fix: refuse a running-origin restore for every password-gated VNC display

The guard keyed on CNI, but a user, tap or bridge VM can be started with
--vnc-password too, and the password is never persisted: its relaunch
came back unauthenticated. The record now carries a non-secret
vnc_password_set bit written at launch and cleared at stop, and restore
refuses any running origin whose display is password-gated. Linux test
drives the refusal against the fake qemu and checks it never terminates.

Author: CMGS

cmd/vm/handler.go

@@ -37,6 +37,7 @@ type record struct {
 	Storage      int64    `json:"storage,omitempty"` // system-disk virtual size in bytes
 	VNCDisp      int      `json:"vnc"`
 	VNCPass      string   `json:"-"` // launch-scoped, set from the flag each start; never persisted (would leak at rest)
+	VNCPassSet   bool     `json:"vnc_password_set,omitempty"`
 	SSHPort      int      `json:"ssh_port"`
 	NetMode      string   `json:"net_mode,omitempty"`
 	Hugepages    bool     `json:"hugepages,omitempty"`

cmd/vm/lifecycle.go

@@ -118,7 +118,7 @@ func (h *Handler) Stop(cmd *cobra.Command, args []string) error {
 			terminate(ctx, r, grace)
 			quiesceNet(cmd, r)
 			stopVNCProxy(ctx, dir)
-			r.PID, r.VNCDisp, r.VNCPass = 0, -1, "" // VNC is launch-scoped: gone with the qemu it belonged to
+			r.PID, r.VNCDisp, r.VNCPass, r.VNCPassSet = 0, -1, "", false // VNC is launch-scoped: gone with the qemu it belonged to
 			return saveRec(dir, r)
 		}); err != nil {
 			return err
@@ -296,6 +296,7 @@ func (h *Handler) launch(cmd *cobra.Command, dir string, r *record) error {
 			return fmt.Errorf("start vnc proxy: %w", err)
 		}
 	}
+	r.VNCPassSet = r.VNCPass != ""
 	return saveRec(dir, r)
 }
 

cmd/vm/lifecycle_test.go

@@ -51,6 +51,30 @@ func TestRMAdoptsQEMUWhenRecordPIDWasNotCommitted(t *testing.T) {
 	}
 }
 
+func TestRestoreRefusesRunningPasswordedVNC(t *testing.T) {
+	stateDir := t.TempDir()
+	vmDir, pid := startUnrecordedQEMU(t, stateDir, "macos-demo")
+	r, err := loadRec(vmDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	r.VNCDisp, r.VNCPassSet = 7, true
+	if err := saveRec(vmDir, r); err != nil {
+		t.Fatal(err)
+	}
+	cmd := newLifecycleTestCommand(t, stateDir)
+	cmd.Flags().String("tag", "", "")
+	cmd.Flags().Bool("force", true, "")
+
+	err = NewHandler().Restore(cmd, []string{"macos-demo"})
+	if err == nil || !strings.Contains(err.Error(), "password-gated VNC") {
+		t.Fatalf("Restore error = %v, want the password-gated VNC refusal", err)
+	}
+	if !utils.VerifyProcessCmdline(pid, qemuBinary, filepath.Join(vmDir, "disk.qcow2")) {
+		t.Error("qemu was terminated by a refused restore")
+	}
+}
+
 func TestCloneRejectsRunningSource(t *testing.T) {
 	stateDir := t.TempDir()
 	startUnrecordedQEMU(t, stateDir, "macos-src")

cmd/vm/snapshot.go

@@ -67,8 +67,8 @@ func (h *Handler) Restore(cmd *cobra.Command, args []string) error {
 			if force, _ := cmd.Flags().GetBool("force"); !force {
 				return fmt.Errorf("vm %q is running; stop it first or pass --force to stop+restore", r.Name)
 			}
-			if r.Netns != "" && r.VNCDisp >= 0 {
-				return fmt.Errorf("vm %q serves VNC over CNI and a relaunch cannot carry its password; stop it, restore, then start --vnc %d --vnc-password", r.Name, r.VNCDisp)
+			if r.VNCDisp >= 0 && (r.VNCPassSet || r.Netns != "") {
+				return fmt.Errorf("vm %q serves a password-gated VNC display and a relaunch cannot carry the password; stop it, restore, then start --vnc %d --vnc-password", r.Name, r.VNCDisp)
 			}
 			terminate(ctx, r, stopGracePeriod)
 			r.PID = 0