Qubes/core-admin
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

ext/admin: allow setting 'created-by-*' tags from dom0

Browse Source 
Add an exception for this limit - if for nothing else, to allow full
backup restore (non-paranoid mode).
This commit is contained in:
Marek Marczykowski-Górecki 2017-07-17 02:42:36 +02:00
parent cbc7241a93
commit 8cb831da29
No known key found for this signature in database
GPG Key ID: 063938BA42CFA724
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
qubes/ext/admin.py
View File

@ -19,6 +19,7 @@
import qubes.api
import qubes.ext
import qubes.vm.adminvm
class AdminExtension(qubes.ext.Extension):
# pylint: disable=too-few-public-methods
@ -28,7 +29,8 @@ class AdminExtension(qubes.ext.Extension):
def on_tag_set_or_remove(self, vm, event, arg, **kwargs):
'''Forbid changing specific tags'''
# pylint: disable=no-self-use,unused-argument
if arg.startswith('created-by-'):
if arg.startswith('created-by-') and \
not isinstance(vm, qubes.vm.adminvm.AdminVM):
raise qubes.api.PermissionDenied(
'changing this tag is prohibited by {}.{}'.format(
__name__, type(self).__name__))