Qubes/core-admin
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Add qubes.ShowTerminal service

Browse Source
This commit is contained in:
Frédéric Pierret (fepitre) 2019-04-30 11:23:23 +02:00
parent 33bf3d4506
commit baef139c00
No known key found for this signature in database
GPG Key ID: 484010B5CDC576E2
2 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
qubes-rpc-policy/qubes.ShowTerminal Normal file
View File

@ -0,0 +1,12 @@
## Note that policy parsing stops at the first match,
## so adding anything below "$anyvm $anyvm action" line will have no effect
## Please use a single # to start your custom comments
$anyvm $anyvm deny,target=dom0
# WARNING: The qubes.ShowTerminal service is dangerous and allows any
# qube to access any other qube console. It should be restricted
# only to management/admin qubes. This is why the default policy is 'deny'
# Example of policy: mgmtvm $tag:created-by-mgmtvm allow,target=dom0

7
qubes-rpc/qubes.ShowTerminal Executable file
View File

@ -0,0 +1,7 @@
#!/bin/bash
lock="/var/run/qubes/$QREXEC_REQUESTED_TARGET.terminal.lock"
# Create an exclusive lock to ensure that multiple qubes cannot access to the same socket
# In the case of multiple qrexec calls it returns a specific exit code
sudo flock -n -E 200 -x "$lock" socat - OPEN:"$(virsh -c xen ttyconsole "$QREXEC_REQUESTED_TARGET")"