qvm_backup.py 8.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222
  1. # -*- encoding: utf8 -*-
  2. #
  3. # The Qubes OS Project, http://www.qubes-os.org
  4. #
  5. # Copyright (C) 2017 Marek Marczykowski-Górecki
  6. # <marmarek@invisiblethingslab.com>
  7. #
  8. # This program is free software; you can redistribute it and/or modify
  9. # it under the terms of the GNU Lesser General Public License as published by
  10. # the Free Software Foundation; either version 2.1 of the License, or
  11. # (at your option) any later version.
  12. #
  13. # This program is distributed in the hope that it will be useful,
  14. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  15. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  16. # GNU Lesser General Public License for more details.
  17. #
  18. # You should have received a copy of the GNU Lesser General Public License along
  19. # with this program; if not, see <http://www.gnu.org/licenses/>.
  20. '''qvm-backup tool'''
  21. import asyncio
  22. import functools
  23. import getpass
  24. import os
  25. import signal
  26. import sys
  27. import yaml
  28. try:
  29. import qubesadmin.events
  30. have_events = True
  31. except ImportError:
  32. have_events = False
  33. import qubesadmin.tools
  34. from qubesadmin.exc import QubesException
  35. backup_profile_dir = '/etc/qubes/backup'
  36. parser = qubesadmin.tools.QubesArgumentParser()
  37. parser.add_argument("--yes", "-y", action="store_true",
  38. dest="yes", default=False,
  39. help="Do not ask for confirmation")
  40. group = parser.add_mutually_exclusive_group()
  41. group.add_argument('--profile', action='store',
  42. help='Perform backup defined by a given profile')
  43. no_profile = group.add_argument_group('Profile setup',
  44. 'Manually specify profile options')
  45. no_profile.add_argument("--exclude", "-x", action="append",
  46. dest="exclude_list", default=[],
  47. help="Exclude the specified VM from the backup (may be "
  48. "repeated)")
  49. no_profile.add_argument("--dest-vm", "-d", action="store",
  50. dest="appvm", default=None,
  51. help="Specify the destination VM to which the backup "
  52. "will be sent (implies -e)")
  53. no_profile.add_argument("--encrypt", "-e", action="store_true",
  54. dest="encrypted", default=True,
  55. help="Ignored, backup is always encrypted")
  56. no_profile.add_argument("--passphrase-file", "-p", action="store",
  57. dest="passphrase_file", default=None,
  58. help="Read passphrase from a file, or use '-' to read "
  59. "from stdin")
  60. no_profile.add_argument("--compress", "-z", action="store_true",
  61. dest="compression", default=False,
  62. help="Compress the backup")
  63. no_profile.add_argument("--compress-filter", "-Z", action="store",
  64. dest="compression",
  65. help="Specify a non-default compression filter program "
  66. "(default: gzip)")
  67. no_profile.add_argument('--save-profile', action='store',
  68. help='Save profile under selected name for further use.'
  69. 'Available only in dom0.')
  70. no_profile.add_argument("backup_location", action="store", default=None,
  71. nargs='?',
  72. help="Backup location (absolute directory path, "
  73. "or command to pipe backup to)")
  74. no_profile.add_argument("vms", nargs="*", action=qubesadmin.tools.VmNameAction,
  75. help="Backup only those VMs")
  76. def write_backup_profile(output_stream, args, passphrase=None):
  77. '''Format backup profile and print it to *output_stream* (a file or
  78. stdout)
  79. :param output_stream: file-like object ro print the profile to
  80. :param args: parsed arguments
  81. :param passphrase: passphrase to use
  82. '''
  83. profile_data = {}
  84. if args.vms:
  85. profile_data['include'] = args.vms
  86. else:
  87. profile_data['include'] = [
  88. '$type:AppVM', '$type:TemplateVM', '$type:StandaloneVM']
  89. if args.exclude_list:
  90. profile_data['exclude'] = args.exclude_list
  91. if passphrase:
  92. profile_data['passphrase_text'] = passphrase
  93. if args.compression:
  94. profile_data['compression'] = args.compression
  95. if args.appvm:
  96. profile_data['destination_vm'] = args.appvm
  97. else:
  98. profile_data['destination_vm'] = 'dom0'
  99. profile_data['destination_path'] = args.backup_location
  100. yaml.safe_dump(profile_data, output_stream)
  101. def print_progress(expected_profile, _subject, _event, backup_profile,
  102. progress):
  103. '''Event handler for reporting backup progress'''
  104. if backup_profile != expected_profile:
  105. return
  106. sys.stderr.write('\rMaking a backup... {:.02f}%'.format(float(progress)))
  107. def main(args=None, app=None):
  108. '''Main function of qvm-backup tool'''
  109. args = parser.parse_args(args, app=app)
  110. profile_path = None
  111. if args.profile is None:
  112. if args.backup_location is None:
  113. parser.error('either --profile or \'backup_location\' is required')
  114. if args.app.qubesd_connection_type == 'socket':
  115. # when running in dom0, we can create backup profile, including
  116. # passphrase
  117. if args.save_profile:
  118. profile_name = args.save_profile
  119. else:
  120. # don't care about collisions because only the user in dom0 can
  121. # trigger this, and qrexec policy should not allow random VM
  122. # to execute the same backup in the meantime
  123. profile_name = 'backup-run-{}'.format(os.getpid())
  124. # first write the backup profile without passphrase, to display
  125. # summary
  126. profile_path = os.path.join(
  127. backup_profile_dir, profile_name + '.conf')
  128. with open(profile_path, 'w') as f_profile:
  129. write_backup_profile(f_profile, args)
  130. else:
  131. if args.save_profile:
  132. parser.error(
  133. 'Cannot save backup profile when running not in dom0')
  134. # unreachable - parser.error terminate the process
  135. return 1
  136. print('To perform the backup according to selected options, '
  137. 'create backup profile ({}) in dom0 with following '
  138. 'content:'.format(
  139. os.path.join(backup_profile_dir, 'profile_name.conf')))
  140. write_backup_profile(sys.stdout, args)
  141. print('# specify backup passphrase below')
  142. print('passphrase_text: ...')
  143. return 1
  144. else:
  145. profile_name = args.profile
  146. backup_summary = args.app.qubesd_call(
  147. 'dom0', 'admin.backup.Info', profile_name)
  148. print(backup_summary.decode())
  149. if not args.yes:
  150. if input("Do you want to proceed? [y/N] ").upper() != "Y":
  151. if args.profile is None and not args.save_profile:
  152. os.unlink(profile_path)
  153. return 0
  154. if args.profile is None:
  155. if args.passphrase_file is not None:
  156. pass_f = open(args.passphrase_file) \
  157. if args.passphrase_file != "-" else sys.stdin
  158. passphrase = pass_f.readline().rstrip()
  159. if pass_f is not sys.stdin:
  160. pass_f.close()
  161. else:
  162. prompt = ("Please enter the passphrase that will be used to "
  163. "encrypt and verify the backup: ")
  164. passphrase = getpass.getpass(prompt)
  165. if getpass.getpass("Enter again for verification: ") != passphrase:
  166. parser.error_runtime("Passphrase mismatch!")
  167. with open(profile_path, 'w') as f_profile:
  168. write_backup_profile(f_profile, args, passphrase)
  169. loop = asyncio.get_event_loop()
  170. if have_events:
  171. # pylint: disable=no-member
  172. events_dispatcher = qubesadmin.events.EventsDispatcher(args.app)
  173. events_dispatcher.add_handler('backup-progress',
  174. functools.partial(print_progress, profile_name))
  175. events_task = asyncio.ensure_future(
  176. events_dispatcher.listen_for_events())
  177. loop.add_signal_handler(signal.SIGINT,
  178. args.app.qubesd_call, 'dom0', 'admin.backup.Cancel', profile_name)
  179. try:
  180. loop.run_until_complete(loop.run_in_executor(None,
  181. args.app.qubesd_call, 'dom0', 'admin.backup.Execute', profile_name))
  182. except QubesException as err:
  183. print('\nBackup error: {}'.format(err), file=sys.stderr)
  184. return 1
  185. finally:
  186. if have_events:
  187. events_task.cancel()
  188. try:
  189. loop.run_until_complete(events_task)
  190. except asyncio.CancelledError:
  191. pass
  192. loop.close()
  193. if args.profile is None and not args.save_profile:
  194. os.unlink(profile_path)
  195. print('\n')
  196. return 0
  197. if __name__ == '__main__':
  198. sys.exit(main())