3 files changed, 15 insertions, 12 deletions
diff --git a/unix/vncserver/CMakeLists.txt b/unix/vncserver/CMakeLists.txt
index ae69dc09..ed259c22 100644
--- a/unix/vncserver/CMakeLists.txt
+++ b/unix/vncserver/CMakeLists.txt
@@ -1,5 +1,8 @@
 add_executable(vncsession vncsession.c)
-target_link_libraries(vncsession ${PAM_LIBS} ${SELINUX_LIBS})
+target_include_directories(vncsession SYSTEM PRIVATE ${PAM_INCLUDE_DIRS})
+target_include_directories(vncsession SYSTEM PRIVATE ${SELINUX_INCLUDE_DIRS})
+target_link_libraries(vncsession ${PAM_LIBRARIES})
+target_link_libraries(vncsession ${SELINUX_LIBRARIES})
 
 configure_file(vncserver@.service.in vncserver@.service @ONLY)
 configure_file(vncsession-start.in vncsession-start @ONLY)
diff --git a/unix/vncserver/selinux/vncsession.te b/unix/vncserver/selinux/vncsession.te
index 4dbf687e..2ce4fc81 100644
--- a/unix/vncserver/selinux/vncsession.te
+++ b/unix/vncserver/selinux/vncsession.te
@@ -34,17 +34,13 @@ allow vnc_session_t self:capability { chown dac_override dac_read_search fowner
 allow vnc_session_t self:process { getcap setexec setrlimit setsched };
 allow vnc_session_t self:fifo_file rw_fifo_file_perms;
 
-optional_policy(`
-        gen_require(`
-                type sysctl_fs_t;
-        ')
-        allow vnc_session_t sysctl_fs_t:dir search;
-        allow vnc_session_t sysctl_fs_t:file { getattr open read };
-')
-
 allow vnc_session_t vnc_session_var_run_t:file manage_file_perms;
 files_pid_filetrans(vnc_session_t, vnc_session_var_run_t, file)
 
+# Allow access to /proc/sys/fs/nr_open
+# Needed when the nofile limit is set to unlimited.
+kernel_read_fs_sysctls(vnc_session_t)
+
 # Allowed to create ~/.local
 optional_policy(`
 	gnome_filetrans_home_content(vnc_session_t)
diff --git a/unix/vncserver/vncsession.c b/unix/vncserver/vncsession.c
index 0830e81a..79683ff9 100644
--- a/unix/vncserver/vncsession.c
+++ b/unix/vncserver/vncsession.c
@@ -134,7 +134,7 @@ begin_daemon(void)
 static void
 finish_daemon(void)
 {
-    write(daemon_pipe_fd, "+", 1);
+    if (write(daemon_pipe_fd, "+", 1) == -1) {}
     close(daemon_pipe_fd);
     daemon_pipe_fd = -1;
 }
@@ -545,8 +545,12 @@ run_script(const char *username, const char *display, char **envp)
 
     switch_user(pwent->pw_name, pwent->pw_uid, pwent->pw_gid);
 
-    if (chdir(pwent->pw_dir) == -1)
-        chdir("/");
+    if (chdir(pwent->pw_dir) == -1) {
+        syslog(LOG_CRIT, "chdir(\"%s\") failed: %s", pwent->pw_dir, strerror(errno));
+        // fallback to "/"
+        if (chdir("/") == -1)
+            syslog(LOG_CRIT, "chdir(\"%s\") failed: %s", "/", strerror(errno));
+    }
 
     close_fds();