TigerVNC

Validate TigerVNC behaviors under the Secure Sandbox.

Objectives

• Enforce network controls for VNC connections.
• Verify clipboard sharing isolation.

Preconditions

• Windows target with Turbo Launcher and Secure Sandbox.
• TigerVNC installed.

Controls Under Test

• runtime.networking.egressDefaultAction.
• runtime.dataMotion.rules[].

Test Scenarios

ID	Canonical ID	Scenario	Procedure	Expected Outcome
SCEN-REMOTE-TIGERVNC-01	NET-EGRESS-01	Connect to Disallowed IP	Connect to <IP>.	Connection fails (timeout or proxy deny).
SCEN-REMOTE-TIGERVNC-02	NET-EGRESS-10	Connect via Designated Proxy	Connect to allowlisted VNC server via configured proxy.	Connection succeeds only when proxy identity/pinning is valid; traffic traverses the proxy; on mismatch, TLS handshake fails. Audit includes proxyEnforced: true and reason when denied.
SCEN-REMOTE-TIGERVNC-03	DM-CLIP-01	Clipboard Outbound	Copy text inside VNC session; attempt paste on host.	Denied or processed per policy.
SCEN-REMOTE-TIGERVNC-04	DM-CLIP-06	Clipboard Inbound	Copy text on host; paste into VNC session.	Denied or processed per policy.

Evidence Requirements

• network events: protocol (tcp/5900+), destination, action.
• dataMotion events: channel: "clipboard".