security(network): retire inherited VNC (NET-10)

build/dependencies.lock

@@ -207,11 +207,11 @@ legacy_channels = ["development"]
 [legacy_inventory]
 manifest = "build/legacy-manifest.json"
 schema = 1
-component_count = 328
-file_count = 1969
-byte_count = 260922113
+component_count = 326
+file_count = 1967
+byte_count = 260659274
 source_build_components = 232
-unresolved_components = 96
+unresolved_components = 94
 inherited_baseline = "07505ea58c7bba698d6b9220ff43946a43cac76b"
 
 [themes]

build/legacy-manifest.json

@@ -579,8 +579,8 @@
       "kind": "runtime",
       "path": "static/build/.tmp_update/bin/bloom-listener-audit",
       "file_count": 1,
-      "byte_count": 2723,
-      "tree_sha256": "d0d0cc448e9122be7275d73c474619bb0515a9785b7beecf11af0574f73756ed",
+      "byte_count": 2830,
+      "tree_sha256": "7ece6dcb6d57117033a2be3d275d47dafb8bb9f5a82eb6380e0bef92dadd1e4e",
       "source": "https://github.com/boburning/BloomOS",
       "source_revision": "release-commit",
       "license": "GPL-3.0-only",
@@ -1367,19 +1367,6 @@
       "build_recipe": null,
       "resolution": "replace-source-build-or-exclude"
     },
-    {
-      "id": "runtime-tmp-update-bin-vncserver",
-      "kind": "runtime",
-      "path": "static/build/.tmp_update/bin/vncserver",
-      "file_count": 1,
-      "byte_count": 41692,
-      "tree_sha256": "3dc532356c29271a15e00dc46f4d2d96b79b2cb1e78e9672a0766aeae9b9fdc4",
-      "source": null,
-      "source_revision": null,
-      "license": null,
-      "build_recipe": null,
-      "resolution": "replace-source-build-or-exclude"
-    },
     {
       "id": "runtime-tmp-update-bin-wget",
       "kind": "runtime",
@@ -1874,19 +1861,6 @@
       "build_recipe": null,
       "resolution": "replace-source-build-or-exclude"
     },
-    {
-      "id": "runtime-tmp-update-lib-libvncserver-so-1",
-      "kind": "runtime",
-      "path": "static/build/.tmp_update/lib/libvncserver.so.1",
-      "file_count": 1,
-      "byte_count": 221311,
-      "tree_sha256": "3ce79f4e60262c7628756b145a10d3401c2ba0c7275f66d2817ddab040c70556",
-      "source": null,
-      "source_revision": null,
-      "license": null,
-      "build_recipe": null,
-      "resolution": "replace-source-build-or-exclude"
-    },
     {
       "id": "runtime-tmp-update-lib-libx264-so-155",
       "kind": "runtime",
@@ -2282,8 +2256,8 @@
       "kind": "runtime",
       "path": "static/build/.tmp_update/script/network",
       "file_count": 5,
-      "byte_count": 19961,
-      "tree_sha256": "13e9a2fbae9c29f9f1909ef750630d8e04c6ecdd9b4e4cb958477ec5228d330b",
+      "byte_count": 20018,
+      "tree_sha256": "bd82793eb547e1e1d3a922e39040ce631fb27c0dd3a6d1efe6e90152e6a8db0d",
       "source": "https://github.com/OnionUI/Onion",
       "source_revision": "07505ea58c7bba698d6b9220ff43946a43cac76b",
       "license": "GPL-3.0-only",

docs/1.0_TEST_MATRIX.md

@@ -52,7 +52,7 @@ shoulder button.
 | Critical lifecycle | Exact 640x480 and 752x560 built-in projections; source/target/path and legacy-file rejection; boot/shutdown/save/low-battery/recovery/Safe Mode ignore theme/config/media; charging reflects bounded actual level; installer uses one deterministic surface; missing optional text/font fallback; signed Full-update boot/charging/shutdown/recovery checkpoint |
 | Settings | One sectioned surface; inline values; capability filtering; one-layer details; hidden Developer section; optional overlapping L1/R1 list paging |
 | Quick Settings | START from core surfaces; immediate brightness/volume/mute; capability-gated Wi-Fi opens the dedicated detail surface; Wi-Fi left/right never mutates the radio; readable battery; B/START close |
-| Network services | Desired/runtime separation; carrier without IPv4 remains acquiring/not-ready; canonical DHCP restart and bounded post-address listener reconciliation; SSH shell and SFTP independent key-only states; canonical transfer roots and modes; Saves read-only; private roots denied; traversal/symlink/path bounds; same-filesystem atomic publication; authorized-key import; quiesce/health; stale FTP/Telnet/FileBrowser/inherited-Samba/WPS/hotspot flags cannot activate listeners; process-aware listener audit; inherited FTP/Telnet/FileBrowser HTTP and rejected Samba launchers, configurations, and Tweaks exposure absent from newly assembled stable artifacts; WPS progress assets, WPS controls, inherited hotspot controls, and dormant hotspot mutation functions absent while fail-closed entrypoints and older-card process cleanup remain |
+| Network services | Desired/runtime separation; carrier without IPv4 remains acquiring/not-ready; canonical DHCP restart and bounded post-address listener reconciliation; SSH shell and SFTP independent key-only states; canonical transfer roots and modes; Saves read-only; private roots denied; traversal/symlink/path bounds; same-filesystem atomic publication; authorized-key import; quiesce/health; stale FTP/Telnet/FileBrowser/inherited-Samba/WPS/hotspot/VNC flags cannot activate listeners; process-aware listener audit including inherited TCP/5900 and vncserver; inherited FTP/Telnet/FileBrowser HTTP, rejected Samba, and unresolved VNC launchers, configurations, libraries, and Tweaks exposure absent from newly assembled stable artifacts; WPS progress assets, WPS controls, inherited hotspot controls, and dormant hotspot mutation functions absent while fail-closed entrypoints and older-card process cleanup remain |
 | Wi-Fi profile store | JFFS2 private root; stdin-only bounded replacement and `bloomctl network profile upsert ID`; requested/document ID binding; explicit `network forget ID`; inactive-ID deletion with active-profile refusal; active forget only after a separately confirmed fallback connection; schema/unknown-field/count/size enforcement; WPA2-PSK, explicit open, and manual hidden WPA2; WEP and hidden open denial; unique IDs/SSIDs; redacted status; explicit local credential-free UI list with one active marker; sanitized `network connect status` with internal profile-handle validation and public omission; mode-0600 atomic single-profile supplicant projection; symlink, occupied-slot, live-lock, invalid-profile, and prior-byte preservation |
 | Wi-Fi scan API | Asynchronous start; redacted status; explicit ID-scoped local results; cancel and terminal discard; one active worker; five-second rate limit; 15-second runtime; 64-KiB raw ceiling; 32 unique printable SSIDs; eight-operation history; open/WPA2-PSK/unsupported classification; duplicate signal reconciliation; backend failure, timeout, oversize, unsafe-path, stale/live-lock, and unsupported-hardware handling |
 | Wi-Fi UI | Original Mini hidden; Settings, Shell Quick Settings, and GameSwitcher Quick Settings converge on `--settings-wifi`; direct radio toggle removed; bounded fixed-argv profile-list load outside render; connection state and saved-network detail; selectable Scan/Cancel row and read-only discovered networks; active-only 100-ms SDL wake; deferred GameSwitcher until cancellation discard; single-flight nonblocking fixed-argv scan client; 16-KiB output and five-second deadline; child process-group cleanup; controller-owned start/status/results/discard and cancel-during-start sequencing; 250-ms status opportunities; exact profile/scan/ack schemas; 16 profiles and 32 networks; unique bounded IDs/SSIDs; one active profile; fixed scan phases/errors; terminal history discarded; open/WPA2 profile form with shared keyboard, masked secret, fixed profile-upsert argv, escaped stdin JSON, strict ID/SSID/PSK validation, explicit secret clearing, nonblocking submit/poll, 4-KiB acknowledgement cap, exact upsert response, timeout process-group cleanup, exact saved-ID reuse, 104-bit no-follow random new handles, collision/security/full-store rejection, one editing/submitting controller with 100-ms poll opportunities, exact cancellation, terminal clearing, bounded focus return, supported scan-result selection, explicit saved-not-connected result, and no implicit association; explicit inactive-profile X/confirm forget flow; active-row refusal in Shell and store; fixed nonblocking delete; exact acknowledgement; terminal projection reload; graceful TERM cleanup before bounded KILL; exact guarded-connect status model with fixed phases/operations/failures, lease consistency, 64-byte transaction-ID and 300-second deadline ceilings, and discarded transaction/overlay identity; fixed no-follow `network connect status` loader with less-than-4-KiB output, five-second read ceiling, and stale-state clearing; separately typed single-flight nonblocking status request with process-group timeout and generic-poller refusal; controller-owned single request, 100-ms opportunities, duplicate-begin refusal, typed terminal state, teardown reaping, explicit guarded-state presentation, one-second freshness, fail-closed mutation gating for stale/unavailable/lease-armed/rollback-failed results, read-only refresh without queued intent, and exit teardown; credential and unknown-field rejection; passwords absent from arguments, logs, screenshots, durable Shell state, and evidence |

docs/SECURITY.md

@@ -15,7 +15,7 @@ public-key authentication only, and refuses unknown or changed host keys.
 
 Inherited Onion listener flags are migration-only input. Bloom reconciliation
 never starts FTP, Telnet, whole-card FileBrowser HTTP, inherited Samba, WPS, or
-the inherited hotspot, even when stale flags remain on the SD card. It actively
+the inherited hotspot or VNC server, even when stale flags remain on the SD card. It actively
 stops their known processes. `bloom-listener-audit` provides a bounded,
 process-aware check that names service classes without publishing addresses.
 The dormant FileBrowser executable, database, web theme, icon, and boot-time
@@ -38,6 +38,10 @@ older-card compatibility.
 Stable Tweaks does not expose WPS or the inherited hotspot. The WPS compatibility
 entry point remains only to reject inherited callers, while hotspot state is
 migration-only until NET-08 supplies a separately reviewed transactional owner.
+The unresolved inherited VNC executable and library, direct input/display
+launcher, and stable Tweaks controls are excluded. Older-card `.vncServer`
+intent is migration-only, and reconciliation plus listener audit detect and stop
+the exact inherited process without publishing an address.
 The reviewed key-only Dropbear transport is the only stable remote listener;
 SFTP is independently gated and confined through that same transport.
 Its chroot is materialized from the versioned canonical transfer policy rather

src/tweaks/appstate.h

@@ -16,12 +16,10 @@ bool isMenu(List *target)
 }
 
 static List _menu_network;
-static List _menu_vnc;
 
 void menu_network_free_all(void)
 {
     list_free(&_menu_network);
-    list_free(&_menu_vnc);
 }
 
 static List _menu_icons;

src/tweaks/network.h

@@ -19,7 +19,6 @@
 #include "utils/json.h"
 #include "utils/keystate.h"
 #include "utils/netinfo.h"
-#include "utils/process.h"
 
 #include "./appstate.h"
 
@@ -31,13 +30,9 @@ static struct network_s {
     bool manual_tz;
     bool check_updates;
     bool keep_alive;
-    bool vncserv;
     bool loaded;
     bool force_wifi_on_startup;
-    int vncfps;
-} network_state = {
-    .vncfps = 20,
-};
+} network_state;
 
 void network_loadState(void)
 {
@@ -50,8 +45,6 @@ void network_loadState(void)
     network_state.manual_tz = config_flag_get(".manual_tz");
     network_state.check_updates = config_flag_get(".checkUpdates");
     network_state.keep_alive = config_flag_get(".keepServicesAlive");
-    network_state.vncserv = config_flag_get(".vncServer");
-    config_get(".vncfps", CONFIG_INT, &network_state.vncfps);
     network_state.loaded = true;
 }
 
@@ -147,80 +140,10 @@ void network_setTzSelectState(void *pt)
     config_setString(".tz", utc_str);
 }
 
-void network_toggleVNC(void *pt)
-{
-    char command_start[STR_MAX];
-    char command_stop[STR_MAX];
-
-    int new_fps = (int)network_state.vncfps;
-
-    sprintf(command_start, "/mnt/SDCARD/.tmp_update/bin/vncserver -k /dev/input/event0 -F %d -r 180 > /dev/null 2>&1 &", new_fps);
-    sprintf(command_stop, "killall -9 vncserver");
-
-    if (!network_state.vncserv) {
-        network_state.vncserv = true;
-        network_setState(&network_state.vncserv, ".vncServer", true);
-        reset_menus = true;
-        if (!process_isRunning("vncserver")) {
-            system(command_start);
-        }
-    }
-    else {
-        network_state.vncserv = false;
-        network_setState(&network_state.vncserv, ".vncServer", false);
-        reset_menus = true;
-        if (process_isRunning("vncserver")) {
-            system(command_stop);
-        }
-    }
-}
-
-void network_setVNCFPS(void *pt)
-{
-    network_state.vncfps = ((ListItem *)pt)->value;
-    config_setNumber(".vncfps", network_state.vncfps);
-
-    if (network_state.vncserv) {
-        network_toggleVNC(pt);
-        network_state.vncserv = false;
-        network_setState(&network_state.vncserv, ".vncServer", false);
-        reset_menus = true;
-    }
-}
-
-void menu_vnc(void *pt)
-{
-    ListItem *item = (ListItem *)pt;
-    item->value = (int)network_state.vncserv;
-    if (!_menu_vnc._created) {
-        _menu_vnc = list_create(2, LIST_SMALL);
-        strcpy(_menu_vnc.title, "VNC");
-        list_addItem(&_menu_vnc,
-                     (ListItem){
-                         .label = "Enable",
-                         .item_type = TOGGLE,
-                         .value = (int)network_state.vncserv,
-                         .action = network_toggleVNC});
-        list_addItemWithInfoNote(&_menu_vnc,
-                                 (ListItem){
-                                     .label = "Framerate",
-                                     .item_type = MULTIVALUE,
-                                     .value_max = 20,
-                                     .value_min = 1,
-                                     .value = (int)network_state.vncfps,
-                                     .action = network_setVNCFPS},
-                                 "Set the framerate of the VNC server\n"
-                                 "between 1 and 20. The higher the \n"
-                                 "framerate the more CPU it will use \n");
-    }
-    menu_stack[++menu_level] = &_menu_vnc;
-    header_changed = true;
-}
-
 void menu_network(void *_)
 {
     if (!_menu_network._created) {
-        _menu_network = list_create(3, LIST_SMALL);
+        _menu_network = list_create(2, LIST_SMALL);
         strcpy(_menu_network.title, "Network");
 
         network_loadState();
@@ -230,17 +153,6 @@ void menu_network(void *_)
                          .label = "IP address: N/A",
                          .disabled = true,
                          .action = NULL});
-        list_addItemWithInfoNote(&_menu_network,
-                                 (ListItem){
-                                     .label = "VNC: Screen share...",
-                                     .item_type = TOGGLE,
-                                     .disabled = !settings.wifi_on,
-                                     .alternative_arrow_action = true,
-                                     .arrow_action = network_toggleVNC,
-                                     .value = (int)network_state.vncserv,
-                                     .action = menu_vnc},
-                                 "Connect to your MMP from another device\n"
-                                 "to view the screen and interact with it.");
         list_addItemWithInfoNote(&_menu_network,
                                  (ListItem){
                                      .label = "Disable services in game",

static/build/.tmp_update/bin/bloom-listener-audit

@@ -45,14 +45,16 @@ listener_present '(:|[.])23[[:space:]].*(telnetd|busybox)' && append_unique proh
 listener_present '(:|[.])(80|8080)[[:space:]].*(filebrowser|uhttpd)' && append_unique prohibited filebrowser_http
 listener_present '(:|[.])(137|138|139|445)[[:space:]].*smbd' && append_unique prohibited samba
 listener_present '(:|[.])(53|67)[[:space:]].*(dnsmasq|hostapd)' && append_unique prohibited hotspot
+listener_present '(:|[.])5900[[:space:]].*vncserver' && append_unique prohibited vnc
 listener_present '(:|[.])22[[:space:]].*dropbear' && append_unique reviewed key_only_ssh
 if listener_present '(:|[.])2222[[:space:]].*dropbear'; then
     append_unique reviewed key_only_ssh_shadow
     append_unique prohibited ssh_shadow
 fi
 
 for mapping in 'bftpd:ftp' 'ftpd:ftp' 'telnetd:telnet' 'filebrowser:filebrowser_http' \
-    'uhttpd:filebrowser_http' 'smbd:samba' 'hostapd:hotspot' 'dnsmasq:hotspot'; do
+    'uhttpd:filebrowser_http' 'smbd:samba' 'hostapd:hotspot' 'dnsmasq:hotspot' \
+    'vncserver:vnc'; do
     process=${mapping%%:*}
     service=${mapping#*:}
     if process_present "$process"; then

static/build/.tmp_update/script/network/update_networking.sh

@@ -14,7 +14,7 @@ export PATH="$sysdir/bin:$PATH"
 is_booting=$([ -f /tmp/is_booting ] && echo 1 || echo 0)
 
 # Legacy listener flags are migration input only. Bloom never restores them.
-legacy_services="httpState ftpState telnetState smbdState authftpState authhttpState hotspotState"
+legacy_services="httpState ftpState telnetState smbdState authftpState authhttpState hotspotState vncServer"
 
 logfile=$(basename "$0" .sh)
 . $sysdir/script/log.sh
@@ -130,7 +130,7 @@ lockdown_legacy_listeners() {
     # cannot see it. Match only the exact applet argv and kill only that PID.
     stop_busybox_telnet
 
-    for process in bftpd filebrowser telnetd hostapd dnsmasq smbd; do
+    for process in bftpd filebrowser telnetd hostapd dnsmasq smbd vncserver; do
         if is_running "$process"; then
             killall -9 "$process"
             log "Bloom security: stopped inherited $process process"
@@ -148,8 +148,9 @@ disable_all_services() {
     disable_flag httpState
     disable_flag authhttpState
     disable_flag smbdState
+    disable_flag vncServer
 
-    for process in dropbear bftpd filebrowser telnetd hostapd dnsmasq smbd; do
+    for process in dropbear bftpd filebrowser telnetd hostapd dnsmasq smbd vncserver; do
         if is_running $process; then
             killall -9 $process
         fi

test/shell/bloom_shell_runtime.bats

@@ -212,7 +212,7 @@
     ! grep -F 'bin/filebrowser' "$runtime"
     grep -F 'filebrowser' /workspace/static/build/.tmp_update/bin/bloom-listener-audit
     network=/workspace/static/build/.tmp_update/script/network/update_networking.sh
-    grep -F 'for process in bftpd filebrowser telnetd hostapd dnsmasq smbd; do' "$network"
+    grep -F 'for process in bftpd filebrowser telnetd hostapd dnsmasq smbd vncserver; do' "$network"
     ! grep -F 'filebrowserbin=' "$network"
     ! grep -F 'check_httpstate()' "$network"
     ! grep -F 'http_authed()' "$network"

test/shell/ci_validation.bats

@@ -165,3 +165,19 @@
     [ "$status" -eq 0 ]
     [ "$output" = "full" ]
 }
+
+@test "stable VNC payload retirement keeps packaging exhaustive" {
+    scope=/workspace/tools/ci-scope.sh
+    run sh -c "printf '%s\n' static/build/.tmp_update/bin/vncserver | '$scope' build"
+    [ "$status" -eq 0 ]
+    [ "$output" = "full" ]
+    run sh -c "printf '%s\n' static/build/.tmp_update/lib/libvncserver.so.1 | '$scope' static-analysis"
+    [ "$status" -eq 0 ]
+    [ "$output" = "none" ]
+    run sh -c "printf '%s\n' static/build/.tmp_update/bin/vncserver | '$scope' risk"
+    [ "$status" -eq 0 ]
+    [ "$output" = "3" ]
+    run sh -c "printf '%s\n' static/build/.tmp_update/lib/libvncserver.so.1 | '$scope' shell-tests"
+    [ "$status" -eq 0 ]
+    [ "$output" = "full" ]
+}

test/shell/legacy_manifest.bats

@@ -6,7 +6,7 @@
         --manifest /workspace/build/legacy-manifest.json
 
     [ "$status" -eq 0 ]
-    [[ "$output" == "legacy manifest validate: 328 components" ]]
+    [[ "$output" == "legacy manifest validate: 326 components" ]]
     [ ! -e "/workspace/static/packages/RApp/SNK - Neo Geo (GnGeo)" ]
     [ ! -e "/workspace/static/packages/RApp/PICO-8 (PICO-8 standalone)" ]
     [ ! -e "/workspace/static/packages/RApp/SCUMM (ScummVM standalone)" ]