Qubes/core-admin
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

qvm-usb: issue detach call to backend domain

Browse Source 
Make sure that even compromised frontend will be cut of (possibly
sensitive - like a webcam) device. On the other hand, if backend domain
is already compromised, it may already compromise frontend domain too,
so none of them would be better to call detach to.

QubesOS/qubes-issues#531
This commit is contained in:
Marek Marczykowski-Górecki 2016-06-02 02:45:26 +02:00
parent 52fb410deb
commit d5e06bfb83
No known key found for this signature in database
GPG Key ID: 063938BA42CFA724
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
core/qubesutils.py
View File

@ -645,9 +645,10 @@ def usb_detach(qvmc, vm, device):
"Device {} not connected to VM {}".format( "Device {} not connected to VM {}".format(
device['name'], vm.name)) device['name'], vm.name))
p = vm.run_service('qubes.USBDetach', passio_popen=True, user='root') p = device['vm'].run_service('qubes.USBDetach', passio_popen=True,
user='root')
(stdout, stderr) = p.communicate( (stdout, stderr) = p.communicate(
'{} {}\n'.format(device['vm'].name, device['device'])) '{}\n'.format(device['device']))
if p.returncode != 0: if p.returncode != 0:
# TODO: sanitize and include stdout # TODO: sanitize and include stdout
raise QubesException('Device detach failed') raise QubesException('Device detach failed')