Accept bare marker protocols, reject msb_right framebuffers, split the policy row conversion

client/server/server.go

@@ -2096,9 +2096,9 @@ func (s *Server) RespondApproval(ctx context.Context, msg *proto.RespondApproval
 	id, ok := ipcauth.CallerIdentity(ctx)
 	if !ok {
 		log.Warnf("refusing approval response for %s: the caller's identity cannot be verified on this control channel", msg.GetRequestId())
-		return nil, gstatus.Errorf(codes.PermissionDenied,
-			"answering a connection approval requires a control channel that carries the caller's identity. "+
-				"Reinstall the service on a socket that does: %s", reinstallCommand())
+		// Same envelope as the privileged-config refusals, so the CLI and the UI
+		// present the guidance instead of a raw gRPC error: see privilegeError.
+		return nil, privilegeError(unidentifiableCallerSummary(), reinstallCommand())
 	}
 	log.Infof("approval response for %s from caller %s: accept=%t view_only=%t",
 		msg.GetRequestId(), id, msg.GetAccept(), msg.GetViewOnly())

client/server/ssh_gate.go

@@ -233,6 +233,15 @@ func unidentifiedSummary(action string) string {
 		"Reinstall the service on a socket that carries the caller's identity.", capitalize(action), ipcauth.PrivilegedActor())
 }
 
+// unidentifiableCallerSummary covers an operation that needs to know who is
+// asking rather than a privileged caller, so unlike unidentifiedSummary it does
+// not name root: elevating would not help, only moving the daemon onto a socket
+// that carries the caller's identity.
+func unidentifiableCallerSummary() string {
+	return "Answering a connection approval requires a control channel that carries the caller's identity, " +
+		"and the daemon's current socket does not. Reinstall the service on one that does."
+}
+
 // reinstallCommand is the command that moves the daemon onto a socket whose
 // callers can be identified.
 func reinstallCommand() string {

client/vnc/server/capture_fb_linux.go

@@ -173,6 +173,14 @@ func validateFBLayout(bpp int, v *fbVarScreenInfo) error {
 			bpp, v.RedOffset, v.RedLen, v.GreenOffset, v.GreenLen, v.BlueOffset, v.BlueLen)
 	}
 
+	// msb_right marks a channel whose bits run the other way inside the pixel.
+	// Every swizzler reads them in normal order, so such a device would be
+	// decoded into mirrored channel values.
+	if v.RedMSBR != 0 || v.GreenMSBR != 0 || v.BlueMSBR != 0 {
+		return fmt.Errorf("unsupported %dbpp framebuffer layout: msb_right set (r=%d g=%d b=%d)",
+			bpp, v.RedMSBR, v.GreenMSBR, v.BlueMSBR)
+	}
+
 	switch bpp {
 	case 32:
 		// Offsets are honoured, channel widths are not.