Commit Graph

3538 Commits

Author SHA1 Message Date
Marek Marczykowski-Górecki
1d69f2c24a qvm-tools: fix qvm-firewall -r 2015-04-28 15:00:50 +02:00
Marek Marczykowski-Górecki
1a284f18fb core: store dom0 info in qubes.xml
At least to have there info about its backup.

This was already done in commit
dc6fd3c8f3, but later was erroneously
reverted during migration to libvirt.

Fixes qubesos/qubes-issues#958
2015-04-28 15:00:50 +02:00
Marek Marczykowski-Górecki
c421dc2a95 Prevent concurrent qvm-sync-clock calls
In some cases qvm-sync-clock can take a long time (for example in case
of network problems, or when some do not responds). This can lead to
multiple qvm-sync-clock hanging for the same reason (blocking vchan
resources). To prevent that create a lock file and simply abort when one
instance is already running.
2015-04-28 15:00:50 +02:00
Marek Marczykowski-Górecki
7652137854 core: make sure that dom0.libvirt_domain isn't used
libvirt do not have domain object for dom0, so do not try to access it.
2015-04-28 15:00:50 +02:00
Marek Marczykowski-Górecki
4d5df95ae8 version 3.0.9 2015-04-28 14:23:26 +02:00
Marek Marczykowski-Górecki
cd163b81be dispvm: sanitize used memory info received from VM
Luckily it is used as argument to commands with does not allow any
harmful arguments (virsh set(max)mem). Also usage in arithmetic
expression does not allow any harmful usage in this place.
2015-04-28 03:24:38 +02:00
Marek Marczykowski-Górecki
e9735d156c version 3.0.8 2015-04-15 18:47:41 +02:00
Marek Marczykowski-Górecki
bbf2ee3a67 core: cleanup_vifs should not fail when no network intf is present
This can happen when initially there was no default netvm, some domain
was started, then default netvm was set and started - then
netvm.connected_vms will contain domains which aren't really connected
there.
Especially this was happening in firstboot.
2015-04-15 12:04:21 +02:00
Marek Marczykowski-Górecki
db28551807 tests: update backup tests
Since default netvm name was changed, the restore process need to set
'use-default-netvm' flag.
2015-04-14 23:10:18 +02:00
Marek Marczykowski-Górecki
868ee83093 block: trigger QubesDB watches after attaching/detaching device
Since libvirt do not support such events (at least for libxl driver), we
need some way to notify qubes-manager when device is attached/detached.
Use the same protocol as for connect/disconnect but on the target
domain.
2015-04-14 23:08:52 +02:00
Marek Marczykowski-Górecki
e1da1fb3c1 block: fixes for dom0-backed devices and dead domains 2015-04-14 23:07:54 +02:00
Marek Marczykowski-Górecki
936fa0f4cc version 3.0.7 2015-04-12 03:13:40 +02:00
Marek Marczykowski-Górecki
48945a9d37 linux/systemd: prevent user login before VMs autostart
When user logins, login script will try to connect all guid to all the
running VMs. If VMs are still booting at this stage, will never
automatically get its guid (until user tries to start some program
there). This can for example lead to lack of nm-applet icon.
2015-04-12 03:11:03 +02:00
Marek Marczykowski-Górecki
08c8c919a5 minor indentation fix 2015-04-10 19:05:42 +02:00
Marek Marczykowski-Górecki
f2aa0f3e2f dispvm: prevent any output from qfile-daemon-dvm
This script is connected directly to calling process, so any output here
will disrupt qrexec service data. For example in case of qubes.OpenInVM
this will be prepended to modified file while sending it back to the
source VM - in case of no modification, it will override that file in
the source VM...
2015-04-10 19:01:46 +02:00
Marek Marczykowski-Górecki
913cc27023 core: fix QubesVm.clone_attrs - really copy dicts
Otherwise it would point at the same object and for example changing
vm.services[] in one VM will change that also for another. That link
will be severed after reloading the VMs from qubes.xml, but at least in
case of DispVM startup its too late - vm.service['qubes-dvm'] is set for
the DispVM template even during normal startup, not savefile preparation.
2015-04-10 18:32:14 +02:00
Marek Marczykowski-Górecki
d776400973 version 3.0.6 2015-04-07 15:02:18 +02:00
Marek Marczykowski-Górecki
1ab4663293 core: reject non-NetVM for vm.netvm and vm.dispvm_netvm 2015-04-06 02:55:26 +02:00
Marek Marczykowski-Górecki
75e9c8aff0 tests: test for netvm/dispvm_netvm
Check:
 - default value
 - setting to None
 - setting to a VM
 - resetting to default
 - setting invalid value
2015-04-06 02:53:18 +02:00
Marek Marczykowski-Górecki
dbb43f6035 core/storage: fix disk handling for HVM template
Currently HVM template do not have root-cow.img (also do not use 2-layer
device-mapper as PV VMs), so vm.is_template() check isn't enough.
2015-04-06 00:21:38 +02:00
Marek Marczykowski-Górecki
678ccdfaa0 core: fix saving 'dispvm_netvm' attribute 2015-04-06 00:21:08 +02:00
Marek Marczykowski-Górecki
221750af94 version 3.0.5 2015-04-04 22:04:02 +02:00
Marek Marczykowski-Górecki
d8533bd061 core: do not reset firewal when setting netvm=none
It is no longer needed as qubesos/qubes-issues#862 is implemented.
2015-04-04 21:48:03 +02:00
Marek Marczykowski-Górecki
7516737fae core: Add "dispvm_netvm" property - NetVM for DispVMs started from a VM
This allows to specify tight network isolation for a VM, and finally
close one remaining way for leaking traffic around TorVM. Now when VM is
connected to for example TorVM, its DispVMs will be also connected
there.
The new property can be set to:
 - default (uses_default_dispvm_netvm=True) - use the same NetVM/ProxyVM as the
 calling VM itself - including none it that's the case
 - None - DispVMs will be network-isolated
 - some NetVM/ProxyVM - will be used, even if calling VM is network-isolated

Closes qubesos/qubes-issues#862
2015-04-04 21:47:31 +02:00
Marek Marczykowski-Górecki
a6448e073c block: fix handling non-dom0 backend
The libvirt XML config syntax was changed - the element is named
<backenddomain/>.
2015-04-04 16:18:10 +02:00
Marek Marczykowski-Górecki
b10cead867 version 3.0.4 2015-04-03 11:26:12 +02:00
Marek Marczykowski-Górecki
d76bd0ad1d Use partitioned loop device instead of device-mapper to prepare volatile.img
There was a lot problems with device-mapper, at least it asynchronous
creation, races with udev, problems with cleanup.
2015-04-03 11:24:37 +02:00
Marek Marczykowski-Górecki
1923e366cf version 3.0.3 2015-04-02 01:01:14 +02:00
Marek Marczykowski-Górecki
ea92f5d491 tests: improve clipboard test
To not use gnome-terminal, but much simpler zenity. This fixes some
race-conditions in the test itself.
2015-04-01 05:24:24 +02:00
Marek Marczykowski-Górecki
0727678575 version 3.0.2 2015-04-01 00:12:20 +02:00
Wojtek Porczyk
fbdb2f07ac qmemman: add logging 2015-03-31 20:42:53 +02:00
Wojtek Porczyk
19dfe3d390 core: allow '.' in domain name 2015-03-31 20:42:53 +02:00
Wojtek Porczyk
20b3fdedb8 rename netvm -> sys-net, firewallvm -> sys-firewall 2015-03-31 20:42:53 +02:00
Marek Marczykowski-Górecki
6dac228648 backup: backup any template marked to do so, even if installed by rpm 2015-03-31 05:54:41 +02:00
Marek Marczykowski-Górecki
0b0dbfd1e7 core: default 'include_in_backups' to negative of 'installed_by_rpm'
As we allow to backup template, even if installed by rpm, it makes sense
to not include such templates in backup by default.
2015-03-31 05:49:13 +02:00
Marek Marczykowski-Górecki
b3899ba81a tests: enable long messages by default 2015-03-31 05:14:42 +02:00
Marek Marczykowski-Górecki
d0b3d15212 tests: add a test for secure clipboard 2015-03-31 05:14:18 +02:00
Marek Marczykowski-Górecki
b563cf290e tests: fix firewall test - use the IP, not the ping command... 2015-03-30 22:33:08 +02:00
qjoo
d69b03e5e0 qubes-firewall is not supported in netvms 2015-03-30 22:31:20 +02:00
qjoo
9659c33a09 qvm-service: +disable-dns-server/disable-default-route
The logic for set-default-route/set-dns-server has been inverted.
2015-03-30 22:31:20 +02:00
Marek Marczykowski-Górecki
20c32e7233 tests: give firewallvm more time to apply the rules
Not everyone use fast SSD drive and 4+ core CPU...
2015-03-30 22:31:11 +02:00
Marek Marczykowski-Górecki
961ae3588f tests: force gnome-terminal title, so we can find the window
Debian do not use hostname in gnome-terminal window title by default, so
the test failed there, even when DispVM was started correctly.
Additionally we can't rely on gnome-terminal --title, as it isn't
working on Debian 8...
2015-03-30 21:32:13 +02:00
Marek Marczykowski-Górecki
98ab523da4 Wait for udev to process all the events during volatile.img preparation
Otherwise it could happen that the device will still be opened by udev,
so can't be freed by kpartx
2015-03-30 21:30:58 +02:00
Marek Marczykowski-Górecki
063e2617d6 Cleanup after failed volatile.img preparation 2015-03-30 16:18:52 +02:00
Marek Marczykowski-Górecki
cba8c6430c tests: do not rely on gedit being the default editor
Handle gedit, emacs and vim.
2015-03-30 16:18:09 +02:00
Marek Marczykowski-Górecki
5c59067676 core: treat absence of libvirt domain as 'Halted' state
If the domain isn't defined in libvirt, it surely isn't running. This is
needed for DispVM, which compares with exactly this state.
2015-03-30 05:33:13 +02:00
Marek Marczykowski-Górecki
b61aef2bef dispvm: typos 2015-03-30 05:32:04 +02:00
Marek Marczykowski-Górecki
64755b2d98 dispvm: do not treat DispVMs as Xen-specific
Theoretically it should work (with some minor modifications) on any
hypervisor.
2015-03-30 05:30:52 +02:00
Marek Marczykowski-Górecki
d02aa70e93 dispvm: speedup sparse files handling by using bsdtar
Apparently it is much faster. Especially during savefile preparation -
tar reads the whole file, while bsdtar gets file map and reads only used
regions.
2015-03-30 05:29:14 +02:00
Marek Marczykowski-Górecki
c6f136869e tests: fix handling tests list from cmdline
Previous approach didn't worked for dynamically generated tests.
2015-03-30 01:40:39 +02:00