Qubes/core-admin
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

qubespolicy/graph: let --target option filter on actual call target

Browse Source 
Not on what VM can ask for (which may be later overriden by target=
option).

Fixes QubesOS/qubes-issues#3006
This commit is contained in:
Marek Marczykowski-Górecki 2017-08-13 02:40:28 +02:00
parent 12661dccf8
commit 10c6697050
No known key found for this signature in database
GPG Key ID: 063938BA42CFA724
1 changed files with 11 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
qubespolicy/graph.py
View File

@ -52,17 +52,19 @@ def handle_single_action(args, action):
service = '' service = ''
else: else:
service = action.service service = action.service
target = action.target or action.original_target
# handle forced target=
if action.rule.override_target:
target = action.rule.override_target
if args.target and target not in args.target:
return ''
if action.action == qubespolicy.Action.ask: if action.action == qubespolicy.Action.ask:
if args.include_ask: if args.include_ask:
# handle forced target=
if len(action.targets_for_ask) == 1:
return ' "{}" -> "{}" [label="{}" color=orange];\n'.format(
action.source, action.targets_for_ask[0], service)
return ' "{}" -> "{}" [label="{}" color=orange];\n'.format( return ' "{}" -> "{}" [label="{}" color=orange];\n'.format(
action.source, action.original_target, service) action.source, target, service)
elif action.action == qubespolicy.Action.allow: elif action.action == qubespolicy.Action.allow:
return ' "{}" -> "{}" [label="{}" color=red];\n'.format( return ' "{}" -> "{}" [label="{}" color=red];\n'.format(
action.source, action.target, service) action.source, target, service)
return '' return ''
def main(args=None): def main(args=None):
@ -83,12 +85,9 @@ def main(args=None):
sources = args.source sources = args.source
targets = list(system_info['domains'].keys()) targets = list(system_info['domains'].keys())
if args.target: targets.append('$dispvm')
targets = args.target targets.extend('$dispvm:' + dom for dom in system_info['domains']
else: if system_info['domains'][dom]['dispvm_allowed'])
targets.append('$dispvm')
targets.extend('$dispvm:' + dom for dom in system_info['domains']
if system_info['domains'][dom]['dispvm_allowed'])
connections = set() connections = set()