From 873706428e0d8ea2d0cb135b687c3d17962db789 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?= Date: Mon, 18 Jan 2016 02:19:19 +0100 Subject: [PATCH] dispvm: fix firewall propagation when the calling VM has no rules set Fixes QubesOS/qubes-issues#1608 --- dispvm/qfile-daemon-dvm | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/dispvm/qfile-daemon-dvm b/dispvm/qfile-daemon-dvm index 26bea9ac..0421abb0 100755 --- a/dispvm/qfile-daemon-dvm +++ b/dispvm/qfile-daemon-dvm @@ -79,10 +79,13 @@ class QfileDaemonDvm: label=label) print >>sys.stderr, "time=%s, VM created" % (str(time.time())) # By default inherit firewall rules from calling VM + disp_firewall_conf = '/var/run/qubes/%s-firewall.xml' % dispvm.name + dispvm.firewall_conf = disp_firewall_conf if os.path.exists(vm.firewall_conf): - disp_firewall_conf = '/var/run/qubes/%s-firewall.xml' % dispvm.name shutil.copy(vm.firewall_conf, disp_firewall_conf) - dispvm.firewall_conf = disp_firewall_conf + elif vm.qid == 0 and os.path.exists(vm_disptempl.firewall_conf): + # for DispVM called from dom0, copy use rules from DispVM template + shutil.copy(vm_disptempl.firewall_conf, disp_firewall_conf) if len(sys.argv) > 5 and len(sys.argv[5]) > 0: assert os.path.exists(sys.argv[5]), "Invalid firewall.conf location" dispvm.firewall_conf = sys.argv[5]