Merge branch 'prebeta2' of git.qubes-os.org:/var/lib/qubes/git/rafal/core
This commit is contained in:
Joanna Rutkowska
commit
71209b5b39
@ -58,9 +58,13 @@ while true; do
|
||||
done
|
||||
|
||||
# At the end synchronize clock
|
||||
UNTRUSTED_CURRENT_TIME="`$QREXEC_CLIENT -d $UPDATES_VM 'user:date +%s.%N'`"
|
||||
# I believe that date has safe input parsing...
|
||||
sudo date -s "$UNTRUSTED_CURRENT_TIME"
|
||||
|
||||
# dd is supposed to not allow memory exhaustion
|
||||
# grep does basic sanity checking
|
||||
# there seems to be no way to pass output of date +%s.%N to date,
|
||||
# so we use human-readable format
|
||||
CURRENT_TIME="$($QREXEC_CLIENT -d $UPDATES_VM 'user:date -u' | dd count=1 2>/dev/null | grep '^[A-Za-z]* [A-Za-z]* [0-9]* [0-9][0-9]:[0-9][0-9]:[0-9][0-9] UTC [0-9][0-9][0-9][0-9]$'|head -1)"
|
||||
if [ -n "$CURRENT_TIME" ] ; then sudo date -u -s "$CURRENT_TIME" ; fi
|
||||
sleep $UPDATES_SLEEP
|
||||
done
|
||||
|
||||
|
||||
@ -1137,6 +1137,13 @@ class QubesTemplateVm(QubesVm):
|
||||
if retcode != 0:
|
||||
raise IOError ("Error while copying {0} to {1}".\
|
||||
format(self.clean_volatile_img, self.volatile_img))
|
||||
|
||||
if verbose:
|
||||
print "--> Copying the template's DispVM prerun script..."
|
||||
retcode = subprocess.call (["cp", src_template_vm.dir_path + '/dispvm-prerun.sh', self.dir_path + '/dispvm-prerun.sh'])
|
||||
if retcode != 0:
|
||||
raise IOError ("Error while copying DispVM prerun script")
|
||||
|
||||
if verbose:
|
||||
print "--> Copying the template's appmenus templates dir:\n{0} ==>\n{1}".\
|
||||
format(src_template_vm.appmenus_templates_dir, self.appmenus_templates_dir)
|
||||
@ -1452,6 +1459,7 @@ class QubesProxyVm(QubesNetVm):
|
||||
"{0}".format(self.netvm_vm.get_xid()))
|
||||
|
||||
def write_iptables_xenstore_entry(self):
|
||||
xs.rm('', "/local/domain/{0}/qubes_iptables_domainrules".format(self.get_xid()))
|
||||
iptables = "# Generated by Qubes Core on {0}\n".format(datetime.now().ctime())
|
||||
iptables += "*filter\n"
|
||||
iptables += ":INPUT DROP [0:0]\n"
|
||||
@ -1470,9 +1478,12 @@ class QubesProxyVm(QubesNetVm):
|
||||
iptables += "-A FORWARD -i vif0.0 -j ACCEPT\n"
|
||||
# Deny inter-VMs networking
|
||||
iptables += "-A FORWARD -i vif+ -o vif+ -j DROP\n"
|
||||
iptables += "COMMIT\n"
|
||||
xs.write('', "/local/domain/{0}/qubes_iptables_header".format(self.get_xid()), iptables)
|
||||
|
||||
vms = [vm for vm in self.connected_vms.values()]
|
||||
for vm in vms:
|
||||
iptables="*filter\n"
|
||||
if vm.has_firewall():
|
||||
conf = vm.get_firewall_conf()
|
||||
else:
|
||||
@ -1515,16 +1526,14 @@ class QubesProxyVm(QubesNetVm):
|
||||
iptables += "-A FORWARD -i vif{0}.+ -p icmp -j ACCEPT\n".format(xid)
|
||||
|
||||
iptables += "-A FORWARD -i vif{0}.+ -j {1}\n".format(xid, default_action)
|
||||
|
||||
iptables += "#End of VM rules\n"
|
||||
iptables += "-A FORWARD -j DROP\n"
|
||||
|
||||
iptables += "COMMIT"
|
||||
iptables += "COMMIT\n"
|
||||
xs.write('', "/local/domain/"+str(self.get_xid())+"/qubes_iptables_domainrules/"+str(xid), iptables)
|
||||
# no need for ending -A FORWARD -j DROP, cause default action is DROP
|
||||
|
||||
self.write_netvm_domid_entry()
|
||||
|
||||
self.rules_applied = None
|
||||
xs.write('', "/local/domain/{0}/qubes_iptables".format(self.get_xid()), iptables)
|
||||
xs.write('', "/local/domain/{0}/qubes_iptables".format(self.get_xid()), 'reload')
|
||||
|
||||
def get_xml_attrs(self):
|
||||
attrs = super(QubesProxyVm, self).get_xml_attrs()
|
||||
|
||||
@ -109,8 +109,7 @@ class QfileDaemonDvm:
|
||||
|
||||
def get_dvm(self):
|
||||
if not self.dvm_setup_ok():
|
||||
self.tray_notify("Updating DisposableVM savefile, please wait", 120000)
|
||||
if os.system("qvm-create-default-dvm --default-template --default-script >/var/run/qubes/qvm-create-default-dvm.stdout </dev/null" ) != 0:
|
||||
if os.system("/usr/lib/qubes/qubes_update_dispvm_savefile_with_progress.sh >/dev/null </dev/null" ) != 0:
|
||||
self.tray_notify_error("DVM savefile creation failed")
|
||||
return None
|
||||
return self.do_get_dvm()
|
||||
|
||||
14
dom0/restore/qubes_update_dispvm_savefile_with_progress.sh
Executable file
14
dom0/restore/qubes_update_dispvm_savefile_with_progress.sh
Executable file
@ -0,0 +1,14 @@
|
||||
#!/bin/sh
|
||||
trap "exit 1" USR1 TERM
|
||||
export SHELL_PID=$$
|
||||
(
|
||||
echo "1"
|
||||
if ! qvm-create-default-dvm --used-template --default-script >/var/run/qubes/qvm-create-default-dvm.stdout </dev/null ; then
|
||||
kill -USR1 $SHELL_PID
|
||||
fi
|
||||
echo 100
|
||||
) | zenity --progress --pulsate --auto-close \
|
||||
--text="Please wait (up to 120s) while the DispVM savefile is being updated. This only happens when you have updated the template, next time will be much faster." \
|
||||
--title="Updating default DispVM savefile"
|
||||
exit 0
|
||||
|
||||
@ -1,16 +1,23 @@
|
||||
#!/bin/sh
|
||||
if [ $# != 1 -a $# != 2 ] ; then
|
||||
echo 'Usage: qvm-create-default-dvm templatename|--default-template [script-name|--default-script]'
|
||||
echo 'Usage: qvm-create-default-dvm templatename|--default-template|--used-template [script-name|--default-script]'
|
||||
exit 1
|
||||
fi
|
||||
if [ "$1" = --default-template ] ; then
|
||||
export ROOT=/var/lib/qubes/dvmdata/savefile_root
|
||||
TEMPLATENAME=$1
|
||||
if [ "$TEMPLATENAME" = --used-template ] ; then
|
||||
if [ -e $ROOT ] ; then
|
||||
TEMPLATENAME=$(readlink $ROOT | sed -e 's/.root.img//' -e 's/.*\///')
|
||||
else
|
||||
TEMPLATENAME=--default-template
|
||||
fi
|
||||
fi
|
||||
if [ "$TEMPLATENAME" = --default-template ] ; then
|
||||
TEMPLATENAME=$(qvm-get-default-template)
|
||||
if [ "X"$TEMPLATENAME = "X" ] ; then
|
||||
echo No default template ?
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
TEMPLATENAME=$1
|
||||
fi
|
||||
|
||||
if [ "X""$2" = "X""--default-script" ] ; then
|
||||
@ -38,7 +45,6 @@ if ! /usr/lib/qubes/qubes_prepare_saved_domain.sh \
|
||||
"$DVMTMPL" "/var/lib/qubes/appvms/$DVMTMPL/dvm-savefile" $SCRIPTNAME ; then
|
||||
exit 1
|
||||
fi
|
||||
ROOT=/var/lib/qubes/dvmdata/savefile_root
|
||||
DEFAULT=/var/lib/qubes/dvmdata/default_savefile
|
||||
DEFAULTCONF=/var/lib/qubes/dvmdata/default_dvm.conf
|
||||
CURRENT=/var/run/qubes/current_savefile
|
||||
|
||||
@ -3,9 +3,9 @@ set -e
|
||||
|
||||
PIDFILE=/var/run/qubes/qubes_firewall.pid
|
||||
XENSTORE_IPTABLES=qubes_iptables
|
||||
XENSTORE_IPTABLES_HEADER=qubes_iptables_header
|
||||
XENSTORE_ERROR=qubes_iptables_error
|
||||
OLD_RULES=""
|
||||
|
||||
# PIDfile handling
|
||||
[[ -e $PIDFILE ]] && kill -s 0 $(<$PIDFILE) 2>/dev/null && exit 0
|
||||
echo $$ >$PIDFILE
|
||||
@ -13,24 +13,26 @@ echo $$ >$PIDFILE
|
||||
trap 'exit 0' SIGTERM
|
||||
|
||||
while true; do
|
||||
RULES=$(/usr/bin/xenstore-read $XENSTORE_IPTABLES)
|
||||
|
||||
if [[ "$RULES" != "$OLD_RULES" ]]; then
|
||||
IPTABLES_SAVE=$(/sbin/iptables-save | sed '/^\*filter/,/^COMMIT/d')
|
||||
OUT=`echo -e "$RULES\n$IPTABLES_SAVE" | /sbin/iptables-restore 2>&1 || :`
|
||||
/usr/bin/xenstore-write $XENSTORE_ERROR "$OUT"
|
||||
if [ "$OUT" ]; then
|
||||
DISPLAY=:0 /usr/bin/notify-send -t 3000 "Firewall loading error ($HOSTNAME)" "$OUT" || :
|
||||
fi
|
||||
|
||||
if [[ -z "$OUT" ]]; then
|
||||
# If OK save it for later
|
||||
/sbin/service iptables save >/dev/null
|
||||
fi
|
||||
|
||||
OLD_RULES="$RULES"
|
||||
fi
|
||||
|
||||
# Wait for changes in xenstore file
|
||||
/usr/bin/xenstore-watch-qubes $XENSTORE_IPTABLES
|
||||
TRIGGER=$(/usr/bin/xenstore-read $XENSTORE_IPTABLES)
|
||||
|
||||
if ! [ "$TRIGGER" = "reload" ]; then continue ; fi
|
||||
RULES=$(/usr/bin/xenstore-read $XENSTORE_IPTABLES_HEADER)
|
||||
IPTABLES_SAVE=$(/sbin/iptables-save | sed '/^\*filter/,/^COMMIT/d')
|
||||
OUT=`echo -e "$RULES\n$IPTABLES_SAVE" | /sbin/iptables-restore 2>&1 || :`
|
||||
|
||||
for i in $(xenstore-list qubes_iptables_domainrules) ; do
|
||||
RULES=$(/usr/bin/xenstore-read qubes_iptables_domainrules/"$i")
|
||||
ERRS=`echo -e "$RULES" | /sbin/iptables-restore -n 2>&1 || :`
|
||||
OUT="$OUT""$ERRS"
|
||||
done
|
||||
/usr/bin/xenstore-write $XENSTORE_ERROR "$OUT"
|
||||
if [ "$OUT" ]; then
|
||||
DISPLAY=:0 /usr/bin/notify-send -t 3000 "Firewall loading error ($HOSTNAME)" "$OUT" || :
|
||||
fi
|
||||
if [[ -z "$OUT" ]]; then
|
||||
# If OK save it for later
|
||||
/sbin/service iptables save >/dev/null
|
||||
fi
|
||||
done
|
||||
|
||||
@ -117,6 +117,7 @@ cp restore/qvm-create-default-dvm $RPM_BUILD_ROOT/usr/bin
|
||||
cp restore/xenstore-watch $RPM_BUILD_ROOT/usr/bin/xenstore-watch-qubes
|
||||
cp restore/qubes_restore restore/xenfreepages $RPM_BUILD_ROOT/usr/lib/qubes
|
||||
cp restore/qubes_prepare_saved_domain.sh $RPM_BUILD_ROOT/usr/lib/qubes
|
||||
cp restore/qubes_update_dispvm_savefile_with_progress.sh $RPM_BUILD_ROOT/usr/lib/qubes
|
||||
cp restore/qfile-daemon-dvm $RPM_BUILD_ROOT/usr/lib/qubes
|
||||
|
||||
mkdir -p $RPM_BUILD_ROOT/etc/yum.real.repos.d
|
||||
@ -333,6 +334,7 @@ fi
|
||||
/usr/bin/xenstore-watch-qubes
|
||||
/usr/lib/qubes/qubes_restore
|
||||
/usr/lib/qubes/qubes_prepare_saved_domain.sh
|
||||
/usr/lib/qubes/qubes_update_dispvm_savefile_with_progress.sh
|
||||
/etc/xen/scripts/block.qubes
|
||||
/etc/xen/scripts/block-snapshot
|
||||
/etc/xen/scripts/block-origin
|
||||
|
||||
Loading…
Reference in New Issue
Block a user