Enter fullscreen mode Exit fullscreen mode

This rule allows the two listed colord actions for members of colord-users only while their session is active.

  1. Log out of the desktop session and back in over RDP. The new group membership takes effect in a fresh login session, so reconnect before checking the permission.

How to verify

After logging in again, check the create-device action:

A=org.freedesktop.color-manager.create-device
pkcheck -a $A -p $$; echo $?
Enter fullscreen mode Exit fullscreen mode

Example output:

0
Enter fullscreen mode Exit fullscreen mode

A result of 0 means colord is allowed for this action in the current session.

Then check an unrelated systemd action:

B=org.freedesktop.systemd1.manage-units
pkcheck -a $B -p $$; echo $?
Enter fullscreen mode Exit fullscreen mode

Example output:

1
Enter fullscreen mode Exit fullscreen mode

A result of 1 here means administrator authentication is still required for that unrelated action. The PID and result values shown are examples; the PID is supplied by $$ in your shell. Together, these checks show that the rule grants the intended colord permission without allowing systemd unit management.

Common mistakes

Do not add every desktop user to colord-users; the rule is intended for the RDP account that needs the color settings. Check the account name carefully when adding it to the group.

Do not skip logging out and back in after changing group membership. An existing session may not reflect the new membership, which can make a correct rule appear ineffective.

Keep the rule’s action list, group check, and active-session check intact. Removing a condition broadens who can use the exception or when it applies. If the create-device check does not return 0, confirm the session is active, the RDP account belongs to colord-users, and the file contents match the rule above.

If you want a clean Ubuntu box to practice on, PowerVPS is a reasonable choice: https://powervps.net/?from=32

Watch more fixes on Server Lab: https://www.youtube.com/channel/UCov7rfWAnS4c2wF5E9V1Yag

Top comments (0)