This line affects every command run by the user, unlike everything else
in our policy which is just for vncserver/vncsession. It's easy to miss
this so add a comment pointing it out.
Allow vnc session labeled with SELinux vnc_session_t domain to create
directory in user homedir ~/.vnc labeled with SELinux label xdm_home_t.
Because also process vncpasswd creates ~/.vnc directory, file transition that
userdomain attribute SELinux domain (label for the process) can create the
directory with the same label needs to be added.
userdomain attribute contains following SELinux types:
auditadm_t
dbadm_t
guest_t
logadm_t
secadm_t
staff_t
staff_wine_t
sysadm_t
unconfined_t
user_t
user_wine_t
webadm_t
xguest_t
Signed-off-by: Lukas Vrabec <lvrabec@redhat.com>
vncserver: Display check should confirm UNIX domain socket is still valid
If the X server is not shut down cleanly, it can leave UNIX domain
sockets around that "vncserver" has previously mis-identified as
evidence that the display number is still in use.
Instead of checking for existence of /tmp/.X11-unix/X<n>, the code
will now attempt to connect to the socket to confirm that there is a
server process listening on this UNIX domain socket. This will
eliminate false positives in the case the UNIX domain socket still
exists but is not associated with a listening Xorg server. The Xorg
server does not have a problem with fixing this file when it next
starts up. It is only important to avoid using the port if it is still
in use.
vncserver: Display check should be re-factored for Perl 5
The display check and related setup code was complex due to
compatibility with Perl 4. This included different ways of obtaining
system constants and building system data structures. Perl 5 provides
direct constants and utility methods to abstract this out of the
vncserver code.
vncserver: Display check should confirm lock file is still valid
If the X server is not shut down cleanly, it may leave lock files
around that "vncserver" has previously mis-identified as evidence that
the display number is still in use.
Instead of checking for existence of /tmp/.X<n>-lock, the code will
now extract the PID from the lock file and confirm that a process
exists with the same PID. This will eliminate false positives in the
case that this file references a PID that no longer exists. The Xorg
server does not have a problem with fixing this file when it next
starts up. It is only important to avoid using the port if it is still
in use.
vncserver: Display check should avoid duplicate code
The display check had duplicate code to first check if the X11 port is
not in use, and then check that the RFB port is not in use. Eliminate
the duplicate code by using a for-loop.
vncserver: Display check should use named variables
Several calculated values such as file paths and port numbers were
hard coded within strings or expressions, sometimes multiple
times. These values should be extracted into named variables to
improve self-documentation and avoid accidental divergence.
vncserver: Display check should check for lock file first
Checking for the existence of `/tmp/.X<n>-lock` is a fast read-only
operation, while calls to bind() or connect() are more expensive and
may have side effects. Perform the fast operation first.
The check for existence of `/usr/spool/sockets/X11/<n>` has been
removed. This file is only relevant on HP-UX, and TigerVNC dropped
support for HP-UX in commit 31e5aa3.
It's quite easy to make a mistake and add an additional space when configuring
users in the vncserver.users config file. You will then get an error that the
user doesn't exist and it's hard to spot the mistake. Same applies for a space
before the display number.
vncsession-start is running in SELinux vnc_session_t domain because of
"SELinuxContext=system_u:system_r:vnc_session_t:s0" option in systemd
vncserver@.service unit file. vncsession-start executing binary
vncsession with SELinux label/type vnc_session_t. This access was not
allowed in vncsession policy.
It seems like many of the X11 operations can end up with no pixels
actually changing. So instead of discovering and adding workarounds for
each individually we'll just check very region added if it's empty.
Running as a service on a SELinux system requires rules so we can
transition to our own context. We also need the proper permissions
to start new user sessions.
This sets up a more correct session as there are key tasks that
need to be performed by PAM. E.g. systemd will allocate cgroups
and start base services.
In order to easily handle this as a system service the mapping of
displays is now done via a configuration file.
We need to be started as a system service for things to work correctly
anyway, so delegate the work of starting and stopping things to the
system service manager (e.g. systemd).
It is the most common init system these days so it should not be
hidden in the contrib/ directory.
This also removes all old SysV files from the contrib packages.
This allows Xvnc to build with xorg-server 1.20.7, which requires OS
layers to implement a ddxInputThreadInit function when configured with
--enable-input-thread (the default).
relevant xorg-server commit: e3f26605d8
When used with -fg we expect the startup script to remain running until
the session is over. This will not happen if the session command is put
in the background using &.
Don't allow subclasses to just override dimensions or buffer details
directly and instead force them to go via methods. This allows us
to do sanity checks on the new values and catch bugs and attacks.
We now filter incoming data, which means we can start assuming the
clipboard data is always null terminated. This allows us to clean
up a lot of the internal handling.
This is required by the protocol so we should make sure it is
enforced. We are tolerant of clients that violate this though and
convert incoming clipboard data.
There might be multiple clients using a single IP (e.g. NAT), which
can make the blacklist do more harm than good. So add a setting to
disable it if needed.
Don't build xserver with -I$(includedir) as it breaks cross-compiling
This is where to install headers to, not where to find headers to
build against. Toolchains should know where to locate their system
headers while non-system headers should be found using
pkg-config. Users with bizarre setups where the toolchain really
cannot find the system headers should set CPPFLAGS.