core-admin/qubes-rpc-policy/admin-local-ro

## This file is included from all local read-only admin.* policy files
## _in default configuration_. To allow only specific action,
## edit specific policy file.

## Note that policy parsing stops at the first match,
## so adding anything below "$anyvm $anyvm action" line will have no effect

## Please use a single # to start your custom comments

## Include all already having write access
$include:include/admin-local-rwx

## Add your entries here, make sure to append ",target=dom0" to all allow/ask actions
Generate policy for Admin API calls based on annotations on actual methods This ease Admin API administration, and also adds checking if qrexec policy + scripts matches actual Admin API methods implementation. The idea is to classify every Admin API method as either local read-only, local read-write, global read-only or global read-write. Where local/global means affecting a single VM, or the whole system. See QubesOS/qubes-issues#2871 for details. Fixes QubesOS/qubes-issues#2871 2017-06-27 01:55:17 +02:00			`## This file is included from all local read-only admin.* policy files`
			`## _in default configuration_. To allow only specific action,`
			`## edit specific policy file.`
admin-api: create and install actual Admin API RPC endpoints Install files in /etc/qubes-rpc for all methods defined in API documentation, even if not yet implemented (qubesd will handle it raising appropriate exception). Use minimal program written in C (qubesd-query-fast), instead of qubesd-query in python for performance reasons: - a single qubesd-query run: ~300ms - equivalent in shell (echo \| nc -U): ~40ms - qubesd-query-fast: ~20ms Many tools makes multiple API calls, so performance here do matter. For example qvm-ls (from VM) currently takes about 60s on a system with 24 VMs. Also make use of `$include:` directive in policy file, to make it easier defining a VM with full Admin API access. QubesOS/qubes-issues#853 2017-05-23 03:24:15 +02:00
			`## Note that policy parsing stops at the first match,`
			`## so adding anything below "$anyvm $anyvm action" line will have no effect`

			`## Please use a single # to start your custom comments`

Generate policy for Admin API calls based on annotations on actual methods This ease Admin API administration, and also adds checking if qrexec policy + scripts matches actual Admin API methods implementation. The idea is to classify every Admin API method as either local read-only, local read-write, global read-only or global read-write. Where local/global means affecting a single VM, or the whole system. See QubesOS/qubes-issues#2871 for details. Fixes QubesOS/qubes-issues#2871 2017-06-27 01:55:17 +02:00			`## Include all already having write access`
			`$include:include/admin-local-rwx`

admin-api: create and install actual Admin API RPC endpoints Install files in /etc/qubes-rpc for all methods defined in API documentation, even if not yet implemented (qubesd will handle it raising appropriate exception). Use minimal program written in C (qubesd-query-fast), instead of qubesd-query in python for performance reasons: - a single qubesd-query run: ~300ms - equivalent in shell (echo \| nc -U): ~40ms - qubesd-query-fast: ~20ms Many tools makes multiple API calls, so performance here do matter. For example qvm-ls (from VM) currently takes about 60s on a system with 24 VMs. Also make use of `$include:` directive in policy file, to make it easier defining a VM with full Admin API access. QubesOS/qubes-issues#853 2017-05-23 03:24:15 +02:00			`## Add your entries here, make sure to append ",target=dom0" to all allow/ask actions`