Qubes/core-admin-client
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Do not check for object existence when got it with another Admin API call

Browse Source 
When qubesd returns an name of VM or other object, as part of another
call (reading a property, listing devices etc), it's safe to assume that
object exists. Do not try to list it, which could be prevented by qrexec
policy. This means a VM object would be returned (for example in
vm.netvm property), which potentially could not be listed through
app.domains collection. This may lead to some corner cases, but
generally should ease handling of restricted policy.

This does not affect practical information the management VM have access
too, as those names are already returned. It's just client side python
wrapper that didn't allowed to access them.

QubesOS/qubes-issues#5099
This commit is contained in:
Marek Marczykowski-Górecki 2019-06-14 17:10:21 +02:00
parent 83b1fc6c58
commit 5315bbf8f9
No known key found for this signature in database
GPG Key ID: 063938BA42CFA724
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
qubesadmin/base.py
View File

@ -233,7 +233,7 @@ class PropertyHolder(object):
if prop_type == 'vm':
if value == '':
return None
return self.app.domains[value]
return self.app.domains.get_blind(value)
if prop_type == 'label':
if value == '':
return None

2
qubesadmin/devices.py
View File

@ -209,7 +209,7 @@ class DeviceCollection(object):
['True', 'yes', True])
if persistent is not None and dev_persistent != persistent:
continue
backend_domain = self._vm.app.domains[backend_domain]
backend_domain = self._vm.app.domains.get_blind(backend_domain)
yield DeviceAssignment(backend_domain, ident, options,
persistent=dev_persistent,
frontend_domain=self._vm,