initial package creation

Signed-off-by: Toshaan Bharvani <toshaan@powerel.org>

SOURCES/0001-rpath-hack.patch

@@ -0,0 +1,24 @@
+From 2489f2f38eb32d9dd03718a36cbdbdf13d2f8b9b Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax@redhat.com>
+Date: Thu, 12 Nov 2015 11:10:11 -0500
+Subject: [PATCH] rpath hack
+
+Normally, rpath is undesirable.  But for the X server we _know_ we need
+Mesa's libGL, which will always be in %{_libdir}, and not any third-party
+libGL that may be configured using ld.so.conf.
+
+---
+ configure.ac       | 1 +
+ 1 files changed, 1 insertions(+), 0 deletion(-)
+
+diff --git a/configure.ac b/configure.ac
+index fa15a2d..a5af1e0 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1261,6 +1261,7 @@ AM_CONDITIONAL(GLX, test "x$GLX" = xyes)
+ 
+ AM_CONDITIONAL(HASHTABLE, test "x$HASHTABLE" = xyes)
+ 
++GLX_SYS_LIBS="$GLX_SYS_LIBS -Wl,-rpath=\$(libdir)"
+ AC_SUBST([GLX_DEFINES])
+ AC_SUBST([GLX_SYS_LIBS])

SOURCES/10-libvnc.conf

@@ -0,0 +1,19 @@
+# This file contains configuration of libvnc.so module
+#
+# To get libvnc.so module working, do this:
+# 1. run "vncpasswd" from tigervnc-server package as root user
+# 2. uncomment configuration lines below
+#
+# Please note you can specify any option which Xvnc accepts.
+# Refer to `Xvnc -help` output for detailed list of options.
+
+#Section "Module"
+#    Load "vnc"
+#EndSection
+
+#Section "Screen"
+#    Identifier "Screen0
+#    DefaultDepth 16
+#    Option "SecurityTypes" "VncAuth"
+#    Option "PasswordFile" "/root/.vnc/passwd"
+#EndSection

SOURCES/HOWTO.md

@@ -0,0 +1,110 @@
+# What has changed
+The previous Tigervnc versions had a wrapper script called `vncserver` which 
+could be run as a user manually to start *Xvnc* process. The usage was quite 
+simple as you just run
+```
+$ vncserver :x [vncserver options] [Xvnc options]
+```
+and that was it. While this was working just fine, there were issues when users
+wanted to start a Tigervnc server using *systemd*. For these reasons things were 
+completely changed and there is now a new way how this all is supposed to work.
+
+ # How to start Tigervnc server
+ 
+## Add a user mapping
+With this you can map a user to a particular port. The mapping should be done in 
+`/etc/tigervnc/vncserver.users` configuration file. It should be pretty 
+straightforward once you open the file as there are some examples, but basically
+the mapping is in form
+```
+:x=user
+```
+For example you can have
+```
+:1=test
+:2=vncuser
+```
+
+## Configure Xvnc options
+To configure Xvnc parameters, you need to go to the same directory where you did
+the user mapping and open `vncserver-config-defaults` configuration file. This 
+file is for the default Xvnc configuration and will be applied to every user 
+unless any of the following applies:
+* The user has its own configuration in `$HOME/.vnc/config`
+* The same option with different value is configured in 
+  `vncserver-config-mandatory` configuration file, which replaces the default 
+  configuration and has even a higher priority than the per-user configuration.
+  This option is for system administrators when they want to force particular 
+  *Xvnc* options.
+
+Format of the configuration file is also quite simple as the configuration is
+in form of
+```
+option=value
+option
+```
+for example
+```
+session=gnome
+securitytypes=vncauth,tlsvnc
+desktop=sandbox
+geometry=2000x1200
+localhost
+alwaysshared
+```
+### Note:
+There is one important option you need to set and that option is the session you
+want to start. E.g when you want to start GNOME desktop, then you have to use
+```
+session=gnome
+```
+which should match the name of a session desktop file from `/usr/share/xsessions`
+directory.
+
+## Set VNC password
+You need to set a password for each user in order to be able to start the 
+Tigervnc server. In order to create a password, you just run
+```
+$ vncpasswd
+```
+as the user you will be starting the server for. 
+### Note:
+If you were using Tigervnc before for your user and you already created a 
+password, then you will have to make sure the `$HOME/.vnc` folder created by 
+`vncpasswd` will have the correct *SELinux* context. You either can delete this 
+folder and recreate it again by creating the password one more time, or 
+alternatively you can run
+```
+$ restorecon -RFv /home/<USER>/.vnc
+```
+
+## Start the Tigervnc server
+Finally you can start the server using systemd service. To do so just run
+```
+$ systemctl start vncserver@:x
+```
+as root or
+```
+$ sudo systemctl start vncserver@:x
+```
+as a regular user in case it has permissions to run `sudo`. Don't forget to 
+replace the `:x` by the actual number you configured in the user mapping file. 
+Following our example by running
+```
+$ systemctl start vncserver@:1
+```
+you will start a Tigervnc server for user `test` with a GNOME session.
+
+### Note:
+If you were previously using Tigervnc and you were used to start it using 
+*systemd* then you will need to remove previous *systemd* configuration files,
+those you most likely copied to `/etc/systemd/system/vncserver@.service`, 
+otherwise this service file will be preferred over the new one installed with
+latest Tigervnc.
+
+# Limitations
+You will not be able to start a Tigervnc server for a user who is already
+logged into a graphical session. Avoid running the server as the `root` user as
+it's not a safe thing to do. While running the server as the `root` should work 
+in general, it's not recommended to do so and there might be some things which
+are not working properly.

SOURCES/tigervnc-argb-runtime-ximage-byteorder-selection.patch

@@ -0,0 +1,43 @@
+From 7ab92639848a6059e2b6b88499b008b9606f3af6 Mon Sep 17 00:00:00 2001
+From: johnmartin-oracle <55413843+johnmartin-oracle@users.noreply.github.com>
+Date: Thu, 27 Aug 2020 22:30:23 -0400
+Subject: [PATCH] Update Surface_X11.cxx
+
+Runtime sellection of ARGB  XImage byte order
+---
+ vncviewer/Surface_X11.cxx | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/vncviewer/Surface_X11.cxx b/vncviewer/Surface_X11.cxx
+index 6562634dc..8944c3f71 100644
+--- a/vncviewer/Surface_X11.cxx
++++ b/vncviewer/Surface_X11.cxx
+@@ -123,17 +123,17 @@ void Surface::alloc()
+   // we find such a format
+   templ.type = PictTypeDirect;
+   templ.depth = 32;
+-#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
+-  templ.direct.alpha = 0;
+-  templ.direct.red   = 8;
+-  templ.direct.green = 16;
+-  templ.direct.blue  = 24;
+-#else
+-  templ.direct.alpha = 24;
+-  templ.direct.red   = 16;
+-  templ.direct.green = 8;
+-  templ.direct.blue  = 0;
+-#endif
++  if (XImageByteOrder(fl_display) == MSBFirst) {
++    templ.direct.alpha = 0;
++    templ.direct.red   = 8;
++    templ.direct.green = 16;
++    templ.direct.blue  = 24;
++  } else {
++    templ.direct.alpha = 24;
++    templ.direct.red   = 16;
++    templ.direct.green = 8;
++    templ.direct.blue  = 0;
++  }
+   templ.direct.alphaMask = 0xff;
+   templ.direct.redMask = 0xff;
+   templ.direct.greenMask = 0xff;

SOURCES/tigervnc-correctly-start-vncsession-as-daemon.patch

@@ -0,0 +1,13 @@
+diff --git a/unix/vncserver/vncsession.c b/unix/vncserver/vncsession.c
+index 2b47f5f5..f78c096f 100644
+--- a/unix/vncserver/vncsession.c
++++ b/unix/vncserver/vncsession.c
+@@ -99,7 +99,7 @@ begin_daemon(void)
+         return -1;
+     }
+ 
+-    if (pid == 0)
++    if (pid != 0)
+         _exit(0);
+ 
+     /* Send all stdio to /dev/null */

SOURCES/tigervnc-let-user-know-about-not-using-view-only-password.patch

@@ -0,0 +1,22 @@
+From dbf76d2ee8da157c2c2970c937bcc0ed9ef08a6f Mon Sep 17 00:00:00 2001
+From: Jan Grulich <jgrulich@redhat.com>
+Date: Tue, 25 May 2021 14:14:33 +0200
+Subject: [PATCH] Let user know that a view-only password is not used
+
+---
+ unix/vncpasswd/vncpasswd.cxx | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/unix/vncpasswd/vncpasswd.cxx b/unix/vncpasswd/vncpasswd.cxx
+index 3055223ef..8f3649fe9 100644
+--- a/unix/vncpasswd/vncpasswd.cxx
++++ b/unix/vncpasswd/vncpasswd.cxx
+@@ -160,6 +160,8 @@ int main(int argc, char** argv)
+     char yesno[3];
+     if (fgets(yesno, 3, stdin) != NULL && (yesno[0] == 'y' || yesno[0] == 'Y')) {
+       obfuscatedReadOnly = readpassword();
++    } else {
++      fprintf(stderr, "A view-only password is not used\n");
+     }
+
+     FILE* fp = fopen(fname,"w");

SOURCES/tigervnc-passwd-crash-with-malloc-checks.patch

@@ -0,0 +1,38 @@
+From 5d834359bef6727df82cf4f2c2f3f255145f7785 Mon Sep 17 00:00:00 2001
+From: Jan Grulich <jgrulich@redhat.com>
+Date: Tue, 25 May 2021 14:18:48 +0200
+Subject: [PATCH] CharArray: pre-fill empty array with zeroes
+
+CharArray should always be null-terminated. There is a potential
+scenario where this all might lead to crash. In Password we call
+memset(), passing length of the array we get with strlen(), but
+this won't return correct value when the array is not properly
+null-terminated.
+---
+ common/rfb/util.h | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/common/rfb/util.h b/common/rfb/util.h
+index 3100f90fd..71caac426 100644
+--- a/common/rfb/util.h
++++ b/common/rfb/util.h
+@@ -52,14 +52,17 @@ namespace rfb {
+     CharArray(char* str) : buf(str) {} // note: assumes ownership
+     CharArray(size_t len) {
+       buf = new char[len]();
++      memset(buf, 0, len);
+     }
+     ~CharArray() {
+-      delete [] buf;
++      if (buf) {
++        delete [] buf;
++      }
+     }
+     void format(const char *fmt, ...) __printf_attr(2, 3);
+     // Get the buffer pointer & clear it (i.e. caller takes ownership)
+     char* takeBuf() {char* tmp = buf; buf = 0; return tmp;}
+-    void replaceBuf(char* b) {delete [] buf; buf = b;}
++    void replaceBuf(char* b) {if (buf) delete [] buf; buf = b;}
+     char* buf;
+   private:
+     CharArray(const CharArray&);

SOURCES/tigervnc-root-user-selinux-context.patch

@@ -0,0 +1,26 @@
+From faf81b4b238e24fe29eb53f885a25367e212dd7b Mon Sep 17 00:00:00 2001
+From: Zdenek Pytela <zpytela@redhat.com>
+Date: Mon, 7 Feb 2022 10:45:41 +0100
+Subject: [PATCH] SELinux: use /root/.vnc in file context specification
+
+Instead of HOME_ROOT/.vnc, /root/.vnc should be used
+for user root's home to specify default file context
+as HOME_ROOT actually means base for home dirs (usually /home).
+---
+ unix/vncserver/selinux/vncsession.fc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/unix/vncserver/selinux/vncsession.fc b/unix/vncserver/selinux/vncsession.fc
+index ae768ba..5c03e46 100644
+--- a/unix/vncserver/selinux/vncsession.fc
++++ b/unix/vncserver/selinux/vncsession.fc
+@@ -18,7 +18,7 @@
+ #
+
+ HOME_DIR/\.vnc(/.*)?      gen_context(system_u:object_r:xdm_home_t,s0)
+-HOME_ROOT/\.vnc(/.*)?      gen_context(system_u:object_r:xdm_home_t,s0)
++/root/\.vnc(/.*)?      gen_context(system_u:object_r:xdm_home_t,s0)
+
+ /usr/sbin/vncsession			--	gen_context(system_u:object_r:vnc_session_exec_t,s0)
+ /usr/libexec/vncsession-start		--	gen_context(system_u:object_r:vnc_session_exec_t,s0)
+

SOURCES/tigervnc-selinux-missing-compression-and-correct-location.patch

@@ -0,0 +1,38 @@
+From 6125695b80f6a43002f454786115b0a6c1730831 Mon Sep 17 00:00:00 2001
+From: Jan Grulich <jgrulich@redhat.com>
+Date: Mon, 17 May 2021 13:44:32 +0200
+Subject: [PATCH 1/2] SELinux: Add missing compression and install policy to
+ correct directory
+
+---
+ unix/vncserver/selinux/Makefile | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/unix/vncserver/selinux/Makefile b/unix/vncserver/selinux/Makefile
+index 7497bf846..b23f20f60 100644
+--- a/unix/vncserver/selinux/Makefile
++++ b/unix/vncserver/selinux/Makefile
+@@ -10,15 +10,18 @@
+ PREFIX=/usr
+ DATADIR=$(PREFIX)/share
+
+-all: vncsession.pp
++all: vncsession.pp.bz2
++
++%.pp.bz2: %.pp
++	bzip2 -9 $^
+
+ %.pp: %.te
+ 	make -f $(DATADIR)/selinux/devel/Makefile $@
+
+ clean:
+-	rm -f *.pp
++	rm -f *.pp *.pp.bz2
+ 	rm -rf tmp
+
+-install: vncsession.pp
+-	mkdir -p $(DESTDIR)$(DATADIR)/selinux/packages
+-	install vncsession.pp $(DESTDIR)$(DATADIR)/selinux/packages/vncsession.pp
++install: vncsession.pp.bz2
++	mkdir -p $(DESTDIR)$(DATADIR)/selinux/packages/targeted/
++	install vncsession.pp.bz2 $(DESTDIR)$(DATADIR)/selinux/packages/targeted/vncsession.pp.bz2

SOURCES/tigervnc-selinux-policy-improvements.patch

@@ -0,0 +1,183 @@
+From 386542e6d50eeaa68aa91f821c0725ddd0ab9b2a Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Tue, 18 May 2021 12:23:15 +0200
+Subject: [PATCH] selinux: Fix issues reported by SELint
+
+Style guide [1] issues only. No impact on policy functionality.
+
+[1] - https://github.com/TresysTechnology/refpolicy/wiki/StyleGuide
+---
+ unix/vncserver/selinux/vncsession.te | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/unix/vncserver/selinux/vncsession.te b/unix/vncserver/selinux/vncsession.te
+index a773fed39..63ad8a85f 100644
+--- a/unix/vncserver/selinux/vncsession.te
++++ b/unix/vncserver/selinux/vncsession.te
+@@ -17,7 +17,7 @@
+ #  USA.
+ #
+
+-policy_module(vncsession, 1.0.0);
++policy_module(vncsession, 1.0.0)
+
+ gen_require(`
+     attribute userdomain;
+@@ -42,8 +42,8 @@ can_exec(vnc_session_t, vnc_session_exec_t)
+ userdom_spec_domtrans_all_users(vnc_session_t)
+ userdom_signal_all_users(vnc_session_t)
+
+-allow vnc_session_t self:capability { kill chown dac_override dac_read_search fowner setgid setuid sys_resource };
+-allow vnc_session_t self:process { getcap setsched setexec setrlimit };
++allow vnc_session_t self:capability { chown dac_override dac_read_search fowner kill setgid setuid sys_resource };
++allow vnc_session_t self:process { getcap setexec setrlimit setsched };
+ allow vnc_session_t self:fifo_file rw_fifo_file_perms;
+
+ manage_files_pattern(vnc_session_t, xdm_home_t, xdm_home_t)
+@@ -65,4 +65,3 @@ logging_append_all_logs(vnc_session_t)
+
+ mcs_process_set_categories(vnc_session_t)
+ mcs_killall(vnc_session_t)
+-
+From 23cf514ac265a02dc666e8651dcc579022f0da77 Mon Sep 17 00:00:00 2001
+From: Zdenek Pytela <zpytela@redhat.com>
+Date: Tue, 18 May 2021 13:31:53 +0200
+Subject: [PATCH] selinux: further style and comprehensibility improvements
+
+Sections and rules blocks reordered according to the Style guide.
+
+https://github.com/TresysTechnology/refpolicy/wiki/StyleGuide
+---
+ unix/vncserver/selinux/vncsession.te | 59 +++++++++++++++++-----------
+ 1 file changed, 36 insertions(+), 23 deletions(-)
+
+diff --git a/unix/vncserver/selinux/vncsession.te b/unix/vncserver/selinux/vncsession.te
+index 63ad8a85f..86fd6e5ef 100644
+--- a/unix/vncserver/selinux/vncsession.te
++++ b/unix/vncserver/selinux/vncsession.te
+@@ -20,48 +20,61 @@
+ policy_module(vncsession, 1.0.0)
+
+ gen_require(`
+-    attribute userdomain;
+-    type xdm_home_t;
++	attribute userdomain;
++	type xdm_home_t;
+ ')
+
+-type vnc_session_exec_t;
+-corecmd_executable_file(vnc_session_exec_t)
+ type vnc_session_t;
++type vnc_session_exec_t;
+ init_daemon_domain(vnc_session_t, vnc_session_exec_t)
+-auth_login_pgm_domain(vnc_session_t)
++can_exec(vnc_session_t, vnc_session_exec_t)
+
+ type vnc_session_var_run_t;
+ files_pid_file(vnc_session_var_run_t)
+-allow vnc_session_t vnc_session_var_run_t:file manage_file_perms;
+-files_pid_filetrans(vnc_session_t, vnc_session_var_run_t, file)
+-
+-auth_write_login_records(vnc_session_t)
+-
+-can_exec(vnc_session_t, vnc_session_exec_t)
+-
+-userdom_spec_domtrans_all_users(vnc_session_t)
+-userdom_signal_all_users(vnc_session_t)
+
+ allow vnc_session_t self:capability { chown dac_override dac_read_search fowner kill setgid setuid sys_resource };
+ allow vnc_session_t self:process { getcap setexec setrlimit setsched };
+ allow vnc_session_t self:fifo_file rw_fifo_file_perms;
+
++allow vnc_session_t vnc_session_var_run_t:file manage_file_perms;
++files_pid_filetrans(vnc_session_t, vnc_session_var_run_t, file)
++
+ manage_files_pattern(vnc_session_t, xdm_home_t, xdm_home_t)
+ manage_fifo_files_pattern(vnc_session_t, xdm_home_t, xdm_home_t)
+ manage_sock_files_pattern(vnc_session_t, xdm_home_t, xdm_home_t)
+ manage_lnk_files_pattern(vnc_session_t, xdm_home_t, xdm_home_t)
+-userdom_user_home_dir_filetrans(vnc_session_t, xdm_home_t, dir, ".vnc")
+-userdom_admin_home_dir_filetrans(vnc_session_t, xdm_home_t, dir, ".vnc")
+-
+-# This also affects other tools, e.g. vncpasswd
+-userdom_admin_home_dir_filetrans(userdomain, xdm_home_t, dir, ".vnc")
+-userdom_user_home_dir_filetrans(userdomain, xdm_home_t, dir, ".vnc")
+-
+-miscfiles_read_localization(vnc_session_t)
+
+ kernel_read_kernel_sysctls(vnc_session_t)
+
+-logging_append_all_logs(vnc_session_t)
++corecmd_executable_file(vnc_session_exec_t)
+
+ mcs_process_set_categories(vnc_session_t)
+ mcs_killall(vnc_session_t)
++
++optional_policy(`
++	auth_login_pgm_domain(vnc_session_t)
++	auth_write_login_records(vnc_session_t)
++')
++
++optional_policy(`
++	logging_append_all_logs(vnc_session_t)
++')
++
++optional_policy(`
++	miscfiles_read_localization(vnc_session_t)
++')
++
++optional_policy(`
++	userdom_spec_domtrans_all_users(vnc_session_t)
++	userdom_signal_all_users(vnc_session_t)
++
++	userdom_user_home_dir_filetrans(vnc_session_t, xdm_home_t, dir, ".vnc")
++	userdom_admin_home_dir_filetrans(vnc_session_t, xdm_home_t, dir, ".vnc")
++
++	# This also affects other tools, e.g. vncpasswd
++	gen_require(`
++		attribute userdomain;
++	')
++	userdom_admin_home_dir_filetrans(userdomain, xdm_home_t, dir, ".vnc")
++	userdom_user_home_dir_filetrans(userdomain, xdm_home_t, dir, ".vnc")
++')
+From 3c8622691abfb377b48bf3749dd629c5a7120cf4 Mon Sep 17 00:00:00 2001
+From: Zdenek Pytela <zpytela@redhat.com>
+Date: Tue, 18 May 2021 13:39:11 +0200
+Subject: [PATCH] Allow vnc_session_t manage nfs dirs and files conditionally
+
+The permissions set to manage directories and files with the nfs_t type
+is allowed when the use_nfs_home_dirs boolean is turned on.
+
+Resolves: https://github.com/TigerVNC/tigervnc/issues/1189
+---
+ unix/vncserver/selinux/vncsession.te | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/unix/vncserver/selinux/vncsession.te b/unix/vncserver/selinux/vncsession.te
+index 86fd6e5ef..46e699117 100644
+--- a/unix/vncserver/selinux/vncsession.te
++++ b/unix/vncserver/selinux/vncsession.te
+@@ -51,6 +51,11 @@ corecmd_executable_file(vnc_session_exec_t)
+ mcs_process_set_categories(vnc_session_t)
+ mcs_killall(vnc_session_t)
+
++tunable_policy(`use_nfs_home_dirs',`
++	fs_manage_nfs_dirs(vnc_session_t)
++	fs_manage_nfs_files(vnc_session_t)
++')
++
+ optional_policy(`
+ 	auth_login_pgm_domain(vnc_session_t)
+ 	auth_write_login_records(vnc_session_t)
+diff --git a/unix/vncserver/selinux/vncsession.te b/unix/vncserver/selinux/vncsession.te
+index 46e69911..f1108ec8 100644
+--- a/unix/vncserver/selinux/vncsession.te
++++ b/unix/vncserver/selinux/vncsession.te
+@@ -20,7 +20,6 @@
+ policy_module(vncsession, 1.0.0)
+
+ gen_require(`
+-	attribute userdomain;
+ 	type xdm_home_t;
+ ')
+

SOURCES/tigervnc-selinux-restore-context-in-case-of-different-policies.patch

@@ -0,0 +1,81 @@
+From d2d52704624ce841f4a392fccd82079d87ff13b6 Mon Sep 17 00:00:00 2001
+From: Jan Grulich <jgrulich@redhat.com>
+Date: Thu, 11 Nov 2021 13:52:41 +0100
+Subject: [PATCH] SELinux: restore SELinux context in case of different
+ policies
+
+---
+ CMakeLists.txt                | 13 +++++++++++++
+ unix/vncserver/CMakeLists.txt |  2 +-
+ unix/vncserver/vncsession.c   | 16 ++++++++++++++++
+ 3 files changed, 30 insertions(+), 1 deletion(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 7bf9944..85be468 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -276,6 +276,19 @@ if(UNIX AND NOT APPLE)
+   endif()
+ endif()
+
++# Check for SELinux library
++if(UNIX AND NOT APPLE)
++  check_include_files(selinux/selinux.h HAVE_SELINUX_H)
++  if(HAVE_SELINUX_H)
++    set(CMAKE_REQUIRED_LIBRARIES -lselinux)
++    set(CMAKE_REQUIRED_LIBRARIES)
++    set(SELINUX_LIBS selinux)
++    add_definitions("-DHAVE_SELINUX")
++  else()
++    message(WARNING "Could not find SELinux development files")
++  endif()
++endif()
++
+ # Generate config.h and make sure the source finds it
+ configure_file(config.h.in config.h)
+ add_definitions(-DHAVE_CONFIG_H)
+diff --git a/unix/vncserver/CMakeLists.txt b/unix/vncserver/CMakeLists.txt
+index eeb4b7b..bce1c3e 100644
+--- a/unix/vncserver/CMakeLists.txt
++++ b/unix/vncserver/CMakeLists.txt
+@@ -1,5 +1,5 @@
+ add_executable(vncsession vncsession.c)
+-target_link_libraries(vncsession ${PAM_LIBS})
++target_link_libraries(vncsession ${PAM_LIBS} ${SELINUX_LIBS})
+
+ configure_file(vncserver@.service.in vncserver@.service @ONLY)
+ configure_file(vncsession-start.in vncsession-start @ONLY)
+diff --git a/unix/vncserver/vncsession.c b/unix/vncserver/vncsession.c
+index f78c096..141f689 100644
+--- a/unix/vncserver/vncsession.c
++++ b/unix/vncserver/vncsession.c
+@@ -37,6 +37,11 @@
+ #include <sys/types.h>
+ #include <sys/wait.h>
+
++#ifdef HAVE_SELINUX
++#include <selinux/selinux.h>
++#include <selinux/restorecon.h>
++#endif
++
+ extern char **environ;
+
+ // PAM service name
+@@ -359,6 +364,17 @@ redir_stdio(const char *homedir, const char *display)
+             perror("mkdir");
+             _exit(EX_OSERR);
+         }
++
++#ifdef HAVE_SELINUX
++        int result;
++        if (selinux_file_context_verify(logfile, 0) == 0) {
++            result = selinux_restorecon(logfile, SELINUX_RESTORECON_RECURSE);
++
++            if (result < 0) {
++                syslog(LOG_WARNING, "Failure restoring SELinux context for \"%s\": %s", logfile, strerror(errno));
++            }
++        }
++#endif
+     }
+
+     if (gethostname(hostname, sizeof(hostname)) == -1) {

SOURCES/tigervnc-systemd-service.patch

@@ -0,0 +1,47 @@
+From 40f104ffe1e36df9613f8d316f616fb2b089cc86 Mon Sep 17 00:00:00 2001
+From: Jan Grulich <jgrulich@redhat.com>
+Date: Tue, 29 Sep 2020 13:37:16 +0200
+Subject: [PATCH] Use /run instead of /var/run which is just a symlink
+
+---
+ unix/vncserver/selinux/vncsession.fc | 2 +-
+ unix/vncserver/vncserver@.service.in | 2 +-
+ unix/vncserver/vncsession.c          | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/unix/vncserver/selinux/vncsession.fc b/unix/vncserver/selinux/vncsession.fc
+index 121cdd237..ae768baa4 100644
+--- a/unix/vncserver/selinux/vncsession.fc
++++ b/unix/vncserver/selinux/vncsession.fc
+@@ -23,4 +23,4 @@ HOME_ROOT/\.vnc(/.*)?      gen_context(system_u:object_r:xdm_home_t,s0)
+ /usr/sbin/vncsession			--	gen_context(system_u:object_r:vnc_session_exec_t,s0)
+ /usr/libexec/vncsession-start		--	gen_context(system_u:object_r:vnc_session_exec_t,s0)
+ 
+-/var/run/vncsession-:[0-9]*\.pid	--      gen_context(system_u:object_r:vnc_session_var_run_t,s0)
++/run/vncsession-:[0-9]*\.pid	--      gen_context(system_u:object_r:vnc_session_var_run_t,s0)
+diff --git a/unix/vncserver/vncserver@.service.in b/unix/vncserver/vncserver@.service.in
+index 584ecf4b1..5624dff76 100644
+--- a/unix/vncserver/vncserver@.service.in
++++ b/unix/vncserver/vncserver@.service.in
+@@ -36,7 +36,7 @@ After=syslog.target network.target
+ [Service]
+ Type=forking
+ ExecStart=@CMAKE_INSTALL_FULL_LIBEXECDIR@/vncsession-start %i
+-PIDFile=/var/run/vncsession-%i.pid
++PIDFile=/run/vncsession-%i.pid
+ SELinuxContext=system_u:system_r:vnc_session_t:s0
+ 
+ [Install]
+diff --git a/unix/vncserver/vncsession.c b/unix/vncserver/vncsession.c
+index 3e0c98f0f..2b47f5f55 100644
+--- a/unix/vncserver/vncsession.c
++++ b/unix/vncserver/vncsession.c
+@@ -543,7 +543,7 @@ main(int argc, char **argv)
+     }
+ 
+     snprintf(pid_file, sizeof(pid_file),
+-             "/var/run/vncsession-%s.pid", display);
++             "/run/vncsession-%s.pid", display);
+     f = fopen(pid_file, "w");
+     if (f == NULL) {
+         syslog(LOG_ERR, "Failure creating pid file \"%s\": %s",

SOURCES/tigervnc-tolerate-specifying-boolparam.patch

@@ -0,0 +1,149 @@
+From 38c6848b30cb1908171f2b4628e345fbf6727b39 Mon Sep 17 00:00:00 2001
+From: Pierre Ossman <ossman@cendio.se>
+Date: Fri, 18 Sep 2020 10:44:32 +0200
+Subject: [PATCH] Tolerate specifying -BoolParam 0 and similar
+
+This is needed by vncserver which doesn't know which parameters are
+boolean, and it cannot use the -Param=Value form as that isn't tolerated
+by the Xorg code.
+---
+ unix/vncserver/vncserver.in    |  8 ++++----
+ unix/xserver/hw/vnc/RFBGlue.cc | 16 ++++++++++++++++
+ unix/xserver/hw/vnc/RFBGlue.h  |  1 +
+ unix/xserver/hw/vnc/xvnc.c     | 14 ++++++++++++++
+ vncviewer/vncviewer.cxx        | 20 ++++++++++++++++++++
+ 5 files changed, 55 insertions(+), 4 deletions(-)
+
+diff --git a/unix/vncserver/vncserver.in b/unix/vncserver/vncserver.in
+index 25fbbd315..261b258f1 100755
+--- a/unix/vncserver/vncserver.in
++++ b/unix/vncserver/vncserver.in
+@@ -107,7 +107,7 @@ $default_opts{rfbwait} = 30000;
+ $default_opts{rfbauth} = "$vncUserDir/passwd";
+ $default_opts{rfbport} = $vncPort;
+ $default_opts{fp} = $fontPath if ($fontPath);
+-$default_opts{pn} = "";
++$default_opts{pn} = undef;
+ 
+ # Load user-overrideable system defaults
+ LoadConfig($vncSystemConfigDefaultsFile);
+@@ -242,13 +242,13 @@ push(@cmd, "@CMAKE_INSTALL_FULL_BINDIR@/Xvnc", ":$displayNumber");
+ 
+ foreach my $k (sort keys %config) {
+   push(@cmd, "-$k");
+-  push(@cmd, $config{$k}) if $config{$k};
++  push(@cmd, $config{$k}) if defined($config{$k});
+   delete $default_opts{$k}; # file options take precedence
+ }
+ 
+ foreach my $k (sort keys %default_opts) {
+   push(@cmd, "-$k");
+-  push(@cmd, $default_opts{$k}) if $default_opts{$k};
++  push(@cmd, $default_opts{$k}) if defined($default_opts{$k});
+ }
+ 
+ warn "\nNew '$desktopName' desktop is $host:$displayNumber\n\n";
+@@ -291,7 +291,7 @@ sub LoadConfig {
+           # current config file being loaded defined the logical opposite setting
+           # (NeverShared vs. AlwaysShared, etc etc).
+           $toggle = lc($1); # must normalize key case
+-          $config{$toggle} = $k;
++          $config{$toggle} = undef;
+         }
+       }
+       close(IN);
+diff --git a/unix/xserver/hw/vnc/RFBGlue.cc b/unix/xserver/hw/vnc/RFBGlue.cc
+index f108fae43..7c32bea8f 100644
+--- a/unix/xserver/hw/vnc/RFBGlue.cc
++++ b/unix/xserver/hw/vnc/RFBGlue.cc
+@@ -143,6 +143,22 @@ const char* vncGetParamDesc(const char *name)
+   return param->getDescription();
+ }
+ 
++int vncIsParamBool(const char *name)
++{
++  VoidParameter *param;
++  BoolParameter *bparam;
++
++  param = rfb::Configuration::getParam(name);
++  if (param == NULL)
++    return false;
++
++  bparam = dynamic_cast<BoolParameter*>(param);
++  if (bparam == NULL)
++    return false;
++
++  return true;
++}
++
+ int vncGetParamCount(void)
+ {
+   int count;
+diff --git a/unix/xserver/hw/vnc/RFBGlue.h b/unix/xserver/hw/vnc/RFBGlue.h
+index 112405b84..695cea105 100644
+--- a/unix/xserver/hw/vnc/RFBGlue.h
++++ b/unix/xserver/hw/vnc/RFBGlue.h
+@@ -41,6 +41,7 @@ int vncSetParam(const char *name, const char *value);
+ int vncSetParamSimple(const char *nameAndValue);
+ char* vncGetParam(const char *name);
+ const char* vncGetParamDesc(const char *name);
++int vncIsParamBool(const char *name);
+ 
+ int vncGetParamCount(void);
+ char *vncGetParamList(void);
+diff --git a/unix/xserver/hw/vnc/xvnc.c b/unix/xserver/hw/vnc/xvnc.c
+index 4eb0b0b13..5744acac8 100644
+--- a/unix/xserver/hw/vnc/xvnc.c
++++ b/unix/xserver/hw/vnc/xvnc.c
+@@ -618,6 +618,20 @@ ddxProcessArgument(int argc, char *argv[], int i)
+         exit(0);
+     }
+ 
++    /* We need to resolve an ambiguity for booleans */
++    if (argv[i][0] == '-' && i+1 < argc &&
++        vncIsParamBool(&argv[i][1])) {
++        if ((strcasecmp(argv[i+1], "0") == 0) ||
++            (strcasecmp(argv[i+1], "1") == 0) ||
++            (strcasecmp(argv[i+1], "true") == 0) ||
++            (strcasecmp(argv[i+1], "false") == 0) ||
++            (strcasecmp(argv[i+1], "yes") == 0) ||
++            (strcasecmp(argv[i+1], "no") == 0)) {
++            vncSetParam(&argv[i][1], argv[i+1]);
++            return 2;
++        }
++    }
++
+     if (vncSetParamSimple(argv[i]))
+ 	return 1;
+     
+diff --git a/vncviewer/vncviewer.cxx b/vncviewer/vncviewer.cxx
+index d4dd3063c..77ba3d3f4 100644
+--- a/vncviewer/vncviewer.cxx
++++ b/vncviewer/vncviewer.cxx
+@@ -556,6 +556,26 @@ int main(int argc, char** argv)
+   }
+ 
+   for (int i = 1; i < argc;) {
++    /* We need to resolve an ambiguity for booleans */
++    if (argv[i][0] == '-' && i+1 < argc) {
++        VoidParameter *param;
++
++        param = Configuration::getParam(&argv[i][1]);
++        if ((param != NULL) &&
++            (dynamic_cast<BoolParameter*>(param) != NULL)) {
++          if ((strcasecmp(argv[i+1], "0") == 0) ||
++              (strcasecmp(argv[i+1], "1") == 0) ||
++              (strcasecmp(argv[i+1], "true") == 0) ||
++              (strcasecmp(argv[i+1], "false") == 0) ||
++              (strcasecmp(argv[i+1], "yes") == 0) ||
++              (strcasecmp(argv[i+1], "no") == 0)) {
++              param->setParam(argv[i+1]);
++              i += 2;
++              continue;
++          }
++      }
++    }
++
+     if (Configuration::setParam(argv[i])) {
+       i++;
+       continue;

SOURCES/tigervnc-use-gnome-as-default-session.patch

@@ -0,0 +1,12 @@
+diff --git a/unix/vncserver/vncserver-config-defaults b/unix/vncserver/vncserver-config-defaults
+index 0c217bf..2889347 100644
+--- a/unix/vncserver/vncserver-config-defaults
++++ b/unix/vncserver/vncserver-config-defaults
+@@ -13,3 +13,7 @@
+ # geometry=2000x1200
+ # localhost
+ # alwaysshared
++
++# Default to GNOME session
++# Note: change this only when you know what are you doing
++session=gnome

SOURCES/tigervnc-utilize-system-crypto-policies.patch

@@ -0,0 +1,198 @@
+diff --git a/common/rfb/CSecurityTLS.cxx b/common/rfb/CSecurityTLS.cxx
+index 9900837..59d2086 100644
+--- a/common/rfb/CSecurityTLS.cxx
++++ b/common/rfb/CSecurityTLS.cxx
+@@ -210,26 +210,66 @@ void CSecurityTLS::setParam()
+   static const char kx_anon_priority[] = ":+ANON-ECDH:+ANON-DH";
+ 
+   int ret;
+-  char *prio;
+-  const char *err;
+ 
+-  prio = (char*)malloc(strlen(Security::GnuTLSPriority) +
+-                       strlen(kx_anon_priority) + 1);
+-  if (prio == NULL)
+-    throw AuthFailureException("Not enough memory for GnuTLS priority string");
++  // Custom priority string specified?
++  if (strcmp(Security::GnuTLSPriority, "") != 0) {
++    char *prio;
++    const char *err;
+ 
+-  strcpy(prio, Security::GnuTLSPriority);
+-  if (anon)
++    prio = (char*)malloc(strlen(Security::GnuTLSPriority) +
++                         strlen(kx_anon_priority) + 1);
++    if (prio == NULL)
++      throw AuthFailureException("Not enough memory for GnuTLS priority string");
++
++    strcpy(prio, Security::GnuTLSPriority);
++    if (anon)
++      strcat(prio, kx_anon_priority);
++
++    ret = gnutls_priority_set_direct(session, prio, &err);
++
++    free(prio);
++
++    if (ret != GNUTLS_E_SUCCESS) {
++      if (ret == GNUTLS_E_INVALID_REQUEST)
++        vlog.error("GnuTLS priority syntax error at: %s", err);
++      throw AuthFailureException("gnutls_set_priority_direct failed");
++    }
++  } else if (anon) {
++    const char *err;
++
++#if GNUTLS_VERSION_NUMBER >= 0x030603
++    // gnutls_set_default_priority_appends() expects a normal priority string that
++    // doesn't start with ":".
++    ret = gnutls_set_default_priority_append(session, kx_anon_priority + 1, &err, 0);
++    if (ret != GNUTLS_E_SUCCESS) {
++      if (ret == GNUTLS_E_INVALID_REQUEST)
++        vlog.error("GnuTLS priority syntax error at: %s", err);
++      throw AuthFailureException("gnutls_set_default_priority_append failed");
++    }
++#else
++    // We don't know what the system default priority is, so we guess
++    // it's what upstream GnuTLS has
++    static const char gnutls_default_priority[] = "NORMAL";
++    char *prio;
++
++    prio = (char*)malloc(strlen(gnutls_default_priority) +
++                         strlen(kx_anon_priority) + 1);
++    if (prio == NULL)
++      throw AuthFailureException("Not enough memory for GnuTLS priority string");
++
++    strcpy(prio, gnutls_default_priority);
+     strcat(prio, kx_anon_priority);
+ 
+-  ret = gnutls_priority_set_direct(session, prio, &err);
++    ret = gnutls_priority_set_direct(session, prio, &err);
+ 
+-  free(prio);
++    free(prio);
+ 
+-  if (ret != GNUTLS_E_SUCCESS) {
+-    if (ret == GNUTLS_E_INVALID_REQUEST)
+-      vlog.error("GnuTLS priority syntax error at: %s", err);
+-    throw AuthFailureException("gnutls_set_priority_direct failed");
++    if (ret != GNUTLS_E_SUCCESS) {
++      if (ret == GNUTLS_E_INVALID_REQUEST)
++        vlog.error("GnuTLS priority syntax error at: %s", err);
++      throw AuthFailureException("gnutls_set_priority_direct failed");
++    }
++#endif
+   }
+ 
+   if (anon) {
+diff --git a/common/rfb/SSecurityTLS.cxx b/common/rfb/SSecurityTLS.cxx
+index ef5d8c9..f32f87f 100644
+--- a/common/rfb/SSecurityTLS.cxx
++++ b/common/rfb/SSecurityTLS.cxx
+@@ -198,26 +198,66 @@ void SSecurityTLS::setParams(gnutls_session_t session)
+   static const char kx_anon_priority[] = ":+ANON-ECDH:+ANON-DH";
+ 
+   int ret;
+-  char *prio;
+-  const char *err;
+ 
+-  prio = (char*)malloc(strlen(Security::GnuTLSPriority) +
+-                       strlen(kx_anon_priority) + 1);
+-  if (prio == NULL)
+-    throw AuthFailureException("Not enough memory for GnuTLS priority string");
++  // Custom priority string specified?
++  if (strcmp(Security::GnuTLSPriority, "") != 0) {
++    char *prio;
++    const char *err;
+ 
+-  strcpy(prio, Security::GnuTLSPriority);
+-  if (anon)
++    prio = (char*)malloc(strlen(Security::GnuTLSPriority) +
++                         strlen(kx_anon_priority) + 1);
++    if (prio == NULL)
++      throw AuthFailureException("Not enough memory for GnuTLS priority string");
++
++    strcpy(prio, Security::GnuTLSPriority);
++    if (anon)
++      strcat(prio, kx_anon_priority);
++
++    ret = gnutls_priority_set_direct(session, prio, &err);
++
++    free(prio);
++
++    if (ret != GNUTLS_E_SUCCESS) {
++      if (ret == GNUTLS_E_INVALID_REQUEST)
++        vlog.error("GnuTLS priority syntax error at: %s", err);
++      throw AuthFailureException("gnutls_set_priority_direct failed");
++    }
++  } else if (anon) {
++    const char *err;
++
++#if GNUTLS_VERSION_NUMBER >= 0x030603
++    // gnutls_set_default_priority_appends() expects a normal priority string that
++    // doesn't start with ":".
++    ret = gnutls_set_default_priority_append(session, kx_anon_priority + 1, &err, 0);
++    if (ret != GNUTLS_E_SUCCESS) {
++      if (ret == GNUTLS_E_INVALID_REQUEST)
++        vlog.error("GnuTLS priority syntax error at: %s", err);
++      throw AuthFailureException("gnutls_set_default_priority_append failed");
++    }
++#else
++    // We don't know what the system default priority is, so we guess
++    // it's what upstream GnuTLS has
++    static const char gnutls_default_priority[] = "NORMAL";
++    char *prio;
++
++    prio = (char*)malloc(strlen(gnutls_default_priority) +
++                         strlen(kx_anon_priority) + 1);
++    if (prio == NULL)
++      throw AuthFailureException("Not enough memory for GnuTLS priority string");
++
++    strcpy(prio, gnutls_default_priority);
+     strcat(prio, kx_anon_priority);
+ 
+-  ret = gnutls_priority_set_direct(session, prio, &err);
++    ret = gnutls_priority_set_direct(session, prio, &err);
+ 
+-  free(prio);
++    free(prio);
+ 
+-  if (ret != GNUTLS_E_SUCCESS) {
+-    if (ret == GNUTLS_E_INVALID_REQUEST)
+-      vlog.error("GnuTLS priority syntax error at: %s", err);
+-    throw AuthFailureException("gnutls_set_priority_direct failed");
++    if (ret != GNUTLS_E_SUCCESS) {
++      if (ret == GNUTLS_E_INVALID_REQUEST)
++        vlog.error("GnuTLS priority syntax error at: %s", err);
++      throw AuthFailureException("gnutls_set_priority_direct failed");
++    }
++#endif
+   }
+ 
+ #if defined (SSECURITYTLS__USE_DEPRECATED_DH)
+diff --git a/common/rfb/Security.cxx b/common/rfb/Security.cxx
+index 0666041..59deb78 100644
+--- a/common/rfb/Security.cxx
++++ b/common/rfb/Security.cxx
+@@ -52,7 +52,7 @@ static LogWriter vlog("Security");
+ #ifdef HAVE_GNUTLS
+ StringParameter Security::GnuTLSPriority("GnuTLSPriority",
+   "GnuTLS priority string that controls the TLS session’s handshake algorithms",
+-  "NORMAL");
++  "");
+ #endif
+ 
+ Security::Security()
+diff --git a/unix/xserver/hw/vnc/Xvnc.man b/unix/xserver/hw/vnc/Xvnc.man
+index 83621c0..4a0d20c 100644
+--- a/unix/xserver/hw/vnc/Xvnc.man
++++ b/unix/xserver/hw/vnc/Xvnc.man
+@@ -226,7 +226,9 @@ also be in PEM format.
+ .TP
+ .B \-GnuTLSPriority \fIpriority\fP
+ GnuTLS priority string that controls the TLS session’s handshake algorithms.
+-See the GnuTLS manual for possible values. Default is \fBNORMAL\fP.
++See the GnuTLS manual for possible values. For GnuTLS < 3.6.3 the default
++value will be \fBNORMAL\fP to use upstream default. For newer versions
++of GnuTLS system-wide crypto policy will be used.
+ .
+ .TP
+ .B \-UseBlacklist

SOURCES/tigervnc-vncsession-restore-script-systemd-service.patch

@@ -0,0 +1,113 @@
+From 1919a8ab86c99b47ba86dc697abcdf3343b0aafa Mon Sep 17 00:00:00 2001
+From: Jan Grulich <jgrulich@redhat.com>
+Date: Tue, 1 Feb 2022 14:31:05 +0100
+Subject: Add vncsession-restore script to restore SELinux context
+
+The vncsession-restore script is used in the ExecStartPre option
+for systemd service file in order to properly start the session
+in case the policy is updated (e.g. after Tigervnc update).
+
+diff --git a/unix/vncserver/CMakeLists.txt b/unix/vncserver/CMakeLists.txt
+index bce1c3e..44c4e2a 100644
+--- a/unix/vncserver/CMakeLists.txt
++++ b/unix/vncserver/CMakeLists.txt
+@@ -2,6 +2,7 @@ add_executable(vncsession vncsession.c)
+ target_link_libraries(vncsession ${PAM_LIBS} ${SELINUX_LIBS})
+
+ configure_file(vncserver@.service.in vncserver@.service @ONLY)
++configure_file(vncsession-restore.in vncsession-restore @ONLY)
+ configure_file(vncsession-start.in vncsession-start @ONLY)
+ configure_file(vncserver.in vncserver @ONLY)
+
+@@ -17,4 +18,5 @@ install(FILES vncserver.users DESTINATION ${CMAKE_INSTALL_FULL_SYSCONFDIR}/tiger
+ if(INSTALL_SYSTEMD_UNITS)
+   install(FILES ${CMAKE_CURRENT_BINARY_DIR}/vncserver@.service DESTINATION ${CMAKE_INSTALL_FULL_UNITDIR})
+   install(PROGRAMS ${CMAKE_CURRENT_BINARY_DIR}/vncsession-start DESTINATION ${CMAKE_INSTALL_FULL_LIBEXECDIR})
++  install(PROGRAMS ${CMAKE_CURRENT_BINARY_DIR}/vncsession-restore DESTINATION ${CMAKE_INSTALL_FULL_LIBEXECDIR})
+ endif()
+diff --git a/unix/vncserver/vncserver@.service.in b/unix/vncserver/vncserver@.service.in
+index 5624dff..be62c85 100644
+--- a/unix/vncserver/vncserver@.service.in
++++ b/unix/vncserver/vncserver@.service.in
+@@ -35,6 +35,7 @@ After=syslog.target network.target
+
+ [Service]
+ Type=forking
++ExecStartPre=+@CMAKE_INSTALL_FULL_LIBEXECDIR@/vncsession-restore %i
+ ExecStart=@CMAKE_INSTALL_FULL_LIBEXECDIR@/vncsession-start %i
+ PIDFile=/run/vncsession-%i.pid
+ SELinuxContext=system_u:system_r:vnc_session_t:s0
+diff --git a/unix/vncserver/vncsession-restore.in b/unix/vncserver/vncsession-restore.in
+new file mode 100644
+index 00000000..d3abc57d
+--- /dev/null
++++ b/unix/vncserver/vncsession-restore.in
+@@ -0,0 +1,68 @@
++#!/bin/bash
++#
++#  Copyright 2022 Jan Grulich <jgrulich@redhat.com>
++#
++#  This is free software; you can redistribute it and/or modify
++#  it under the terms of the GNU General Public License as published by
++#  the Free Software Foundation; either version 2 of the License, or
++#  (at your option) any later version.
++#
++#  This software is distributed in the hope that it will be useful,
++#  but WITHOUT ANY WARRANTY; without even the implied warranty of
++#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++#  GNU General Public License for more details.
++#
++#  You should have received a copy of the GNU General Public License
++#  along with this software; if not, write to the Free Software
++#  Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307,
++#  USA.
++#
++
++USERSFILE="@CMAKE_INSTALL_FULL_SYSCONFDIR@/tigervnc/vncserver.users"
++
++if [ $# -ne 1 ]; then
++	echo "Syntax:" >&2
++	echo "    $0 <display>" >&2
++	exit 1
++fi
++
++if [ ! -f "${USERSFILE}" ]; then
++	echo "Users file ${USERSFILE} missing" >&2
++	exit 1
++fi
++
++DISPLAY="$1"
++
++USER=`grep "^ *${DISPLAY}=" "${USERSFILE}" 2>/dev/null | head -1 | cut -d = -f 2- | sed 's/ *$//g'`
++
++if [ -z "${USER}" ]; then
++	echo "No user configured for display ${DISPLAY}" >&2
++	exit 1
++fi
++
++USER_HOMEDIR=`getent passwd ${USER} | cut -f6 -d:`
++
++if [ -z "${USER_HOMEDIR}" ]; then
++	echo "Failed to get home directory for ${USER}" >&2
++	exit 1
++fi
++
++if [ ! -d "${USER_HOMEDIR}/.vnc" ]; then
++	exit 0
++fi
++
++MATCHPATHCON=`which matchpathcon`
++
++if [ $? -eq 0 ]; then
++	${MATCHPATHCON} -V "${USER_HOMEDIR}/.vnc" &>/dev/null
++	if [ $? -eq 0 ]; then
++		exit 0
++	fi
++fi
++
++RESTORECON=`which restorecon`
++
++if [ $? -eq 0 ]; then
++	exec "${RESTORECON}" -R "${USER_HOMEDIR}/.vnc" >&2
++	return $?
++fi

SOURCES/tigervnc-working-tls-on-fips-systems.patch

@@ -0,0 +1,120 @@
+diff --git a/common/rfb/SSecurityTLS.cxx b/common/rfb/SSecurityTLS.cxx
+index d5ef47e..ef5d8c9 100644
+--- a/common/rfb/SSecurityTLS.cxx
++++ b/common/rfb/SSecurityTLS.cxx
+@@ -37,7 +37,23 @@
+ #include <rdr/TLSOutStream.h>
+ #include <gnutls/x509.h>
+ 
+-#define DH_BITS 1024 /* XXX This should be configurable! */
++#if defined (SSECURITYTLS__USE_DEPRECATED_DH)
++/* FFDHE (RFC-7919) 2048-bit parameters, PEM-encoded */
++static unsigned char ffdhe2048[] =
++  "-----BEGIN DH PARAMETERS-----\n"
++  "MIIBDAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz\n"
++  "+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a\n"
++  "87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7\n"
++  "YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi\n"
++  "7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD\n"
++  "ssbzSibBsu/6iGtCOGEoXJf//////////wIBAgICAOE=\n"
++  "-----END DH PARAMETERS-----\n";
++
++static const gnutls_datum_t ffdhe_pkcs3_param = {
++  ffdhe2048,
++  sizeof(ffdhe2048)
++};
++#endif
+ 
+ using namespace rfb;
+ 
+@@ -50,10 +66,14 @@ StringParameter SSecurityTLS::X509_KeyFile
+ static LogWriter vlog("TLS");
+ 
+ SSecurityTLS::SSecurityTLS(SConnection* sc, bool _anon)
+-  : SSecurity(sc), session(NULL), dh_params(NULL), anon_cred(NULL),
++  : SSecurity(sc), session(NULL), anon_cred(NULL),
+     cert_cred(NULL), anon(_anon), tlsis(NULL), tlsos(NULL),
+     rawis(NULL), rawos(NULL)
+ {
++#if defined (SSECURITYTLS__USE_DEPRECATED_DH)
++  dh_params = NULL;
++#endif
++
+   certfile = X509_CertFile.getData();
+   keyfile = X509_KeyFile.getData();
+ 
+@@ -70,10 +90,12 @@ void SSecurityTLS::shutdown()
+     }
+   }
+ 
++#if defined (SSECURITYTLS__USE_DEPRECATED_DH)
+   if (dh_params) {
+     gnutls_dh_params_deinit(dh_params);
+     dh_params = 0;
+   }
++#endif
+ 
+   if (anon_cred) {
+     gnutls_anon_free_server_credentials(anon_cred);
+@@ -198,17 +220,21 @@ void SSecurityTLS::setParams(gnutls_session_t session)
+     throw AuthFailureException("gnutls_set_priority_direct failed");
+   }
+ 
++#if defined (SSECURITYTLS__USE_DEPRECATED_DH)
+   if (gnutls_dh_params_init(&dh_params) != GNUTLS_E_SUCCESS)
+     throw AuthFailureException("gnutls_dh_params_init failed");
+ 
+-  if (gnutls_dh_params_generate2(dh_params, DH_BITS) != GNUTLS_E_SUCCESS)
+-    throw AuthFailureException("gnutls_dh_params_generate2 failed");
++  if (gnutls_dh_params_import_pkcs3(dh_params, &ffdhe_pkcs3_param, GNUTLS_X509_FMT_PEM) != GNUTLS_E_SUCCESS)
++    throw AuthFailureException("gnutls_dh_params_import_pkcs3 failed");
++#endif
+ 
+   if (anon) {
+     if (gnutls_anon_allocate_server_credentials(&anon_cred) != GNUTLS_E_SUCCESS)
+       throw AuthFailureException("gnutls_anon_allocate_server_credentials failed");
+ 
++#if defined (SSECURITYTLS__USE_DEPRECATED_DH)
+     gnutls_anon_set_server_dh_params(anon_cred, dh_params);
++#endif
+ 
+     if (gnutls_credentials_set(session, GNUTLS_CRD_ANON, anon_cred)
+         != GNUTLS_E_SUCCESS)
+@@ -220,7 +246,9 @@ void SSecurityTLS::setParams(gnutls_session_t session)
+     if (gnutls_certificate_allocate_credentials(&cert_cred) != GNUTLS_E_SUCCESS)
+       throw AuthFailureException("gnutls_certificate_allocate_credentials failed");
+ 
++#if defined (SSECURITYTLS__USE_DEPRECATED_DH)
+     gnutls_certificate_set_dh_params(cert_cred, dh_params);
++#endif
+ 
+     switch (gnutls_certificate_set_x509_key_file(cert_cred, certfile, keyfile, GNUTLS_X509_FMT_PEM)) {
+     case GNUTLS_E_SUCCESS:
+diff --git a/common/rfb/SSecurityTLS.h b/common/rfb/SSecurityTLS.h
+index dd89bb4..0cb463d 100644
+--- a/common/rfb/SSecurityTLS.h
++++ b/common/rfb/SSecurityTLS.h
+@@ -36,6 +36,13 @@
+ #include <rdr/OutStream.h>
+ #include <gnutls/gnutls.h>
+ 
++/* In GnuTLS 3.6.0 DH parameter generation was deprecated. RFC7919 is used instead.
++ * GnuTLS before 3.6.0 doesn't know about RFC7919 so we will have to import it.
++ */
++#if GNUTLS_VERSION_NUMBER < 0x030600
++#define SSECURITYTLS__USE_DEPRECATED_DH
++#endif
++
+ namespace rfb {
+ 
+   class SSecurityTLS : public SSecurity {
+@@ -55,7 +62,9 @@ namespace rfb {
+ 
+   private:
+     gnutls_session_t session;
++#if defined (SSECURITYTLS__USE_DEPRECATED_DH)
+     gnutls_dh_params_t dh_params;
++#endif
+     gnutls_anon_server_credentials_t anon_cred;
+     gnutls_certificate_credentials_t cert_cred;
+     char *keyfile, *certfile;

SOURCES/tigervnc-xserver120.patch

@@ -0,0 +1,91 @@
+diff -up xserver/configure.ac.xserver116-rebased xserver/configure.ac
+--- xserver/configure.ac.xserver116-rebased	2016-09-29 13:14:45.595441590 +0200
++++ xserver/configure.ac	2016-09-29 13:14:45.631442006 +0200
+@@ -74,6 +74,7 @@ dnl forcing an entire recompile.x
+ AC_CONFIG_HEADERS(include/version-config.h)
+
+ AM_PROG_AS
++AC_PROG_CXX
+ AC_PROG_LN_S
+ LT_PREREQ([2.2])
+ LT_INIT([disable-static win32-dll])
+@@ -1863,6 +1864,10 @@ if test "x$XVFB" = xyes; then
+ 	AC_SUBST([XVFB_SYS_LIBS])
+ fi
+
++dnl Xvnc DDX
++AC_SUBST([XVNC_CPPFLAGS], ["-DHAVE_DIX_CONFIG_H $XSERVER_CFLAGS"])
++AC_SUBST([XVNC_LIBS], ["$FB_LIB $FIXES_LIB $XEXT_LIB $CONFIG_LIB $DBE_LIB $RECORD_LIB $GLX_LIBS $RANDR_LIB $RENDER_LIB $DAMAGE_LIB $DRI3_LIB $PRESENT_LIB $MIEXT_SYNC_LIB $MIEXT_DAMAGE_LIB $MIEXT_SHADOW_LIB $XI_LIB $XKB_LIB $XKB_STUB_LIB $COMPOSITE_LIB $MAIN_LIB"])
++AC_SUBST([XVNC_SYS_LIBS], ["$GLX_SYS_LIBS"])
+
+ dnl Xnest DDX
+
+@@ -1898,6 +1903,8 @@ if test "x$XORG" = xauto; then
+ fi
+ AC_MSG_RESULT([$XORG])
+
++AC_DEFINE_UNQUOTED(XORG_VERSION_CURRENT, [$VENDOR_RELEASE], [Current Xorg version])
++
+ if test "x$XORG" = xyes; then
+ 	XORG_DDXINCS='-I$(top_srcdir)/hw/xfree86 -I$(top_srcdir)/hw/xfree86/include -I$(top_srcdir)/hw/xfree86/common'
+ 	XORG_OSINCS='-I$(top_srcdir)/hw/xfree86/os-support -I$(top_srcdir)/hw/xfree86/os-support/bus -I$(top_srcdir)/os'
+@@ -2116,7 +2123,6 @@ if test "x$XORG" = xyes; then
+ 	AC_DEFINE(XORG_SERVER, 1, [Building Xorg server])
+ 	AC_DEFINE(XORGSERVER, 1, [Building Xorg server])
+ 	AC_DEFINE(XFree86Server, 1, [Building XFree86 server])
+-	AC_DEFINE_UNQUOTED(XORG_VERSION_CURRENT, [$VENDOR_RELEASE], [Current Xorg version])
+ 	AC_DEFINE(NEED_XF86_TYPES, 1, [Need XFree86 typedefs])
+ 	AC_DEFINE(NEED_XF86_PROTOTYPES, 1, [Need XFree86 helper functions])
+ 	AC_DEFINE(__XSERVERNAME__, "Xorg", [Name of X server])
+@@ -2691,6 +2697,7 @@ hw/dmx/Makefile
+ hw/dmx/man/Makefile
+ hw/vfb/Makefile
+ hw/vfb/man/Makefile
++hw/vnc/Makefile
+ hw/xnest/Makefile
+ hw/xnest/man/Makefile
+ hw/xwin/Makefile
+diff -up xserver/hw/Makefile.am.xserver116-rebased xserver/hw/Makefile.am
+--- xserver/hw/Makefile.am.xserver116-rebased	2016-09-29 13:14:45.601441659 +0200
++++ xserver/hw/Makefile.am	2016-09-29 13:14:45.631442006 +0200
+@@ -38,7 +38,8 @@ SUBDIRS =			\
+ 	$(DMX_SUBDIRS)		\
+ 	$(KDRIVE_SUBDIRS)	\
+ 	$(XQUARTZ_SUBDIRS)	\
+-	$(XWAYLAND_SUBDIRS)
++	$(XWAYLAND_SUBDIRS)	\
++	vnc
+
+ DIST_SUBDIRS = dmx xfree86 vfb xnest xwin xquartz kdrive xwayland
+
+diff --git xserver/mi/miinitext.c xserver/mi/miinitext.c
+index 5596e21..003fc3c 100644
+--- xserver/mi/miinitext.c
++++ xserver/mi/miinitext.c
+@@ -107,8 +107,15 @@ SOFTWARE.
+ #include "os.h"
+ #include "globals.h"
+
++#ifdef TIGERVNC
++extern void vncExtensionInit(INITARGS);
++#endif
++
+ /* List of built-in (statically linked) extensions */
+ static const ExtensionModule staticExtensions[] = {
++#ifdef TIGERVNC
++    {vncExtensionInit, "VNC-EXTENSION", NULL},
++#endif
+     {GEExtensionInit, "Generic Event Extension", &noGEExtension},
+     {ShapeExtensionInit, "SHAPE", NULL},
+ #ifdef MITSHM
+--- xserver/include/os.h~	2016-10-03 09:07:29.000000000 +0200
++++ xserver/include/os.h	2016-10-03 14:13:00.013654506 +0200
+@@ -621,7 +621,7 @@
+ extern _X_EXPORT void
+ LogClose(enum ExitCode error);
+ extern _X_EXPORT Bool
+-LogSetParameter(LogParameter param, int value);
++LogSetParameter(enum _LogParameter param, int value);
+ extern _X_EXPORT void
+ LogVWrite(int verb, const char *f, va_list args)
+ _X_ATTRIBUTE_PRINTF(2, 0);

SOURCES/vncserver

@@ -0,0 +1,897 @@
+#!/usr/bin/perl
+#
+#  Copyright (C) 2009-2010 D. R. Commander.  All Rights Reserved.
+#  Copyright (C) 2005-2006 Sun Microsystems, Inc.  All Rights Reserved.
+#  Copyright (C) 2002-2003 Constantin Kaplinsky.  All Rights Reserved.
+#  Copyright (C) 2002-2005 RealVNC Ltd.
+#  Copyright (C) 1999 AT&T Laboratories Cambridge.  All Rights Reserved.
+#
+#  This is free software; you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation; either version 2 of the License, or
+#  (at your option) any later version.
+#
+#  This software is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this software; if not, write to the Free Software
+#  Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307,
+#  USA.
+#
+
+#
+# vncserver - wrapper script to start an X VNC server.
+#
+
+# First make sure we're operating in a sane environment.
+$exedir = "";
+$slashndx = rindex($0, "/");
+if($slashndx>=0) {
+    $exedir = substr($0, 0, $slashndx+1);
+}
+
+&SanityCheck();
+
+&NotifyAboutDeprecation();
+
+#
+# Global variables.  You may want to configure some of these for
+# your site
+#
+
+$geometry = "1024x768";
+#$depth = 16;
+
+$vncUserDir = "$ENV{HOME}/.vnc";
+$vncUserConfig = "$vncUserDir/config";
+
+$vncSystemConfigDir = "/etc/tigervnc";
+$vncSystemConfigDefaultsFile = "$vncSystemConfigDir/vncserver-config-defaults";
+$vncSystemConfigMandatoryFile = "$vncSystemConfigDir/vncserver-config-mandatory";
+
+$skipxstartup = 0;
+$xauthorityFile = "$ENV{XAUTHORITY}" || "$ENV{HOME}/.Xauthority";
+
+$xstartupFile = $vncUserDir . "/xstartup";
+$defaultXStartup
+    = ("#!/bin/sh\n\n".
+       "unset SESSION_MANAGER\n".
+       "unset DBUS_SESSION_BUS_ADDRESS\n".
+       "/etc/X11/xinit/xinitrc\n".
+       "# Assume either Gnome will be started by default when installed\n".
+       "# We want to kill the session automatically in this case when user logs out. In case you modify\n".
+       "# /etc/X11/xinit/Xclients or ~/.Xclients yourself to achieve a different result, then you should\n".
+       "# be responsible to modify below code to avoid that your session will be automatically killed\n".
+       "if [ -e /usr/bin/gnome-session ]; then\n".
+       "    vncserver -kill \$DISPLAY\n".
+       "fi\n");
+
+$defaultConfig
+    = ("## Supported server options to pass to vncserver upon invocation can be listed\n".
+       "## in this file. See the following manpages for more: vncserver(1) Xvnc(1).\n".
+       "## Several common ones are shown below. Uncomment and modify to your liking.\n".
+       "##\n".
+       "# securitytypes=vncauth,tlsvnc\n".
+       "# desktop=sandbox\n".
+       "# geometry=2000x1200\n".
+       "# localhost\n".
+       "# alwaysshared\n");
+
+chop($host = `uname -n`);
+
+if (-d "/etc/X11/fontpath.d") {
+    $fontPath = "catalogue:/etc/X11/fontpath.d";
+}
+
+@fontpaths = ('/usr/share/X11/fonts', '/usr/share/fonts', '/usr/share/fonts/X11/');
+if (! -l "/usr/lib/X11") {push(@fontpaths, '/usr/lib/X11/fonts');}
+if (! -l "/usr/X11") {push(@fontpaths, '/usr/X11/lib/X11/fonts');}
+if (! -l "/usr/X11R6") {push(@fontpaths, '/usr/X11R6/lib/X11/fonts');}
+push(@fontpaths, '/usr/share/fonts/default');
+
+@fonttypes = ('misc',
+             '75dpi',
+             '100dpi',
+             'Speedo',
+             'Type1');
+
+foreach $_fpath (@fontpaths) {
+    foreach $_ftype (@fonttypes) {
+        if (-f "$_fpath/$_ftype/fonts.dir") {
+            if (! -l "$_fpath/$_ftype") {
+                $defFontPath .= "$_fpath/$_ftype,";
+            }
+        }
+    }
+}
+
+if ($defFontPath) {
+    if (substr($defFontPath, -1, 1) == ',') {
+        chop $defFontPath;
+    }
+}
+
+if ($fontPath eq "") {
+    $fontPath = $defFontPath;
+}
+
+# Check command line options
+
+&ParseOptions("-geometry",1,"-depth",1,"-pixelformat",1,"-name",1,"-kill",1,
+	      "-help",0,"-h",0,"--help",0,"-fp",1,"-list",0,"-fg",0,"-autokill",0,"-noxstartup",0,"-xstartup",1);
+
+&Usage() if ($opt{'-help'} || $opt{'-h'} || $opt{'--help'});
+
+&Kill() if ($opt{'-kill'});
+
+&List() if ($opt{'-list'});
+
+# Uncomment this line if you want default geometry, depth and pixelformat
+# to match the current X display:
+# &GetXDisplayDefaults();
+
+if ($opt{'-geometry'}) {
+    $geometry = $opt{'-geometry'};
+}
+if ($opt{'-depth'}) {
+    $depth = $opt{'-depth'};
+    $pixelformat = "";
+}
+if ($opt{'-pixelformat'}) {
+    $pixelformat = $opt{'-pixelformat'};
+}
+if ($opt{'-noxstartup'}) {
+    $skipxstartup = 1;
+}
+if ($opt{'-xstartup'}) {
+    $xstartupFile = $opt{'-xstartup'};
+}
+if ($opt{'-fp'}) {
+    $fontPath = $opt{'-fp'};
+    $fpArgSpecified = 1;
+}
+
+&CheckGeometryAndDepth();
+
+# Create the user's vnc directory if necessary.
+if (!(-e $vncUserDir)) {
+    if (!mkdir($vncUserDir,0755)) {
+	die "$prog: Could not create $vncUserDir.\n";
+    }
+}
+
+# Find display number.
+if ((@ARGV > 0) && ($ARGV[0] =~ /^:(\d+)$/)) {
+    $displayNumber = $1;
+    shift(@ARGV);
+    if (!&CheckDisplayNumber($displayNumber)) {
+	die "A VNC server is already running as :$displayNumber\n";
+    }
+} elsif ((@ARGV > 0) && ($ARGV[0] !~ /^-/) && ($ARGV[0] !~ /^\+/)) {
+    &Usage();
+} else {
+    $displayNumber = &GetDisplayNumber();
+}
+
+$vncPort = 5900 + $displayNumber;
+
+if ($opt{'-name'}) {
+    $desktopName = $opt{'-name'};
+} else {
+    $desktopName = "$host:$displayNumber ($ENV{USER})";
+}
+
+my %default_opts;
+my %config;
+
+# We set some reasonable defaults. Config file settings
+# override these where present.
+$default_opts{desktop} = &quotedString($desktopName);
+$default_opts{auth} = &quotedString($xauthorityFile);
+$default_opts{geometry} = $geometry if ($geometry);
+$default_opts{depth} = $depth if ($depth);
+$default_opts{pixelformat} = $pixelformat if ($pixelformat);
+$default_opts{rfbwait} = 30000;
+$default_opts{rfbauth} = "$vncUserDir/passwd";
+$default_opts{rfbport} = $vncPort;
+$default_opts{fp} = $fontPath if ($fontPath);
+$default_opts{pn} = "";
+
+# Load user-overrideable system defaults
+LoadConfig($vncSystemConfigDefaultsFile);
+
+# Then the user's settings
+LoadConfig($vncUserConfig);
+
+# And then override anything set above if mandatory settings exist.
+# WARNING: "Mandatory" is used loosely here! As the man page says,
+# there is nothing stopping someone from EASILY subverting the
+# settings in $vncSystemConfigMandatoryFile by simply passing
+# CLI args to vncserver, which trump config files! To properly
+# hard force policy in a non-subvertible way would require major
+# development work that touches Xvnc itself.
+LoadConfig($vncSystemConfigMandatoryFile, 1);
+
+#
+# Check whether VNC authentication is enabled, and if so, prompt the user to
+# create a VNC password if they don't already have one.
+#
+
+$securityTypeArgSpecified = 0;
+$vncAuthEnabled = 0;
+$passwordArgSpecified = 0;
+@vncAuthStrings = ("vncauth", "tlsvnc", "x509vnc");
+
+# ...first we check our configuration files' settings
+if ($config{'securitytypes'}) {
+  $securityTypeArgSpecified = 1;
+  foreach $arg2 (split(',', $config{'securitytypes'})) {
+    if (grep {$_ eq lc($arg2)} @vncAuthStrings) {
+      $vncAuthEnabled = 1;
+    }
+  }
+}
+
+# ...and finally we check CLI args, which in the case of the topic at
+# hand (VNC auth or not), override anything found in configuration files
+# (even so-called "mandatory" settings).
+for ($i = 0; $i < @ARGV; ++$i) {
+    # -SecurityTypes can be followed by a space or "="
+    my @splitargs = split('=', $ARGV[$i]);
+    if (@splitargs <= 1 && $i < @ARGV - 1) {
+        push(@splitargs, $ARGV[$i + 1]);
+    }
+    if (lc(@splitargs[0]) eq "-securitytypes") {
+        if (@splitargs > 1) {
+            $securityTypeArgSpecified = 1;
+        }
+        foreach $arg2 (split(',', @splitargs[1])) {
+            if (grep {$_ eq lc($arg2)} @vncAuthStrings) {
+                $vncAuthEnabled = 1;
+            }
+        }
+    }
+    if ((lc(@splitargs[0]) eq "-password")
+     || (lc(@splitargs[0]) eq "-passwordfile"
+     || (lc(@splitargs[0]) eq "-rfbauth"))) {
+        $passwordArgSpecified = 1;
+    }
+}
+
+if ((!$securityTypeArgSpecified || $vncAuthEnabled) && !$passwordArgSpecified) {
+    ($z,$z,$mode) = stat("$vncUserDir/passwd");
+    if (!(-e "$vncUserDir/passwd") || ($mode & 077)) {
+        warn "\nYou will require a password to access your desktops.\n\n";
+        system($exedir."vncpasswd -q $vncUserDir/passwd");
+        if (($? >> 8) != 0) {
+            exit 1;
+        }
+    }
+}
+
+$desktopLog = "$vncUserDir/$host:$displayNumber.log";
+unlink($desktopLog);
+
+# Make an X server cookie and set up the Xauthority file
+# mcookie is a part of util-linux, usually only GNU/Linux systems have it.
+$cookie = `mcookie`;
+# Fallback for non GNU/Linux OS - use /dev/urandom on systems that have it,
+# otherwise use perl's random number generator, seeded with the sum
+# of the current time, our PID and part of the encrypted form of the password.
+if ($cookie eq "" && open(URANDOM, '<', '/dev/urandom')) {
+  my $randata;
+  if (sysread(URANDOM, $randata, 16) == 16) {
+    $cookie = unpack 'h*', $randata;
+  }
+  close(URANDOM);
+}
+if ($cookie eq "") {
+  srand(time+$$+unpack("L",`cat $vncUserDir/passwd`));
+  for (1..16) {
+    $cookie .= sprintf("%02x", int(rand(256)) % 256);
+  }
+}
+
+open(XAUTH, "|xauth -f $xauthorityFile source -");
+print XAUTH "add $host:$displayNumber . $cookie\n";
+print XAUTH "add $host/unix:$displayNumber . $cookie\n";
+close(XAUTH);
+
+# Now start the X VNC Server
+
+# We build up our Xvnc command with options
+$cmd = $exedir."Xvnc :$displayNumber";
+
+foreach my $k (sort keys %config) {
+  $cmd .= " -$k $config{$k}";
+  delete $default_opts{$k}; # file options take precedence
+}
+
+foreach my $k (sort keys %default_opts) {
+  $cmd .= " -$k $default_opts{$k}";
+}
+
+# Add color database stuff here, e.g.:
+# $cmd .= " -co /usr/lib/X11/rgb";
+
+foreach $arg (@ARGV) {
+  $cmd .= " " . &quotedString($arg);
+}
+$cmd .= " >> " . &quotedString($desktopLog) . " 2>&1";
+
+# Run $cmd and record the process ID.
+$pidFile = "$vncUserDir/$host:$displayNumber.pid";
+system("$cmd & echo \$! >$pidFile");
+
+# Give Xvnc a chance to start up
+
+sleep(3);
+if ($fontPath ne $defFontPath) {
+    unless (kill 0, `cat $pidFile`) {
+        if ($fpArgSpecified) {
+	    warn "\nWARNING: The first attempt to start Xvnc failed, probably because the font\n";
+	    warn "path you specified using the -fp argument is incorrect.  Attempting to\n";
+	    warn "determine an appropriate font path for this system and restart Xvnc using\n";
+	    warn "that font path ...\n";
+        } else {
+	    warn "\nWARNING: The first attempt to start Xvnc failed, possibly because the font\n";
+	    warn "catalog is not properly configured.  Attempting to determine an appropriate\n";
+	    warn "font path for this system and restart Xvnc using that font path ...\n";
+        }
+	$cmd =~ s@-fp [^ ]+@@;
+	$cmd .= " -fp $defFontPath" if ($defFontPath);
+	system("$cmd & echo \$! >$pidFile");
+	sleep(3);
+    }
+}
+unless (kill 0, `cat $pidFile`) {
+    warn "Could not start Xvnc.\n\n";
+    unlink $pidFile;
+    open(LOG, "<$desktopLog");
+    while (<LOG>) { print; }
+    close(LOG);
+    die "\n";
+}
+
+warn "\nNew '$desktopName' desktop is $host:$displayNumber\n\n";
+
+# Create the user's xstartup script if necessary.
+if (! $skipxstartup) {
+    if (!(-e "$xstartupFile")) {
+	warn "Creating default startup script $xstartupFile\n";
+	open(XSTARTUP, ">$xstartupFile");
+        print XSTARTUP $defaultXStartup;
+        close(XSTARTUP);
+        chmod 0755, "$xstartupFile";
+    }
+}
+
+# Create the user's config file if necessary.
+if (!(-e "$vncUserDir/config")) {
+    warn "Creating default config $vncUserDir/config\n";
+    open(VNCUSERCONFIG, ">$vncUserDir/config");
+    print VNCUSERCONFIG $defaultConfig;
+    close(VNCUSERCONFIG);
+    chmod 0644, "$vncUserDir/config";
+}
+
+# Run the X startup script.
+if (! $skipxstartup) {
+    warn "Starting applications specified in $xstartupFile\n";
+}
+warn "Log file is $desktopLog\n\n";
+
+# If the unix domain socket exists then use that (DISPLAY=:n) otherwise use
+# TCP (DISPLAY=host:n)
+
+if (-e "/tmp/.X11-unix/X$displayNumber" ||
+    -e "/usr/spool/sockets/X11/$displayNumber")
+{
+    $ENV{DISPLAY}= ":$displayNumber";
+} else {
+    $ENV{DISPLAY}= "$host:$displayNumber";
+}
+$ENV{VNCDESKTOP}= $desktopName;
+
+if ($opt{'-fg'}) {
+    if (! $skipxstartup) {
+        system("$xstartupFile >> " . &quotedString($desktopLog) . " 2>&1");
+    }
+    if (kill 0, `cat $pidFile`) {
+        $opt{'-kill'} = ':'.$displayNumber;
+        &Kill();
+    }
+} else {
+    if ($opt{'-autokill'}) {
+    	if (! $skipxstartup) {
+            system("($xstartupFile; $0 -kill :$displayNumber) >> "
+	     . &quotedString($desktopLog) . " 2>&1 &");
+    	}
+    } else {
+    	if (! $skipxstartup) {
+            system("$xstartupFile >> " . &quotedString($desktopLog)
+	     . " 2>&1 &");
+    	}
+    }
+}
+
+exit;
+
+###############################################################################
+# Functions
+###############################################################################
+
+#
+# Populate the global %config hash with settings from a specified
+# vncserver configuration file if it exists
+#
+# Args: 1. file path
+#       2. optional boolean flag to enable warning when a previously
+#          set configuration setting is being overridden
+#
+sub LoadConfig {
+  local ($configFile, $warnoverride) = @_;
+  local ($toggle) = undef;
+
+  if (stat($configFile)) {
+    if (open(IN, $configFile)) {
+      while (<IN>) {
+        next if /^#/;
+        if (my ($k, $v) = /^\s*(\w+)\s*=\s*(.+)$/) {
+          $k = lc($k); # must normalize key case
+          if ($k eq "session") {
+            next;
+          }
+          if ($warnoverride && $config{$k}) {
+            print("Warning: $configFile is overriding previously defined '$k' to be '$v'\n");
+          }
+          $config{$k} = $v;
+        } elsif ($_ =~ m/^\s*(\S+)/) {
+          # We can't reasonably warn on override of toggles (e.g. AlwaysShared)
+          # because it would get crazy to do so. We'd have to check if the
+          # current config file being loaded defined the logical opposite setting
+          # (NeverShared vs. AlwaysShared, etc etc).
+          $toggle = lc($1); # must normalize key case
+          $config{$toggle} = $k;
+        }
+      }
+      close(IN);
+    }
+  }
+}
+
+#
+# CheckGeometryAndDepth simply makes sure that the geometry and depth values
+# are sensible.
+#
+
+sub CheckGeometryAndDepth
+{
+    if ($geometry =~ /^(\d+)x(\d+)$/) {
+	$width = $1; $height = $2;
+
+	if (($width<1) || ($height<1)) {
+	    die "$prog: geometry $geometry is invalid\n";
+	}
+
+	$geometry = "${width}x$height";
+    } else {
+	die "$prog: geometry $geometry is invalid\n";
+    }
+
+    if ($depth && (($depth < 8) || ($depth > 32))) {
+	die "Depth must be between 8 and 32\n";
+    }
+}
+
+
+#
+# GetDisplayNumber gets the lowest available display number.  A display number
+# n is taken if something is listening on the VNC server port (5900+n) or the
+# X server port (6000+n).
+#
+
+sub GetDisplayNumber
+{
+    foreach $n (1..99) {
+	if (&CheckDisplayNumber($n)) {
+	    return $n+0; # Bruce Mah's workaround for bug in perl 5.005_02
+	}
+    }
+
+    die "$prog: no free display number on $host.\n";
+}
+
+
+#
+# CheckDisplayNumber checks if the given display number is available.  A
+# display number n is taken if something is listening on the VNC server port
+# (5900+n) or the X server port (6000+n).
+#
+
+sub CheckDisplayNumber
+{
+    local ($n) = @_;
+
+    socket(S, $AF_INET, $SOCK_STREAM, 0) || die "$prog: socket failed: $!\n";
+    eval 'setsockopt(S, &SOL_SOCKET, &SO_REUSEADDR, pack("l", 1))';
+    if (!bind(S, pack('S n x12', $AF_INET, 6000 + $n))) {
+	close(S);
+	return 0;
+    }
+    close(S);
+
+    socket(S, $AF_INET, $SOCK_STREAM, 0) || die "$prog: socket failed: $!\n";
+    eval 'setsockopt(S, &SOL_SOCKET, &SO_REUSEADDR, pack("l", 1))';
+    if (!bind(S, pack('S n x12', $AF_INET, 5900 + $n))) {
+	close(S);
+	return 0;
+    }
+    close(S);
+
+    if (-e "/tmp/.X$n-lock") {
+	warn "\nWarning: $host:$n is taken because of /tmp/.X$n-lock\n";
+	warn "Remove this file if there is no X server $host:$n\n";
+	return 0;
+    }
+
+    if (-e "/tmp/.X11-unix/X$n") {
+	warn "\nWarning: $host:$n is taken because of /tmp/.X11-unix/X$n\n";
+	warn "Remove this file if there is no X server $host:$n\n";
+	return 0;
+    }
+
+    if (-e "/usr/spool/sockets/X11/$n") {
+	warn("\nWarning: $host:$n is taken because of ".
+             "/usr/spool/sockets/X11/$n\n");
+	warn "Remove this file if there is no X server $host:$n\n";
+	return 0;
+    }
+
+    return 1;
+}
+
+
+#
+# GetXDisplayDefaults uses xdpyinfo to find out the geometry, depth and pixel
+# format of the current X display being used.  If successful, it sets the
+# options as appropriate so that the X VNC server will use the same settings
+# (minus an allowance for window manager decorations on the geometry).  Using
+# the same depth and pixel format means that the VNC server won't have to
+# translate pixels when the desktop is being viewed on this X display (for
+# TrueColor displays anyway).
+#
+
+sub GetXDisplayDefaults
+{
+    local (@lines, @matchlines, $width, $height, $defaultVisualId, $i,
+	   $red, $green, $blue);
+
+    $wmDecorationWidth = 4;	# a guess at typical size for window manager
+    $wmDecorationHeight = 24;	# decoration size
+
+    return if (!defined($ENV{DISPLAY}));
+
+    @lines = `xdpyinfo 2>/dev/null`;
+
+    return if ($? != 0);
+
+    @matchlines = grep(/dimensions/, @lines);
+    if (@matchlines) {
+	($width, $height) = ($matchlines[0] =~ /(\d+)x(\d+) pixels/);
+
+	$width -= $wmDecorationWidth;
+	$height -= $wmDecorationHeight;
+
+	$geometry = "${width}x$height";
+    }
+
+    @matchlines = grep(/default visual id/, @lines);
+    if (@matchlines) {
+	($defaultVisualId) = ($matchlines[0] =~ /id:\s+(\S+)/);
+
+	for ($i = 0; $i < @lines; $i++) {
+	    if ($lines[$i] =~ /^\s*visual id:\s+$defaultVisualId$/) {
+		if (($lines[$i+1] !~ /TrueColor/) ||
+		    ($lines[$i+2] !~ /depth/) ||
+		    ($lines[$i+4] !~ /red, green, blue masks/))
+		{
+		    return;
+		}
+		last;
+	    }
+	}
+
+	return if ($i >= @lines);
+
+	($depth) = ($lines[$i+2] =~ /depth:\s+(\d+)/);
+	($red,$green,$blue)
+	    = ($lines[$i+4]
+	       =~ /masks:\s+0x([0-9a-f]+), 0x([0-9a-f]+), 0x([0-9a-f]+)/);
+
+	$red = hex($red);
+	$green = hex($green);
+	$blue = hex($blue);
+
+	if ($red > $blue) {
+	    $red = int(log($red) / log(2)) - int(log($green) / log(2));
+	    $green = int(log($green) / log(2)) - int(log($blue) / log(2));
+	    $blue = int(log($blue) / log(2)) + 1;
+	    $pixelformat = "rgb$red$green$blue";
+	} else {
+	    $blue = int(log($blue) / log(2)) - int(log($green) / log(2));
+	    $green = int(log($green) / log(2)) - int(log($red) / log(2));
+	    $red = int(log($red) / log(2)) + 1;
+	    $pixelformat = "bgr$blue$green$red";
+	}
+    }
+}
+
+
+#
+# quotedString returns a string which yields the original string when parsed
+# by a shell.
+#
+
+sub quotedString
+{
+    local ($in) = @_;
+
+    $in =~ s/\'/\'\"\'\"\'/g;
+
+    return "'$in'";
+}
+
+
+#
+# removeSlashes turns slashes into underscores for use as a file name.
+#
+
+sub removeSlashes
+{
+    local ($in) = @_;
+
+    $in =~ s|/|_|g;
+
+    return "$in";
+}
+
+
+#
+# Usage
+#
+
+sub Usage
+{
+    die("\nusage: $prog [:<number>] [-name <desktop-name>] [-depth <depth>]\n".
+	"                 [-geometry <width>x<height>]\n".
+	"                 [-pixelformat rgbNNN|bgrNNN]\n".
+	"                 [-fp <font-path>]\n".
+	"                 [-cc <visual>]\n".            
+	"                 [-fg]\n".
+	"                 [-autokill]\n".
+	"                 [-noxstartup]\n".
+	"                 [-xstartup <file>]\n".
+	"                 <Xvnc-options>...\n\n".
+	"       $prog -kill <X-display>\n\n".
+	"       $prog -list\n\n");
+}
+
+
+#
+# List
+#
+
+sub List
+{
+    opendir(dir, $vncUserDir);
+    my @filelist = readdir(dir);
+    closedir(dir);
+    print "\nTigerVNC server sessions:\n\n";
+    print "X DISPLAY #\tPROCESS ID\n";
+    foreach my $file (@filelist) {
+	if ($file =~ /$host:(\d+)$\.pid/) {
+	    chop($tmp_pid = `cat $vncUserDir/$file`);
+	    if (kill 0, $tmp_pid) {
+		print ":".$1."\t\t".`cat $vncUserDir/$file`;
+	    } else {
+		unlink ($vncUserDir . "/" . $file);
+	    }
+	}
+    }
+    exit;
+}
+
+
+#
+# Kill
+#
+
+sub Kill
+{
+    $opt{'-kill'} =~ s/(:\d+)\.\d+$/$1/; # e.g. turn :1.0 into :1
+
+    if ($opt{'-kill'} =~ /^:\d+$/) {
+	$pidFile = "$vncUserDir/$host$opt{'-kill'}.pid";
+    } else {
+	if ($opt{'-kill'} !~ /^$host:/) {
+	    die "\nCan't tell if $opt{'-kill'} is on $host\n".
+		"Use -kill :<number> instead\n\n";
+	}
+	$pidFile = "$vncUserDir/$opt{'-kill'}.pid";
+    }
+
+    if (! -r $pidFile) {
+	die "\nCan't find file $pidFile\n".
+	    "You'll have to kill the Xvnc process manually\n\n";
+    }
+
+    $SIG{'HUP'} = 'IGNORE';
+    chop($pid = `cat $pidFile`);
+    warn "Killing Xvnc process ID $pid\n";
+
+    if (kill 0, $pid) {
+	system("kill $pid");
+	sleep(1);
+	if (kill 0, $pid) {
+	    print "Xvnc seems to be deadlocked.  Kill the process manually and then re-run\n";
+	    print "    ".$0." -kill ".$opt{'-kill'}."\n";
+	    print "to clean up the socket files.\n";
+	    exit
+	}
+
+    } else {
+	warn "Xvnc process ID $pid already killed\n";
+	$opt{'-kill'} =~ s/://;
+
+	if (-e "/tmp/.X11-unix/X$opt{'-kill'}") {
+	    print "Xvnc did not appear to shut down cleanly.";
+	    print " Removing /tmp/.X11-unix/X$opt{'-kill'}\n";
+	    unlink "/tmp/.X11-unix/X$opt{'-kill'}";
+	}
+	if (-e "/tmp/.X$opt{'-kill'}-lock") {
+	    print "Xvnc did not appear to shut down cleanly.";
+	    print " Removing /tmp/.X$opt{'-kill'}-lock\n";
+	    unlink "/tmp/.X$opt{'-kill'}-lock";
+	}
+    }
+
+    unlink $pidFile;
+    exit;
+}
+
+
+#
+# ParseOptions takes a list of possible options and a boolean indicating
+# whether the option has a value following, and sets up an associative array
+# %opt of the values of the options given on the command line. It removes all
+# the arguments it uses from @ARGV and returns them in @optArgs.
+#
+
+sub ParseOptions
+{
+    local (@optval) = @_;
+    local ($opt, @opts, %valFollows, @newargs);
+
+    while (@optval) {
+	$opt = shift(@optval);
+	push(@opts,$opt);
+	$valFollows{$opt} = shift(@optval);
+    }
+
+    @optArgs = ();
+    %opt = ();
+
+    arg: while (defined($arg = shift(@ARGV))) {
+	foreach $opt (@opts) {
+	    if ($arg eq $opt) {
+		push(@optArgs, $arg);
+		if ($valFollows{$opt}) {
+		    if (@ARGV == 0) {
+			&Usage();
+		    }
+		    $opt{$opt} = shift(@ARGV);
+		    push(@optArgs, $opt{$opt});
+		} else {
+		    $opt{$opt} = 1;
+		}
+		next arg;
+	    }
+	}
+	push(@newargs,$arg);
+    }
+
+    @ARGV = @newargs;
+}
+
+
+# Routine to make sure we're operating in a sane environment.
+sub SanityCheck
+{
+    local ($cmd);
+
+    # Get the program name
+    ($prog) = ($0 =~ m|([^/]+)$|);
+
+    #
+    # Check we have all the commands we'll need on the path.
+    #
+
+ cmd:
+    foreach $cmd ("uname","xauth") {
+	for (split(/:/,$ENV{PATH})) {
+	    if (-x "$_/$cmd") {
+		next cmd;
+	    }
+	}
+	die "$prog: couldn't find \"$cmd\" on your PATH.\n";
+    }
+
+    if($exedir eq "") {
+      cmd2:
+	foreach $cmd ("Xvnc","vncpasswd") {
+	    for (split(/:/,$ENV{PATH})) {
+		if (-x "$_/$cmd") {
+		    next cmd2;
+		}
+	    }
+	    die "$prog: couldn't find \"$cmd\" on your PATH.\n";
+	}
+    }
+    else {
+      cmd3:
+	foreach $cmd ($exedir."Xvnc",$exedir."vncpasswd") {
+	    for (split(/:/,$ENV{PATH})) {
+		if (-x "$cmd") {
+		    next cmd3;
+		}
+	    }
+	    die "$prog: couldn't find \"$cmd\".\n";
+	}
+    }
+
+    if (!defined($ENV{HOME})) {
+	die "$prog: The HOME environment variable is not set.\n";
+    }
+
+    #
+    # Find socket constants. 'use Socket' is a perl5-ism, so we wrap it in an
+    # eval, and if it fails we try 'require "sys/socket.ph"'.  If this fails,
+    # we just guess at the values.  If you find perl moaning here, just
+    # hard-code the values of AF_INET and SOCK_STREAM.  You can find these out
+    # for your platform by looking in /usr/include/sys/socket.h and related
+    # files.
+    #
+
+    chop($os = `uname`);
+    chop($osrev = `uname -r`);
+
+    eval 'use Socket';
+    if ($@) {
+	eval 'require "sys/socket.ph"';
+	if ($@) {
+	    if (($os eq "SunOS") && ($osrev !~ /^4/)) {
+		$AF_INET = 2;
+		$SOCK_STREAM = 2;
+	    } else {
+		$AF_INET = 2;
+		$SOCK_STREAM = 1;
+	    }
+	} else {
+	    $AF_INET = &AF_INET;
+	    $SOCK_STREAM = &SOCK_STREAM;
+	}
+    } else {
+	$AF_INET = &AF_INET;
+	$SOCK_STREAM = &SOCK_STREAM;
+    }
+} 
+
+sub NotifyAboutDeprecation
+{
+    warn "\nWARNING: vncserver has been replaced by a systemd unit and is now considered deprecated and removed in upstream.\n";
+    warn "Please read /usr/share/doc/tigervnc/HOWTO.md for more information.\n";
+}

SOURCES/vncserver.man

@@ -0,0 +1,204 @@
+.TH vncserver 1 "" "TigerVNC" "Virtual Network Computing"
+.SH NAME
+vncserver \- start or stop a VNC server
+.SH SYNOPSIS
+.B vncserver
+.RI [: display# ]
+.RB [ \-name
+.IR desktop-name ]
+.RB [ \-geometry
+.IR width x height ]
+.RB [ \-depth
+.IR depth ]
+.RB [ \-pixelformat
+.IR format ]
+.RB [ \-fp
+.IR font-path ]
+.RB [ \-fg ]
+.RB [ \-autokill ]
+.RB [ \-noxstartup ]
+.RB [ \-xstartup
+.IR script ]
+.RI [ Xvnc-options... ]
+.br
+.BI "vncserver \-kill :" display#
+.br
+.BI "vncserver \-list"
+.SH DESCRIPTION
+.B vncserver
+is used to start a VNC (Virtual Network Computing) desktop.
+.B vncserver
+is a Perl script which simplifies the process of starting an Xvnc server.  It
+runs Xvnc with appropriate options and starts a window manager on the VNC
+desktop.
+
+.B vncserver
+can be run with no options at all. In this case it will choose the first
+available display number (usually :1), start Xvnc with that display number,
+and start the default window manager in the Xvnc session.  You can also
+specify the display number, in which case vncserver will attempt to start
+Xvnc with that display number and exit if the display number is not
+available.  For example:
+
+.RS
+vncserver :13
+.RE
+
+Editing the file $HOME/.vnc/xstartup allows you to change the applications run
+at startup (but note that this will not affect an existing VNC session.)
+
+.SH OPTIONS
+You can get a list of options by passing \fB\-h\fP as an option to vncserver.
+In addition to the options listed below, any unrecognised options will be
+passed to Xvnc - see the Xvnc man page, or "Xvnc \-help", for details.
+
+.TP
+.B \-name \fIdesktop-name\fP
+Each VNC desktop has a name which may be displayed by the viewer. The desktop
+name defaults to "\fIhost\fP:\fIdisplay#\fP (\fIusername\fP)", but you can
+change it with this option.  The desktop name option is passed to the xstartup
+script via the $VNCDESKTOP environment variable, which allows you to run a
+different set of applications depending on the name of the desktop.
+.
+.TP
+.B \-geometry \fIwidth\fPx\fIheight\fP
+Specify the size of the VNC desktop to be created. Default is 1024x768.
+.
+.TP
+.B \-depth \fIdepth\fP
+Specify the pixel depth (in bits) of the VNC desktop to be created. Default is
+24.  Other possible values are 8, 15 and 16 - anything else is likely to cause
+strange behaviour by applications.
+.
+.TP
+.B \-pixelformat \fIformat\fP
+Specify pixel format for Xvnc to use (BGRnnn or RGBnnn).  The default for
+depth 8 is BGR233 (meaning the most significant two bits represent blue, the
+next three green, and the least significant three represent red), the default
+for depth 16 is RGB565, and the default for depth 24 is RGB888.
+.
+.TP
+.B \-cc 3
+As an alternative to the default TrueColor visual, this allows you to run an
+Xvnc server with a PseudoColor visual (i.e. one which uses a color map or
+palette), which can be useful for running some old X applications which only
+work on such a display.  Values other than 3 (PseudoColor) and 4 (TrueColor)
+for the \-cc option may result in strange behaviour, and PseudoColor desktops
+must have an 8-bit depth.
+.
+.TP
+.B \-kill :\fIdisplay#\fP
+This kills a VNC desktop previously started with vncserver.  It does this by
+killing the Xvnc process, whose process ID is stored in the file
+"$HOME/.vnc/\fIhost\fP:\fIdisplay#\fP.pid".  The
+.B \-kill
+option ignores anything preceding the first colon (":") in the display
+argument.  Thus, you can invoke "vncserver \-kill $DISPLAY", for example at the
+end of your xstartup file after a particular application exits.
+.
+.TP
+.B \-fp \fIfont-path\fP
+If the vncserver script detects that the X Font Server (XFS) is running, it
+will attempt to start Xvnc and configure Xvnc to use XFS for font handling.
+Otherwise, if XFS is not running, the vncserver script will attempt to start
+Xvnc and allow Xvnc to use its own preferred method of font handling (which may
+be a hard-coded font path or, on more recent systems, a font catalog.)  In
+any case, if Xvnc fails to start, the vncserver script will then attempt to
+determine an appropriate X font path for this system and start Xvnc using
+that font path.
+
+The
+.B \-fp
+argument allows you to override the above fallback logic and specify a font
+path for Xvnc to use.
+.
+.TP
+.B \-fg
+Runs Xvnc as a foreground process.  This has two effects: (1) The VNC server
+can be aborted with CTRL-C, and (2) the VNC server will exit as soon as the
+user logs out of the window manager in the VNC session.  This may be necessary
+when launching TigerVNC from within certain grid computing environments.
+.
+.TP
+.B \-autokill
+Automatically kill Xvnc whenever the xstartup script exits.  In most cases,
+this has the effect of terminating Xvnc when the user logs out of the window
+manager.
+.
+.TP
+.B \-noxstartup
+Do not run the %HOME/.vnc/xstartup script after launching Xvnc.  This
+option allows you to manually start a window manager in your TigerVNC session.
+.
+.TP
+.B \-xstartup \fIscript\fP
+Run a custom startup script, instead of %HOME/.vnc/xstartup, after launching
+Xvnc. This is useful to run full-screen applications.
+.
+.TP
+.B \-list
+Lists all VNC desktops started by vncserver.
+
+.SH FILES
+Several VNC-related files are found in the directory $HOME/.vnc:
+.TP
+$HOME/.vnc/xstartup
+A shell script specifying X applications to be run when a VNC desktop is
+started.  If this file does not exist, then vncserver will create a default
+xstartup script which attempts to launch your chosen window manager.
+.TP
+/etc/tigervnc/vncserver-config-defaults
+The optional system-wide equivalent of $HOME/.vnc/config. If this file exists
+and defines options to be passed to Xvnc, they will be used as defaults for
+users. The user's $HOME/.vnc/config overrides settings configured in this file.
+The overall configuration file load order is: this file, $HOME/.vnc/config,
+and then /etc/tigervnc/vncserver-config-mandatory. None are required to exist.
+.TP
+/etc/tigervnc/vncserver-config-mandatory
+The optional system-wide equivalent of $HOME/.vnc/config. If this file exists
+and defines options to be passed to Xvnc, they will override any of the same
+options defined in a user's $HOME/.vnc/config. This file offers a mechanism
+to establish some basic form of system-wide policy. WARNING! There is
+nothing stopping users from constructing their own vncserver-like script
+that calls Xvnc directly to bypass any options defined in
+/etc/tigervnc/vncserver-config-mandatory.  Likewise, any CLI arguments passed
+to vncserver will override ANY config file setting of the same name. The
+overall configuration file load order is:
+/etc/tigervnc/vncserver-config-defaults, $HOME/.vnc/config, and then this file.
+None are required to exist.
+.TP
+$HOME/.vnc/config
+An optional server config file wherein options to be passed to Xvnc are listed
+to avoid hard-coding them to the physical invocation. List options in this file
+one per line. For those requiring an argument, simply separate the option from
+the argument with an equal sign, for example: "geometry=2000x1200" or
+"securitytypes=vncauth,tlsvnc". Options without an argument are simply listed
+as a single word, for example: "localhost" or "alwaysshared".
+.TP
+$HOME/.vnc/passwd
+The VNC password file.
+.TP
+$HOME/.vnc/\fIhost\fP:\fIdisplay#\fP.log
+The log file for Xvnc and applications started in xstartup.
+.TP
+$HOME/.vnc/\fIhost\fP:\fIdisplay#\fP.pid
+Identifies the Xvnc process ID, used by the
+.B \-kill
+option.
+
+.SH SEE ALSO
+.BR vncviewer (1),
+.BR vncpasswd (1),
+.BR vncconfig (1),
+.BR Xvnc (1)
+.br
+https://www.tigervnc.org
+
+.SH AUTHOR
+Tristan Richardson, RealVNC Ltd., D. R. Commander and others.
+
+VNC was originally developed by the RealVNC team while at Olivetti
+Research Ltd / AT&T Laboratories Cambridge.  TightVNC additions were
+implemented by Constantin Kaplinsky. Many other people have since
+participated in development, testing and support. This manual is part
+of the TigerVNC software suite.

SOURCES/xvnc.service

@@ -0,0 +1,38 @@
+# The vncserver service unit file
+#
+# Quick HowTo:
+# 1. Copy this file to /etc/systemd/system/xvnc@.service
+# 2. Copy xvnc.socket to /etc/systemd/system/xvnc.socket
+# 3. Run `systemctl daemon-reload`
+# 4. Run `systemctl enable xvnc.socket`
+#
+# DO NOT RUN THIS SERVICE if your local area network is
+# untrusted!  For a secure way of using VNC, you should
+# limit connections to the local host and then tunnel from
+# the machine you want to view VNC on (host A) to the machine
+# whose VNC output you want to view (host B)
+#
+# [user@hostA ~]$ ssh -v -C -L 590N:localhost:590M hostB
+#
+# this will open a connection on port 590N of your hostA to hostB's port 590M
+# (in fact, it ssh-connects to hostB and then connects to localhost (on hostB).
+# See the ssh man page for details on port forwarding)
+#
+# You can then point a VNC client on hostA at vncdisplay N of localhost and with
+# the help of ssh, you end up seeing what hostB makes available on port 590M
+#
+# Use "-nolisten tcp" to prevent X connections to your VNC server via TCP.
+#
+# Use "-localhost" to prevent remote VNC clients connecting except when
+# doing so through a secure tunnel.  See the "-via" option in the
+# `man vncviewer' manual page.
+
+
+[Unit]
+Description=XVNC Per-Connection Daemon
+
+[Service]
+ExecStart=-/usr/bin/Xvnc -inetd -query localhost -geometry 1024x768 -depth 24 -once -SecurityTypes=None
+User=nobody
+StandardInput=socket
+StandardError=syslog

SOURCES/xvnc.socket

@@ -0,0 +1,9 @@
+[Unit]
+Description=XVNC Server
+
+[Socket]
+ListenStream=5900
+Accept=yes
+
+[Install]
+WantedBy=sockets.target