FR: offline cross-protocol clipboard audit from recordings (guacclip)

[davekempe]

Summary

Offer offline extraction of clipboard artifacts (text and images) from existing session recordings, across all protocols, using guacd's guacclip tool. This would be a cross-protocol audit/compliance capability, complementing the SSH typescript recording added in #159.

Background

The guacd uplift in v1.8.2 (guacamole-server 1.6.0-302) brought in guacclip (from the SPICE work, GUACAMOLE-261), a standalone "clipboard artifact extractor" that reads a Guacamole .guac protocol dump and reassembles everything transferred over clipboard streams. It is the clipboard sibling of guacenc (video) and guaclog (keystroke log), and it depends only on libguac (it is not SPICE-specific).

rustguac already records sessions by teeing the full proxied protocol stream, and clipboard instructions flow through that proxy for every protocol (SSH, RDP, VNC, web, VDI). So the recordings we already produce contain the clipboard data. guacclip could therefore be run offline, on the host, against existing recordings to answer "what was copied to and from the clipboard during this session," for any protocol.

guacclip options include --direction guest-to-client|client-to-guest, --include image|text|all, --dedup, and --max-item-bytes.

Why

• A frequent audit/compliance ask: a record of data moved via the clipboard, alongside the who-did-what that typescripts (Feature Request: SSH Typescript Recording Support #159) provide for SSH.
• Works for all protocols from recordings we already capture, with no change to the live session path.

Considerations

• Sensitivity. Clipboard content can contain pasted passwords and secrets, exactly like typescripts. This should get the same restricted handling as Feature Request: SSH Typescript Recording Support #159: retrieval requires host or storage access, content is not freely downloadable through the web UI, and any at-rest storage follows the LUKS-at-rest approach (see also the per-file encryption discussion in Feature Request: Per-file encryption of SSH typescript recordings #163).
• Build. guacclip only needs libguac, but rustguac currently disables the guacd CLI tools (--disable-guacenc --disable-guaclog, and by default --disable-guacclip) because it tees its own stream. Adopting this means building and shipping guacclip (or invoking it host-side).
• Access model. Likely list-only in the UI (confirm a session's clipboard was captured), with actual extraction requiring host access, mirroring the typescript register.

Open questions

• Capture both directions or just guest-to-client?
• Text only, or images too?
• Retention and access model, and how it composes with recording rotation.

Not scheduled; filing to track the idea while the context is fresh (byproduct of the v1.8.2 guacd uplift).