Commit Graph

5189 Commits

Author SHA1 Message Date
Marek Marczykowski-Górecki
5d0a2fe463
Add default policy for qubes.VMRootShell service 2017-08-06 20:54:11 +02:00
Marek Marczykowski-Górecki
0cd25b5350
firewall: fix Firewall.clone()
New rule require action to be defined, even if will be overwritten a
moment later.
2017-08-06 20:54:10 +02:00
Marek Marczykowski-Górecki
a833692c63
storage/lvm: extend volume snapshot of running VM too
Extend both backing volume as well as current snapshot, so the increased
size is visible immediately to the user.

Fixes QubesOS/qubes-issues#2982
2017-08-06 20:54:10 +02:00
Marek Marczykowski-Górecki
8488d5dc72
vm/adminvm: add default_dispvm property to AdminVM
This is useful to select default DispVM template for VMs started
directly by the user. This makes sense as long as AdminVM == GUIVM.

QubesOS/qubes-issues#2974
2017-08-06 20:54:10 +02:00
Marek Marczykowski-Górecki
971c7d4ac9
api/admin: add admin.vm.CreateDisposable in place of internal.vm.Create.DispVM
Add public Admin API call to create Disposable VM that would be
automatically destroyed after shutdown. Do not keep this functionality
for qrexec-policy tool only.
Also, use admin.vm.Start there, instead of internal.vm.Start and
admin.vm.Kill instead of internal.vm.CleanupDispVM (this is enough,
because DispVM now have auto_cleanup property).

QubesOS/qubes-issues#2974
2017-08-06 20:54:10 +02:00
Marek Marczykowski-Górecki
691a6f4d8c
vm/dispvm: add auto_cleanup property, unify creating new DispVM
Add auto_cleanup property, which remove DispVM after its shutdown
- this is to unify DispVM handling - less places needing special
handling after DispVM shutdown.

New DispVM inherit all settings from respective AppVM. Move this from
classmethod `DispVM.from_appvm()`, to DispVM constructor. This unify
creating new DispVM with any other VM class.
Notable exception are attached devices - because only one running VM can
have a device attached, this would prevent second DispVM started from
the same AppVM. If one need DispVM with some device attached, one can
create DispVM with auto_cleanup=False. Such DispVM will still not have
persistent storage (as any other DispVM).

Tests included.

QubesOS/qubes-issues#2974
2017-08-06 20:54:09 +02:00
Marek Marczykowski-Górecki
22f2fe6d69
block: add support for devtype option
QubesOS/qubes-issues#2951
2017-08-01 15:20:36 +02:00
Marek Marczykowski-Górecki
a407e34931
devices: always pass persistent parameter to device-list-attached event 2017-08-01 15:20:19 +02:00
Marek Marczykowski-Górecki
17324b7ac7
version 4.0.4 2017-07-30 19:19:52 +02:00
Marek Marczykowski-Górecki
b9c217704c
storage/file: fix disk usage reporting
Do not report root image usage in template-based VMs. This space is used
only once - by template.
2017-07-30 18:36:23 +02:00
Marek Marczykowski-Górecki
8a8674bb57
ext/core_features: add handling 'qubes-firewall' feature request
VM (template) can announce whether it support enforcing firewall rules
or not.

Fixes QubesOS/qubes-issues#2003
2017-07-30 18:34:43 +02:00
Marek Marczykowski-Górecki
71a1be30e7
app: fix LVM default storage pool 2017-07-30 14:57:26 +02:00
Marek Marczykowski-Górecki
38bc751b97
qubespolicy: fix handling icons dictionary
Build icons dictionary from all provided icons, not only those allowed
as target. Specifically, source may not be allowed target (but the
window need its icon).
2017-07-30 14:48:21 +02:00
Marek Marczykowski-Górecki
d650a90289
qubespolicy: fix handling ask,default_target= 2017-07-30 14:48:06 +02:00
Marek Marczykowski-Górecki
502f753be9
version 4.0.3 2017-07-29 05:35:31 +02:00
Marek Marczykowski-Górecki
36f1a3abaf
Merge branch 'services'
* services:
  tests: check clockvm-related handlers
  doc: include list of extensions
  qubesvm: fix docstring
  ext/services: move exporting 'service.*' features to extensions
  app: update handling features/service os ClockVM
2017-07-29 05:09:32 +02:00
Marek Marczykowski-Górecki
34ff40c721
tests: fix AdminVM test 2017-07-29 05:07:45 +02:00
Marek Marczykowski-Górecki
c8c32d4956
Merge branch 'stats'
* stats:
  tests: admin.vm.Stats
  api: fix handling interrupted calls
  api/admin: implement admin.vm.Stats
  app: refresh getting VM statistics, rename to QubesHost.get_vm_stats
  api: use str(subject) instead of explicit subject.name
2017-07-29 05:05:32 +02:00
Marek Marczykowski-Górecki
76640df091
Merge branch 'tests-storage'
* tests-storage:
  tests: register libvirt events
  tests: even more agressive cleanup in tearDown
  app: do not wrap libvirt_conn.close() in auto-reconnect wrapper
  api: keep track of established connections
  tests: drop VM cleanup from tearDownClass, fix asyncio usage in tearDown
  storage: fix Storage.clone and Storage.clone_volume
  tests: more tests fixes
  firewall: raise ValueError on invalid hostname in dsthost=
  qmemman: don't load qubes.xml
  tests: fix AdminVM test
  tests: create temporary files in /tmp
  tests: remove renaming test - it isn't supported anymore
  tests: various fixes for storage tests
  tests: fix removing LVM volumes
  tests: fix asyncio usage in some tests
  tests: minor fixes to api/admin tests
  storage/file: create -cow.img only when needed
  storage: move volume_config['source'] filling to one place
  app: do not create 'default' storage pool
  app: add missing setters for default_pool* global properties
2017-07-29 05:01:42 +02:00
Marek Marczykowski-Górecki
639fa26079
Merge branch 'qdb-watch'
* qdb-watch:
  tests: add qdb_watch test
  ext/block: make use of QubesDB watch
  vm: add API for watching changes in QubesDB
  vm: optimize imports
  api/admin: don't send internal events in admin.Events
  Add explanation why admin.vm.volume.Import is a custom script
  Follow change of qubesdb path return type
  Rename vm.qdb to vm.untrusted_qdb
2017-07-29 05:01:13 +02:00
Marek Marczykowski-Górecki
46bfa14d08
storage/lvm: make sure that volumes have /dev entries when export() is called
In some cases (even manual manipulation) those files may not be present
- especially because thin snapshots do not have nodes in /dev by default.
2017-07-29 04:47:44 +02:00
Marek Marczykowski-Górecki
27ce27b6e9
backup: improve error reporting about passphrase retrieval
QubesOS/qubes-issues#2931
2017-07-29 04:47:44 +02:00
Marek Marczykowski-Górecki
bde8d45cca
backup: update last backup timestamp only when backup succeed
QubesOS/qubes-issues#2931
2017-07-29 04:47:44 +02:00
Marek Marczykowski-Górecki
1556814f59
backup: fix handling already encoded passphrase
When passphrase is retrieved from VM, it is already encoded. Do not try
to encode it again.

QubesOS/qubes-issues#2931
2017-07-29 04:47:43 +02:00
Marek Marczykowski-Górecki
73fb16dbda
tests: check clockvm-related handlers 2017-07-28 16:32:48 +02:00
Marek Marczykowski-Górecki
3c052d9e3c
doc: include list of extensions 2017-07-28 16:32:48 +02:00
Marek Marczykowski-Górecki
5321e11003
qubesvm: fix docstring 2017-07-28 16:32:47 +02:00
Marek Marczykowski-Górecki
1a6728cb12
ext/services: move exporting 'service.*' features to extensions
This means core code will not publish any features by default.
2017-07-28 16:32:47 +02:00
Marek Marczykowski-Górecki
e738a7596d
app: update handling features/service os ClockVM
Threis no more ntpd service used - new approach do not conflict with
ntpd. Because of this, new feature is named 'service.clocksync', and
should be _enabled_ in ClockVM ('ntpd' was disabled there).

QubesOS/qubes-issues#1230
2017-07-28 16:32:47 +02:00
Marek Marczykowski-Górecki
9bbefa0edb
tests: admin.vm.Stats
QubesOS/qubes-issues#853
2017-07-28 03:02:33 +02:00
Marek Marczykowski-Górecki
2f4b4d97e7
api: fix handling interrupted calls
When an API call is interrupted, the relevant coroutine is cancelled -
which means it may throw CancelledError. At the same time, cancelled
call have related socket already closed (and transport set to None). But
QubesDaemonProtocol.respond try to close the transport again, which
fails. Fix handling this case.
2017-07-28 03:02:33 +02:00
Marek Marczykowski-Górecki
147bca1648
api/admin: implement admin.vm.Stats
QubesOS/qubes-issues#853
2017-07-28 03:02:32 +02:00
Marek Marczykowski-Górecki
e8b875f552
app: refresh getting VM statistics, rename to QubesHost.get_vm_stats
Get a VM statistics once. If previous measurements are provided,
calculate difference too. This is backend part of upcoming
admin.vm.Stats service.

QubesOS/qubes-issues#853
2017-07-27 22:16:03 +02:00
Marek Marczykowski-Górecki
0d9574d9fc
api: use str(subject) instead of explicit subject.name
This allows better flexibility, when subject is not necessary a VM
object.
2017-07-27 22:15:02 +02:00
Marek Marczykowski-Górecki
6a85592b51
tests: register libvirt events
This is especially needed to have proper domain-shutdown event.
2017-07-26 03:27:00 +02:00
Marek Marczykowski-Górecki
c53582b285
tests: even more agressive cleanup in tearDown
Remove some more references to objects holding (possibly indirectly)
reference to libvirt connection:
 - local variables in tearDown function
 - running Admin API calls (especially admin.Events)
 - vmm._libvirt_conn directly, in case some reference to Qubes()
   is still there
 - any instance attribute that is an object from 'qubes' python package
   (instead of just those descending from BaseVM)
 - do not create new Qubes() instance for removing VMs - if we already
   have one in self.app

Then trigger garbage collector to really cleanup those objects (and
close relevant file descriptors). It's important do do this before
closing event loop, because some of descructors may try to use it (for
example remove registered handlers).
2017-07-26 03:27:00 +02:00
Marek Marczykowski-Górecki
d57120d809
app: do not wrap libvirt_conn.close() in auto-reconnect wrapper
close() function purpose is to close the connection...
2017-07-26 03:26:59 +02:00
Marek Marczykowski-Górecki
074c705f77
api: keep track of established connections
This will be needed to gracefuly cleanup them between individual tests.
2017-07-26 03:26:59 +02:00
Marek Marczykowski-Górecki
4be325a383
tests: drop VM cleanup from tearDownClass, fix asyncio usage in tearDown
When tearDownClass is executed, event loop is already closed. Since no
test really need it right now, drop support for test class-wide VMs and
convert those methods back to instance methods.
Also put coroutines (vm.remove_from_disk, vm.kill) onto event loop.
2017-07-26 03:26:59 +02:00
Marek Marczykowski-Górecki
910f793c61
storage: fix Storage.clone and Storage.clone_volume
1. Volume.import_volume expect volume to be created first.
2. asyncio.wait do not accept generator, it must be concrete iterable.
2017-07-26 03:26:59 +02:00
Marek Marczykowski-Górecki
1af7034d57
tests: more tests fixes 2017-07-26 03:26:58 +02:00
Marek Marczykowski-Górecki
214c646417
firewall: raise ValueError on invalid hostname in dsthost=
...instead of AssertionError
2017-07-26 03:26:58 +02:00
Marek Marczykowski-Górecki
625c94d1f6
qmemman: don't load qubes.xml
Only qubesd should load qubes.xml directly. Put a TODO comments for now
in place of slow VM reporting, invent some better mechanism later.

This loading of qubes.xml caused deadlocks, because qmemnan kept open
file descriptor (in locked state).
2017-07-26 03:26:58 +02:00
Marek Marczykowski-Górecki
5d9bc00885
tests: fix AdminVM test
Since it is no longer child of QubesVM, constructor do not take 'qid'
and 'name' arguments.
Also:
- remove other dropped properties tests (netvm, storage related)
- make the test working in non-dom0
2017-07-26 03:26:40 +02:00
Marek Marczykowski-Górecki
a9934316c1
tests: create temporary files in /tmp 2017-07-26 03:26:39 +02:00
Marek Marczykowski-Górecki
8bae2d39c2
tests: remove renaming test - it isn't supported anymore
QubesOS/qubes-issues#2868
2017-07-26 03:26:39 +02:00
Marek Marczykowski-Górecki
8b2db94b41
tests: various fixes for storage tests
- improve TestPool mock - init_volume now return appropriate mock type,
   instead of TestPool
 - improve patching base directory (/var/lib/qubes) - it is stored in
   more than one place...
 - fix inheritance in TC_01_ThinPool class
 - fix expected LVM volume names ('vm-' prefix)
 - fix cleanup after FilePool tests - remove temporary qubes.xml
 - asyncio usage
 - better reporting in integ.storage - include error message in the
   report, not only as a comment in code
2017-07-26 03:26:13 +02:00
Marek Marczykowski-Górecki
a8e2f3111d
tests: fix removing LVM volumes
VM volumes have 'vm-' name prefix now.
This is continuation of fd5386c storage/lvm: prefix VM LVM volumes with 'vm-'
2017-07-26 03:26:12 +02:00
Marek Marczykowski-Górecki
75394a1348
tests: fix asyncio usage in some tests 2017-07-26 03:26:12 +02:00
Marek Marczykowski-Górecki
ba2b034843
tests: minor fixes to api/admin tests
Drop debug print, fix mocking Storage.remove (it is a coroutine).
2017-07-26 03:26:11 +02:00