From 73b767d8078e32b4de53a42036c03e073ff16fa2 Mon Sep 17 00:00:00 2001 From: 0xFEEDC0DE64 Date: Sat, 31 Oct 2026 12:24:41 +0100 Subject: [PATCH] Bind VNC exclusively to IPv4 loopback and test listeners --- chart/files/supervisord.conf | 2 +- test.py | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/chart/files/supervisord.conf b/chart/files/supervisord.conf index 129dedb..d034545 100644 --- a/chart/files/supervisord.conf +++ b/chart/files/supervisord.conf @@ -10,7 +10,7 @@ command=/usr/bin/Xvfb :0 -screen 0 %(ENV_RES)s -nolisten tcp autorestart=true [program:x11vnc] -command=/usr/bin/x11vnc -localhost -forever -shared -nopw +command=/usr/bin/x11vnc -localhost -listen 127.0.0.1 -no6 -forever -shared -nopw autorestart=true [program:novnc] diff --git a/test.py b/test.py index 4bb20b3..609acfb 100755 --- a/test.py +++ b/test.py @@ -76,6 +76,9 @@ with tempfile.TemporaryDirectory(prefix='oldipmi-test-') as tmp: assert data, 'VNC handshake closed early' received += data assert b'101 Switching Protocols' in received + listeners = run('podman', 'exec', cid, 'netstat', '-lntp') + vnc_listeners = [line.split()[3] for line in listeners.splitlines() if 'x11vnc' in line] + assert vnc_listeners and all(address.startswith('127.0.0.1:') for address in vnc_listeners), listeners status = run('podman', 'exec', cid, 'cat', '/proc/1/status') assert 'NoNewPrivs:\t1' in status and 'CapEff:\t0000000000000000' in status assert run('podman', 'exec', cid, 'id', '-u') != '0'