two general comments to this function.

1) I think you should move out creating vnc dir
2) I propose to merge together touching and chmoding to minimalize race condition attack and simplify 

so something like
```
string GetVncDir( string user )
{
  const string cmd = sformat( "getent passwd %1", user);
  const string vnc_subdir = ".vnc";
  string line = ((map <string, any>)SCR::Execute( .target.bash_output, cmd))[ "stdout"]:"";
  string home_path = splitstring( line, ":")[ 5]:"/tmp";
  string vnc_dir = home_path + "/" + vnc_subdir;

  boolean succeeded = ExecuteAsUser( sformat( "mkdir -p %1", vnc_dir), user);

  if( !succeeded)
  {
      y2error( "Cannot create vnc dir '%1' for user '%2'", vnc_dir, user);
           
      return nil;
   }

   return vnc_dir;
}

string GetDefaultPasswdPath( string user)
{
  string vnc_dir = GetVncDir(user);
  if vnc_dir == nil
    return nil;

  const string passwd_file = vnc_dir + "/passwd";

    //here it would be nice to catch stderr, as even before cannot chmod file is really useless log entry ( and same for user cannot create file )
  boolean succeed = succeeded = ExecuteAsUser( sformat( "touch %1 && chmod 0600 %1", vnc_path), user );
  
  ... 
}
```