Four small exposures, none a same-UID boundary (which the design does not claim), all
about other local users and wrong install hints:
- The host-wide display-allocation lock sat at a predictable name in world-writable
/tmp, where any local user could pre-create or squat it. It now lives under
XDG_RUNTIME_DIR (else ~/.cache), created 0700; still host-wide, outside every profile
home, because all profiles allocate from one band.
- lease.py hand-rolled mkdir + plain writes, so a takeover recorded before start() ever
ran left bot-desktop/ 0755 and lease.json / lease.lock 0644 under the umask — who
holds the screen and the lock the RFB bridge serialises on, readable by everyone. It
now uses secure_parent_dir and creates every file 0600 via an opener; the fcntl-less
(Windows) fallback is untouched.
- launcher.sh passed the X cookie on xauth's argv, visible in ps to other local UIDs.
The cookie is now fed on stdin through `xauth source -`.
- The Fedora map named tigervnc-server-minimal (only a Provides of tigervnc-x11-server,
which actually ships Xvnc) and dbus-x11 for dbus-run-session (dbus-daemon owns it;
dbus-x11 ships dbus-launch). Both BINARY_PACKAGES and PACKAGES are corrected together.
a047156df7