Merge branch 'prebeta2' of git.qubes-os.org:/var/lib/qubes/git/rafal/core

dom0/aux-tools/qubes-watch-updates.sh

@@ -58,9 +58,13 @@ while true; do
     done
     
     # At the end synchronize clock
-    UNTRUSTED_CURRENT_TIME="`$QREXEC_CLIENT -d $UPDATES_VM 'user:date +%s.%N'`"
+
-    # I believe that date has safe input parsing...
+    # dd is supposed to not allow memory exhaustion
-    sudo date -s "$UNTRUSTED_CURRENT_TIME"
+    # grep does basic sanity checking
+    # there seems to be no way to pass output of date +%s.%N to date,
+    # so we use human-readable format
+    CURRENT_TIME="$($QREXEC_CLIENT -d $UPDATES_VM 'user:date -u' | dd count=1 2>/dev/null | grep '^[A-Za-z]* [A-Za-z]* [0-9]* [0-9][0-9]:[0-9][0-9]:[0-9][0-9] UTC [0-9][0-9][0-9][0-9]$'|head -1)"
+    if [ -n "$CURRENT_TIME" ] ; then sudo date -u -s "$CURRENT_TIME" ; fi
     sleep $UPDATES_SLEEP
 done
 

dom0/qvm-core/qubes.py

@@ -1137,6 +1137,13 @@ class QubesTemplateVm(QubesVm):
         if retcode != 0:
             raise IOError ("Error while copying {0} to {1}".\
                            format(self.clean_volatile_img, self.volatile_img))
+
+        if verbose:
+            print "--> Copying the template's DispVM prerun script..."
+        retcode = subprocess.call (["cp", src_template_vm.dir_path + '/dispvm-prerun.sh', self.dir_path + '/dispvm-prerun.sh'])
+        if retcode != 0:
+            raise IOError ("Error while copying DispVM prerun script")
+
         if verbose:
             print "--> Copying the template's appmenus templates dir:\n{0} ==>\n{1}".\
                     format(src_template_vm.appmenus_templates_dir, self.appmenus_templates_dir)
@@ -1452,6 +1459,7 @@ class QubesProxyVm(QubesNetVm):
                 "{0}".format(self.netvm_vm.get_xid()))
 
     def write_iptables_xenstore_entry(self):
+        xs.rm('', "/local/domain/{0}/qubes_iptables_domainrules".format(self.get_xid()))
         iptables =  "# Generated by Qubes Core on {0}\n".format(datetime.now().ctime())
         iptables += "*filter\n"
         iptables += ":INPUT DROP [0:0]\n"
@@ -1470,9 +1478,12 @@ class QubesProxyVm(QubesNetVm):
         iptables += "-A FORWARD -i vif0.0 -j ACCEPT\n"
         # Deny inter-VMs networking
         iptables += "-A FORWARD -i vif+ -o vif+ -j DROP\n"
+        iptables += "COMMIT\n"
+        xs.write('', "/local/domain/{0}/qubes_iptables_header".format(self.get_xid()), iptables)
 
         vms = [vm for vm in self.connected_vms.values()]
         for vm in vms:
+            iptables="*filter\n"
             if vm.has_firewall():
                 conf = vm.get_firewall_conf()
             else:
@@ -1515,16 +1526,14 @@ class QubesProxyVm(QubesNetVm):
                 iptables += "-A FORWARD -i vif{0}.+ -p icmp -j ACCEPT\n".format(xid)
 
             iptables += "-A FORWARD -i vif{0}.+ -j {1}\n".format(xid, default_action)
-
+            iptables += "COMMIT\n"
-        iptables += "#End of VM rules\n"
+            xs.write('', "/local/domain/"+str(self.get_xid())+"/qubes_iptables_domainrules/"+str(xid), iptables)
-        iptables += "-A FORWARD -j DROP\n"
+        # no need for ending -A FORWARD -j DROP, cause default action is DROP
-
-        iptables += "COMMIT"
 
         self.write_netvm_domid_entry()
 
         self.rules_applied = None
-        xs.write('', "/local/domain/{0}/qubes_iptables".format(self.get_xid()), iptables)
+        xs.write('', "/local/domain/{0}/qubes_iptables".format(self.get_xid()), 'reload')
 
     def get_xml_attrs(self):
         attrs = super(QubesProxyVm, self).get_xml_attrs()

dom0/restore/qfile-daemon-dvm

@@ -109,8 +109,7 @@ class QfileDaemonDvm:
 
     def get_dvm(self):
         if not self.dvm_setup_ok():
-            self.tray_notify("Updating DisposableVM savefile, please wait", 120000)
+            if os.system("/usr/lib/qubes/qubes_update_dispvm_savefile_with_progress.sh >/dev/null </dev/null" ) != 0:
-            if os.system("qvm-create-default-dvm --default-template --default-script >/var/run/qubes/qvm-create-default-dvm.stdout </dev/null" ) != 0:
                 self.tray_notify_error("DVM savefile creation failed")
                 return None 
         return self.do_get_dvm()

dom0/restore/qubes_update_dispvm_savefile_with_progress.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+trap "exit 1" USR1 TERM
+export SHELL_PID=$$
+(
+	echo "1"
+	if ! qvm-create-default-dvm --used-template --default-script >/var/run/qubes/qvm-create-default-dvm.stdout </dev/null ; then 
+		kill -USR1 $SHELL_PID
+	fi
+        echo 100 
+) | zenity --progress --pulsate --auto-close \
+	--text="Please wait (up to 120s) while the DispVM savefile is being updated. This only happens when you have updated the template, next time will be much faster." \
+	--title="Updating default DispVM savefile"
+exit 0
+                  

dom0/restore/qvm-create-default-dvm

@@ -1,16 +1,23 @@
 #!/bin/sh
 if [ $# != 1 -a $# != 2 ] ; then
-	echo 'Usage: qvm-create-default-dvm templatename|--default-template [script-name|--default-script]'
+	echo 'Usage: qvm-create-default-dvm templatename|--default-template|--used-template [script-name|--default-script]'
 	exit 1
 fi
-if [ "$1" = --default-template ] ; then
+export ROOT=/var/lib/qubes/dvmdata/savefile_root
+TEMPLATENAME=$1
+if [ "$TEMPLATENAME" = --used-template ] ; then
+	if [ -e $ROOT ] ; then
+		TEMPLATENAME=$(readlink $ROOT | sed -e 's/.root.img//' -e 's/.*\///')
+	else
+		TEMPLATENAME=--default-template
+	fi
+fi
+if [ "$TEMPLATENAME" = --default-template ] ; then
 	TEMPLATENAME=$(qvm-get-default-template)
 	if [ "X"$TEMPLATENAME = "X" ] ; then
 		echo No default template ?
 		exit 1
 	fi
-else
-	TEMPLATENAME=$1
 fi
 
 if [ "X""$2" = "X""--default-script" ] ; then
@@ -38,7 +45,6 @@ if ! /usr/lib/qubes/qubes_prepare_saved_domain.sh \
 	"$DVMTMPL" "/var/lib/qubes/appvms/$DVMTMPL/dvm-savefile" $SCRIPTNAME ; then
 	exit 1
 fi
-ROOT=/var/lib/qubes/dvmdata/savefile_root
 DEFAULT=/var/lib/qubes/dvmdata/default_savefile
 DEFAULTCONF=/var/lib/qubes/dvmdata/default_dvm.conf
 CURRENT=/var/run/qubes/current_savefile

proxyvm/bin/qubes_firewall

@@ -3,9 +3,9 @@ set -e
 
 PIDFILE=/var/run/qubes/qubes_firewall.pid
 XENSTORE_IPTABLES=qubes_iptables
+XENSTORE_IPTABLES_HEADER=qubes_iptables_header
 XENSTORE_ERROR=qubes_iptables_error
 OLD_RULES=""
-
 # PIDfile handling
 [[ -e $PIDFILE ]] && kill -s 0 $(<$PIDFILE) 2>/dev/null && exit 0
 echo $$ >$PIDFILE
@@ -13,24 +13,26 @@ echo $$ >$PIDFILE
 trap 'exit 0' SIGTERM
 
 while true; do
-	RULES=$(/usr/bin/xenstore-read $XENSTORE_IPTABLES)
-
-	if [[ "$RULES" != "$OLD_RULES" ]]; then
-		IPTABLES_SAVE=$(/sbin/iptables-save | sed '/^\*filter/,/^COMMIT/d')
-		OUT=`echo -e "$RULES\n$IPTABLES_SAVE" | /sbin/iptables-restore 2>&1 || :`
-		/usr/bin/xenstore-write $XENSTORE_ERROR "$OUT"
-		if [ "$OUT" ]; then
-			DISPLAY=:0 /usr/bin/notify-send -t 3000 "Firewall loading error ($HOSTNAME)" "$OUT" || :
-		fi
-
-		if [[ -z "$OUT" ]]; then
-			# If OK save it for later
-			/sbin/service iptables save >/dev/null
-		fi
-
-		OLD_RULES="$RULES"
-	fi
-
 	# Wait for changes in xenstore file
 	/usr/bin/xenstore-watch-qubes $XENSTORE_IPTABLES
+	TRIGGER=$(/usr/bin/xenstore-read $XENSTORE_IPTABLES)
+
+	if ! [ "$TRIGGER" = "reload" ]; then continue ; fi
+	RULES=$(/usr/bin/xenstore-read $XENSTORE_IPTABLES_HEADER)
+	IPTABLES_SAVE=$(/sbin/iptables-save | sed '/^\*filter/,/^COMMIT/d')
+	OUT=`echo -e "$RULES\n$IPTABLES_SAVE" | /sbin/iptables-restore 2>&1 || :`
+
+	for i in $(xenstore-list qubes_iptables_domainrules) ; do 
+		RULES=$(/usr/bin/xenstore-read qubes_iptables_domainrules/"$i")
+		ERRS=`echo -e "$RULES" | /sbin/iptables-restore -n 2>&1 || :`
+		OUT="$OUT""$ERRS"
+	done		
+	/usr/bin/xenstore-write $XENSTORE_ERROR "$OUT"
+	if [ "$OUT" ]; then
+		DISPLAY=:0 /usr/bin/notify-send -t 3000 "Firewall loading error ($HOSTNAME)" "$OUT" || :
+	fi
+	if [[ -z "$OUT" ]]; then
+		# If OK save it for later
+		/sbin/service iptables save >/dev/null
+	fi
 done

rpm_spec/core-dom0.spec

@@ -117,6 +117,7 @@ cp restore/qvm-create-default-dvm $RPM_BUILD_ROOT/usr/bin
 cp restore/xenstore-watch $RPM_BUILD_ROOT/usr/bin/xenstore-watch-qubes
 cp restore/qubes_restore restore/xenfreepages $RPM_BUILD_ROOT/usr/lib/qubes
 cp restore/qubes_prepare_saved_domain.sh  $RPM_BUILD_ROOT/usr/lib/qubes
+cp restore/qubes_update_dispvm_savefile_with_progress.sh  $RPM_BUILD_ROOT/usr/lib/qubes
 cp restore/qfile-daemon-dvm $RPM_BUILD_ROOT/usr/lib/qubes
 
 mkdir -p $RPM_BUILD_ROOT/etc/yum.real.repos.d
@@ -333,6 +334,7 @@ fi
 /usr/bin/xenstore-watch-qubes
 /usr/lib/qubes/qubes_restore
 /usr/lib/qubes/qubes_prepare_saved_domain.sh
+/usr/lib/qubes/qubes_update_dispvm_savefile_with_progress.sh
 /etc/xen/scripts/block.qubes
 /etc/xen/scripts/block-snapshot
 /etc/xen/scripts/block-origin