Qubes/core-admin
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
2,010 Commits 1 Branch 0 Tags 15 MiB
3e90174910
Commit Graph

2010 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Marek Marczykowski
812264cfb0 dom0/core: don't limit netvm/proxyvm vcpu count to 1 (#571) 2012-05-31 03:09:22 +02:00
Marek Marczykowski
63d7cb5231 qrexec: describe msg types in header file 2012-05-31 03:09:22 +02:00
Marek Marczykowski
c49ad3438b dom0/core: remove trailing spaces 2012-05-31 03:05:14 +02:00
Marek Marczykowski
d89733b517 dom0/core: setup yum to use proxy when it have access to it (#568) 
To simplify configuration, automatically enable 'yum-proxy-setup'
pseudo-service when allowing access to the proxy. Also disable this service,
when access is revoked. Thanks to this the user can enable this feature by one
click in firewall settings.
 2012-05-31 03:05:13 +02:00
Marek Marczykowski
c81cc32da2 dom0/qvm-firewall: add support for 'allowYumProxy' setting (#568) 2012-05-31 03:05:13 +02:00
Marek Marczykowski
030584f026 dom0/core-firewall: firewall setting for qubes-yum-proxy (#568) 
New setting for access to qubes-yum-proxy. The difference from other firewall
setting (and reason for new top-level setting): 'deny' is enforced even if
policy is set to 'allow'. This proxy service is mainly used to filter network
traffic, so do not expose it to VMs which can connect to any host directly (eg
'untrusted' VM).
 2012-05-31 03:05:13 +02:00
Marek Marczykowski
edc3518ec9 vm/qubes-yum-proxy: setup yum to use qubes-yum-proxy (#568) 
The simplest way is just add proxy=... entry to /etc/yum.conf, but sometimes it
is reasonable to bypass the proxy. Some examples:
 - usage of non-standard repos with some exotic file layout, which will be
   blocked by the proxy
 - usage of repos not-accessible via proxy (eg only via VPN stared in VpnVM)

This commit introduces 'yum-proxy-setup' pseudo-service, which can be
controlled via standard qvm-service or qubes-manager. When enabled - yum will
be configured at VM startup to use qubes proxy, otherwise - to connect directly
(proxy setting will be cleared).
 2012-05-31 03:05:13 +02:00
Marek Marczykowski
332e9008f0 vm/qubes-yum-proxy: create dir for pidfile under FC15 (#568) 
On FC>=15 /var/run is on tmpfs, so /var/run/tinyproxy from rpm don't survive
reboot. This is bug in Fedora package (should include config file for tmpfiles
service). For now create dir just before starting service.
 2012-05-31 03:05:05 +02:00
Marek Marczykowski
b2cfd73691 vm: qubes-yum-proxy service (#568) 
Introduce proxy service, which allow only http(s) traffic to yum repos. The
filter rules are based on URL regexp, so it isn't full-featured content
inspection and can be easy bypassed, but should be enough to prevent some
erroneus user actions (like clicking on invalid link).

It is set up to intercept connections to 10.137.255.254:8082, so VM can connect
to this IP regardless of VM in which proxy is running. By default it is
started in every NetVM, but this can be changed using qvm-service or
qubes-manager (as always).
 2012-05-31 03:04:11 +02:00
Marek Marczykowski
a953e56042 vm/spec: remove executable perm where not needed 2012-05-31 02:21:15 +02:00
Marek Marczykowski
f11882f1ac dom0+vm/iptables: add PR-QBS-SERVICES chain in PREROUTING nat table 
Additional chain for some qubes-related redirections. BTW PR-QBS should be
renamed now to PR-QBS-DNS...
 2012-05-31 02:21:15 +02:00
Marek Marczykowski
10ed263c12 dom0+vm/vif-script: setup IP address of net backend interface 
This is needed to connect to ProxyVM/NetVM, not only pass traffic ahead. Still
firewall rules applies.
 2012-05-31 02:21:05 +02:00
Marek Marczykowski
6a9b4cadd0 vm+dom0/vif-script: indent fix 2012-05-31 02:03:12 +02:00
Marek Marczykowski
d1ec75d4c8 Merge branch 'hvm' of ssh://gitpro.qubes-os.org/var/lib/qubes/git/joanna/core into hvm 2012-05-31 01:02:52 +02:00
Marek Marczykowski
6bc609fbc3 dom0/qvm-tools: introduce qvm-service tool 
Allow setting vm services same as in qubes-manager
 2012-05-30 13:47:25 +02:00
Marek Marczykowski
36f4086254 vm/notify-update: do not treat network problems as updates pending symptom 2012-05-30 13:40:27 +02:00
Marek Marczykowski
b55da785f7 dom0/qvm-block: hide devices mounted in dom0 (#579) 2012-05-30 00:54:24 +02:00
Alexander Tereshkin
db324b270e libvchan_server_init() now does not wait for a client to connect. A server should wait for an incoming event and then call libvchan_server_handle_connected(). 2012-05-29 17:07:17 +04:00
Joanna Rutkowska
51326e3d1d version 1.7.24 2012-05-28 19:30:55 +02:00
Joanna Rutkowska
dcd57e53f0 Merge branch 'master' of git.qubes-os.org:/var/lib/qubes/git/marmarek/core 2012-05-28 19:29:38 +02:00
Marek Marczykowski
2e8765e1e1 dom0/qvm-ls: add 'kernel' and 'kernelopts' columns 2012-05-26 12:21:42 +02:00
Marek Marczykowski
44c14d409c dom0/core: don't limit netvm/proxyvm vcpu count to 1 (#571) 2012-05-25 15:06:00 +02:00
Marek Marczykowski
05123c09f2 qrexec: describe msg types in header file 2012-05-24 12:11:03 +02:00
Marek Marczykowski
8d18c1291f vm/systemd: generate opts for GUI based on debug-mode (#567) 2012-05-22 16:50:25 +02:00
Marek Marczykowski
1e0117ca50 vm/systemd: generate opts for GUI based on debug-mode (#567) 2012-05-22 16:49:03 +02:00
Marek Marczykowski
b87806db17 dom0: expose debug mode in xenstore (#567) 2012-05-22 15:51:40 +02:00
Marek Marczykowski
3d783f7fa3 dom0: expose debug mode in xenstore (#567) 2012-05-22 15:51:09 +02:00
Marek Marczykowski
987a490179 dom0/core: don't force maxmem=memory for NetVM (#572) 2012-05-20 02:10:50 +02:00
Marek Marczykowski
659dec044f dom0/core: don't force maxmem=memory for NetVM (#572) 2012-05-20 02:08:56 +02:00
Marek Marczykowski
44cec03c33 dom0/update-notify: ensure correct permissions for update stat file 2012-05-16 07:56:40 +02:00
Marek Marczykowski
2b439aedfe dom0/update-notify: ensure correct permissions for update stat file 2012-05-16 07:55:48 +02:00
Marek Marczykowski
8d7811827f dom0/qubes-updates: stat file for qubes-manager 2012-05-14 04:57:57 +02:00
Marek Marczykowski
1e496fbfb7 dom0/qubes-updates: one more qubes-dom0-update typo fix 2012-05-14 04:57:57 +02:00
Marek Marczykowski
be1e72cad7 dom0/qubes-updates: stat file for qubes-manager 2012-05-14 04:56:30 +02:00
Marek Marczykowski
ba3d07d300 dom0/qubes-updates: one more qubes-dom0-update typo fix 2012-05-14 04:56:03 +02:00
Alexander Tereshkin
e31128341b Windows-related code moved to core/win directory. 2012-05-12 20:19:56 +04:00
Alexander Tereshkin
7ea3f4a792 vchan modifications for the Windows build. 2012-05-12 19:27:09 +04:00
Alexander Tereshkin
0f13ea2a84 Fixed a potential memory leak. 2012-05-12 18:32:36 +04:00
Alexander Tereshkin
85f926efaa Removed unnecessary access to /proc/u2mfn. 2012-05-12 18:22:16 +04:00
Joanna Rutkowska
b39ab20314 version 1.7.23-vm 2012-05-12 13:45:12 +02:00
Joanna Rutkowska
8a83f2aa63 Merge branch 'master' of git.qubes-os.org:/var/lib/qubes/git/marmarek/core 2012-05-12 13:36:16 +02:00
Joanna Rutkowska
db82cf6851 version 2.0.23-dom0 2012-05-12 11:59:52 +02:00
Marek Marczykowski
b4aa6c6ddc vm/spec: fix /etc/hosts if it was broken by previous version 2012-05-08 23:45:00 +02:00
Marek Marczykowski
0268819655 vm: do not override /etc/hosts, just add VMNAME to 127.0.0.1 2012-05-08 23:44:59 +02:00
Joanna Rutkowska
02e312ab04 vm: Add localhost alias to /etc/hosts 
... or otherwise, some programs will hang for many secconds trying to resolve localhost.
 2012-05-08 23:44:59 +02:00
Marek Marczykowski
0ebd1d0de6 vm/spec: fix /etc/hosts if it was broken by previous version 2012-05-08 23:44:07 +02:00
Marek Marczykowski
21d86b81fc vm: do not override /etc/hosts, just add VMNAME to 127.0.0.1 2012-05-08 23:43:57 +02:00
Marek Marczykowski
e249db1e13 Merge branch 'master' of ssh://git.qubes-os.org/var/lib/qubes/git/joanna/core 2012-05-08 23:22:29 +02:00
Joanna Rutkowska
d9b009d6fe version 1.7.22 2012-05-08 18:36:30 +02:00
Joanna Rutkowska
40037957bd Merge branch 'master' of git.qubes-os.org:/var/lib/qubes/git/marmarek/core 2012-05-08 18:31:55 +02:00