Qubes/core-admin
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
1,380 Commits 1 Branch 0 Tags 15 MiB
a528befbc4
Commit Graph

1380 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Marek Marczykowski
a528befbc4 dom0: default TemplateVM firewall: block all traffic and allow use of yum proxy (#590) 2012-06-05 21:21:53 +02:00
Marek Marczykowski
a8b992e647 dom0/core: implement per-VM-type firewall defaults 2012-06-05 21:21:53 +02:00
Marek Marczykowski
79f13d6c66 vm: yum plugin to notify dom0 about installed updates (#592) 2012-06-05 21:21:53 +02:00
Marek Marczykowski
c5c916b74c vm/systemd: fix ProxyVM related services deps (#578) 2012-06-05 21:21:53 +02:00
Marek Marczykowski
ea08560e43 makefile: rename vchan Makefile to not conflict with windows build 2012-06-05 21:21:53 +02:00
Marek Marczykowski
1732679b18 vm/qrexec: removed obsolete "directly:" command prefix support 
This was used for launching DispVM editor in pre-qrexec-RPC times.
 2012-06-05 21:21:52 +02:00
Marek Marczykowski
e4f64fd600 dom0/core: remove trailing spaces 2012-05-31 03:11:44 +02:00
Marek Marczykowski
65fc62a989 dom0/core: setup yum to use proxy when it have access to it (#568) 
To simplify configuration, automatically enable 'yum-proxy-setup'
pseudo-service when allowing access to the proxy. Also disable this service,
when access is revoked. Thanks to this the user can enable this feature by one
click in firewall settings.
 2012-05-31 03:11:44 +02:00
Marek Marczykowski
ec52d15dfe dom0/qvm-firewall: add support for 'allowYumProxy' setting (#568) 2012-05-31 03:11:44 +02:00
Marek Marczykowski
2ca4b11183 dom0/core-firewall: firewall setting for qubes-yum-proxy (#568) 
New setting for access to qubes-yum-proxy. The difference from other firewall
setting (and reason for new top-level setting): 'deny' is enforced even if
policy is set to 'allow'. This proxy service is mainly used to filter network
traffic, so do not expose it to VMs which can connect to any host directly (eg
'untrusted' VM).
 2012-05-31 03:11:44 +02:00
Marek Marczykowski
4bac57818e vm/qubes-yum-proxy: setup yum to use qubes-yum-proxy (#568) 
The simplest way is just add proxy=... entry to /etc/yum.conf, but sometimes it
is reasonable to bypass the proxy. Some examples:
 - usage of non-standard repos with some exotic file layout, which will be
   blocked by the proxy
 - usage of repos not-accessible via proxy (eg only via VPN stared in VpnVM)

This commit introduces 'yum-proxy-setup' pseudo-service, which can be
controlled via standard qvm-service or qubes-manager. When enabled - yum will
be configured at VM startup to use qubes proxy, otherwise - to connect directly
(proxy setting will be cleared).
 2012-05-31 03:11:44 +02:00
Marek Marczykowski
1a3a2a05e3 vm/qubes-yum-proxy: create dir for pidfile under FC15 (#568) 
On FC>=15 /var/run is on tmpfs, so /var/run/tinyproxy from rpm don't survive
reboot. This is bug in Fedora package (should include config file for tmpfiles
service). For now create dir just before starting service.
 2012-05-31 03:11:43 +02:00
Marek Marczykowski
96508abf2c vm: qubes-yum-proxy service (#568) 
Introduce proxy service, which allow only http(s) traffic to yum repos. The
filter rules are based on URL regexp, so it isn't full-featured content
inspection and can be easy bypassed, but should be enough to prevent some
erroneus user actions (like clicking on invalid link).

It is set up to intercept connections to 10.137.255.254:8082, so VM can connect
to this IP regardless of VM in which proxy is running. By default it is
started in every NetVM, but this can be changed using qvm-service or
qubes-manager (as always).
 2012-05-31 03:11:43 +02:00
Marek Marczykowski
341fbe012c vm/spec: remove executable perm where not needed 2012-05-31 03:11:43 +02:00
Marek Marczykowski
3224026355 dom0+vm/iptables: add PR-QBS-SERVICES chain in PREROUTING nat table 
Additional chain for some qubes-related redirections. BTW PR-QBS should be
renamed now to PR-QBS-DNS...
 2012-05-31 03:11:43 +02:00
Marek Marczykowski
303355a168 dom0+vm/vif-script: setup IP address of net backend interface 
This is needed to connect to ProxyVM/NetVM, not only pass traffic ahead. Still
firewall rules applies.
 2012-05-31 03:11:43 +02:00
Marek Marczykowski
556bc7ac38 vm+dom0/vif-script: indent fix 2012-05-31 03:11:43 +02:00
Marek Marczykowski
a2b222166a dom0/qvm-tools: introduce qvm-service tool 
Allow setting vm services same as in qubes-manager
 2012-05-31 03:09:22 +02:00
Marek Marczykowski
7b00b8fbe6 vm/notify-update: do not treat network problems as updates pending symptom 2012-05-31 03:09:22 +02:00
Marek Marczykowski
1f8251eefb dom0/qvm-block: hide devices mounted in dom0 (#579) 2012-05-31 03:09:22 +02:00
Marek Marczykowski
39b15033aa dom0/qvm-ls: add 'kernel' and 'kernelopts' columns 2012-05-31 03:09:22 +02:00
Marek Marczykowski
812264cfb0 dom0/core: don't limit netvm/proxyvm vcpu count to 1 (#571) 2012-05-31 03:09:22 +02:00
Marek Marczykowski
63d7cb5231 qrexec: describe msg types in header file 2012-05-31 03:09:22 +02:00
Joanna Rutkowska
51326e3d1d version 1.7.24 2012-05-28 19:30:55 +02:00
Joanna Rutkowska
dcd57e53f0 Merge branch 'master' of git.qubes-os.org:/var/lib/qubes/git/marmarek/core 2012-05-28 19:29:38 +02:00
Marek Marczykowski
8d18c1291f vm/systemd: generate opts for GUI based on debug-mode (#567) 2012-05-22 16:50:25 +02:00
Marek Marczykowski
3d783f7fa3 dom0: expose debug mode in xenstore (#567) 2012-05-22 15:51:09 +02:00
Marek Marczykowski
987a490179 dom0/core: don't force maxmem=memory for NetVM (#572) 2012-05-20 02:10:50 +02:00
Marek Marczykowski
44cec03c33 dom0/update-notify: ensure correct permissions for update stat file 2012-05-16 07:56:40 +02:00
Marek Marczykowski
8d7811827f dom0/qubes-updates: stat file for qubes-manager 2012-05-14 04:57:57 +02:00
Marek Marczykowski
1e496fbfb7 dom0/qubes-updates: one more qubes-dom0-update typo fix 2012-05-14 04:57:57 +02:00
Joanna Rutkowska
b39ab20314 version 1.7.23-vm 2012-05-12 13:45:12 +02:00
Joanna Rutkowska
8a83f2aa63 Merge branch 'master' of git.qubes-os.org:/var/lib/qubes/git/marmarek/core 2012-05-12 13:36:16 +02:00
Marek Marczykowski
0ebd1d0de6 vm/spec: fix /etc/hosts if it was broken by previous version 2012-05-08 23:44:07 +02:00
Marek Marczykowski
21d86b81fc vm: do not override /etc/hosts, just add VMNAME to 127.0.0.1 2012-05-08 23:43:57 +02:00
Marek Marczykowski
e249db1e13 Merge branch 'master' of ssh://git.qubes-os.org/var/lib/qubes/git/joanna/core 2012-05-08 23:22:29 +02:00
Joanna Rutkowska
d9b009d6fe version 1.7.22 2012-05-08 18:36:30 +02:00
Joanna Rutkowska
40037957bd Merge branch 'master' of git.qubes-os.org:/var/lib/qubes/git/marmarek/core 2012-05-08 18:31:55 +02:00
Joanna Rutkowska
abd1f30c3e vm: Add localhost alias to /etc/hosts 
... or otherwise, some programs will hang for many secconds trying to resolve localhost.
 2012-05-08 18:30:27 +02:00
Marek Marczykowski
783ea78292 dom0: var name fix, and one minor sanity check 2012-05-08 15:55:46 +02:00
Marek Marczykowski
26985f85c7 version 1.7.21 2012-05-08 13:20:14 +02:00
Marek Marczykowski
50a58c6331 dom0/dom0-update: clean up metadata caches after downloading updates (#558) 2012-05-07 15:49:38 +02:00
Marek Marczykowski
a5c80d4015 dom0/qvm-pci: add info about required restart after PCI device add/remove 2012-05-07 15:49:37 +02:00
Marek Marczykowski
2798e83f64 Merge branch 'master' of ssh://git.qubes-os.org/var/lib/qubes/git/joanna/core 2012-05-02 00:10:41 +02:00
Marek Marczykowski
82851b7a88 vm/systemd: do not depend on proc-xen.mount (#466) 
local-fs.target already covers /proc/xen
 2012-05-02 00:09:00 +02:00
Marek Marczykowski
ebe74d1661 vm: include /proc/xen in fstab (#466) 2012-05-02 00:09:00 +02:00
Marek Marczykowski
b771cb9f90 dom0/qvm-backup: chown user dir before backup (#492) 2012-05-02 00:09:00 +02:00
Marek Marczykowski
9edc845184 dom0: create appmenus for NetVMs, using separate whitelist (#538) 2012-05-02 00:09:00 +02:00
Marek Marczykowski
7b81659593 dom0: create appmenus template and icon for all VMs 2012-05-02 00:09:00 +02:00
Marek Marczykowski
950d848ede vm: notify dom0 when updates available in VM (#475) 2012-05-02 00:09:00 +02:00