system-wide script for remote graphical sessions in ubuntu 22.04 with xfce

The main issue here is that there are many ways that graphical login is managed and some of those might read /etc/profile, or /etc/profile.d files, or ~/.profile, but not all are guaranteed to. So I would try adding the command to the user's ~/.profile files, but that isn't guaranteed to work.

Instead, I would modify the user-creation process, using the /etc/skel system or configuring through /etc/adduser.conf, to ensure that the symlink is created when the user is.

Now, you very correctly mention that users do weird stuff, and that's a very valid concern. So even if you create the link on user creation, you also want to protect against your users doing something, um, creative, like deleting it. I can think of a few workarounds:

1. Move the link into a directory, and make that directory undeletable:

   ## create a directory with rwxr-xr-x permissions, owned by root
   $ sudo mkdir /home/$username/links
   $ sudo ln -sf  /path/to/folder /home/$username/links/
   

   Now, your users cannot delete the symlink, but it is no longer directly under ~/.

2. Have a cron job run every minute that creates the symlink.

   Make a script that goes through all homes and creates the symlink:

   #!/bin/bash
   
   for userhome in /home/*; do
     [[ -l "$userhome/folder" ]] || ln -s /path/to/folder "$userhome"
   done
   

   Or, if you also want to protect against your users uing the same symlink name to point somewhere else, just:

   #!/bin/bash
   
   for userhome in /home/*; do
     ln -sf /path/to/folder "$userhome"
   done
   

   Save that as fixlinks.sh and add this to /etc/crontab:

   * *    * * *   root    /path/to/fixlinks.sh
   

   This is ugly, and cumbersome, but it will at least ensure that nobody is left without the link for more than a minute or so.

3. Use a bind mount.

   Forget symlinks, instead, bind mount the directory into another directory inside the user's $HOME. You would, again, need to do this as part of the user creation process for new users. The idea is something like this:

   sudo mkdir /home/$username/links/
   sudo mount --bind /path/to/folder /home/$username/links/
   

   You could add a @reboot cron job that sets all this up, or use /etc/fstab for the mounting. Now, the user has a ~/links directory which is the /path/to/folder directory. They can use it, but they can't delete or unmount it:

   $ mkdir link
   $ sudo mount --bind /test/ link
   $ rm -r link
   rm: cannot remove 'link': Device or resource busy
   $ umount link
   umount: /home/terdon/link: must be superuser to unmount.
   

One of the workarounds might be a solution for you, depending on the details of what you're doing.