Add patch to disable global shortcuts at login (#2171332)

plasma-workspace.spec

@@ -28,7 +28,7 @@
 Name:    plasma-workspace
 Summary: Plasma workspace, applications and applets
 Version: 5.27.0
-Release: 3%{?dist}
+Release: 4%{?dist}
 
 License: GPLv2+
 URL:     https://invent.kde.org/plasma/%{name}
@@ -65,6 +65,9 @@ Source41:       spice-vdagent.conf
 ## upstream Patches (master branch)
 
 ## upstreamable Patches
+# Ensure global shortcuts don't work in login sessions
+# From: https://invent.kde.org/plasma/plasma-workspace/-/merge_requests/2650
+Patch050:       sddm-wayland-session-Disable-global-shortcuts.patch
 
 ## downstream Patches
 # default to folderview (instead of desktop) containment, see also
@@ -787,6 +790,9 @@ fi
 
 
 %changelog
+* Mon Feb 20 2023 Neal Gompa <ngompa@fedoraproject.org> - 5.27.0-4
+- Add patch to disable global shortcuts at login (#2171332)
+
 * Wed Feb 15 2023 Marc Deop <marcdeop@fedoraproject.org> - 5.27.0-3
 - Add wayland-protocols-devel BR
 - Add kf5-libkexiv2-devel BR

sddm-wayland-session-Disable-global-shortcuts.patch

@@ -0,0 +1,29 @@
+From 7e4159e46f816dc65ac62eae37b15c882f0c8064 Mon Sep 17 00:00:00 2001
+From: Neal Gompa <ngompa@kde.org>
+Date: Mon, 20 Feb 2023 10:28:05 -0500
+Subject: [PATCH] sddm-wayland-session: Disable global shortcuts
+
+By default, KWin starts up with global shortcuts enabled.
+This is very dangerous for the login screen, since it becomes
+possible to bypass the login prompt using default key bindings.
+
+This change closes that hole and ensures this does not work.
+
+Reference: https://bugzilla.redhat.com/2171332
+---
+ sddm-wayland-session/plasma-wayland.conf | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sddm-wayland-session/plasma-wayland.conf b/sddm-wayland-session/plasma-wayland.conf
+index c1f21a5ae..6781ac46c 100644
+--- a/sddm-wayland-session/plasma-wayland.conf
++++ b/sddm-wayland-session/plasma-wayland.conf
+@@ -4,4 +4,4 @@ GreeterEnvironment=QT_WAYLAND_SHELL_INTEGRATION=layer-shell
+ InputMethod=
+ 
+ [Wayland]
+-CompositorCommand=kwin_wayland --no-lockscreen --inputmethod maliit-keyboard --locale1
++CompositorCommand=kwin_wayland --no-global-shortcuts --no-lockscreen --inputmethod maliit-keyboard --locale1
+-- 
+2.39.2
+