Qubes/core-admin
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
1,471 Commits 1 Branch 0 Tags 15 MiB
cfd95575dd
Commit Graph

1471 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Marek Marczykowski
2ca4b11183 dom0/core-firewall: firewall setting for qubes-yum-proxy (#568) 
New setting for access to qubes-yum-proxy. The difference from other firewall
setting (and reason for new top-level setting): 'deny' is enforced even if
policy is set to 'allow'. This proxy service is mainly used to filter network
traffic, so do not expose it to VMs which can connect to any host directly (eg
'untrusted' VM).
 2012-05-31 03:11:44 +02:00
Marek Marczykowski
4bac57818e vm/qubes-yum-proxy: setup yum to use qubes-yum-proxy (#568) 
The simplest way is just add proxy=... entry to /etc/yum.conf, but sometimes it
is reasonable to bypass the proxy. Some examples:
 - usage of non-standard repos with some exotic file layout, which will be
   blocked by the proxy
 - usage of repos not-accessible via proxy (eg only via VPN stared in VpnVM)

This commit introduces 'yum-proxy-setup' pseudo-service, which can be
controlled via standard qvm-service or qubes-manager. When enabled - yum will
be configured at VM startup to use qubes proxy, otherwise - to connect directly
(proxy setting will be cleared).
 2012-05-31 03:11:44 +02:00
Marek Marczykowski
1a3a2a05e3 vm/qubes-yum-proxy: create dir for pidfile under FC15 (#568) 
On FC>=15 /var/run is on tmpfs, so /var/run/tinyproxy from rpm don't survive
reboot. This is bug in Fedora package (should include config file for tmpfiles
service). For now create dir just before starting service.
 2012-05-31 03:11:43 +02:00
Marek Marczykowski
96508abf2c vm: qubes-yum-proxy service (#568) 
Introduce proxy service, which allow only http(s) traffic to yum repos. The
filter rules are based on URL regexp, so it isn't full-featured content
inspection and can be easy bypassed, but should be enough to prevent some
erroneus user actions (like clicking on invalid link).

It is set up to intercept connections to 10.137.255.254:8082, so VM can connect
to this IP regardless of VM in which proxy is running. By default it is
started in every NetVM, but this can be changed using qvm-service or
qubes-manager (as always).
 2012-05-31 03:11:43 +02:00
Marek Marczykowski
341fbe012c vm/spec: remove executable perm where not needed 2012-05-31 03:11:43 +02:00
Marek Marczykowski
3224026355 dom0+vm/iptables: add PR-QBS-SERVICES chain in PREROUTING nat table 
Additional chain for some qubes-related redirections. BTW PR-QBS should be
renamed now to PR-QBS-DNS...
 2012-05-31 03:11:43 +02:00
Marek Marczykowski
303355a168 dom0+vm/vif-script: setup IP address of net backend interface 
This is needed to connect to ProxyVM/NetVM, not only pass traffic ahead. Still
firewall rules applies.
 2012-05-31 03:11:43 +02:00
Marek Marczykowski
556bc7ac38 vm+dom0/vif-script: indent fix 2012-05-31 03:11:43 +02:00
Marek Marczykowski
a2b222166a dom0/qvm-tools: introduce qvm-service tool 
Allow setting vm services same as in qubes-manager
 2012-05-31 03:09:22 +02:00
Marek Marczykowski
7b00b8fbe6 vm/notify-update: do not treat network problems as updates pending symptom 2012-05-31 03:09:22 +02:00
Marek Marczykowski
1f8251eefb dom0/qvm-block: hide devices mounted in dom0 (#579) 2012-05-31 03:09:22 +02:00
Marek Marczykowski
39b15033aa dom0/qvm-ls: add 'kernel' and 'kernelopts' columns 2012-05-31 03:09:22 +02:00
Marek Marczykowski
812264cfb0 dom0/core: don't limit netvm/proxyvm vcpu count to 1 (#571) 2012-05-31 03:09:22 +02:00
Marek Marczykowski
63d7cb5231 qrexec: describe msg types in header file 2012-05-31 03:09:22 +02:00
Joanna Rutkowska
51326e3d1d version 1.7.24 2012-05-28 19:30:55 +02:00
Joanna Rutkowska
dcd57e53f0 Merge branch 'master' of git.qubes-os.org:/var/lib/qubes/git/marmarek/core 2012-05-28 19:29:38 +02:00
Marek Marczykowski
8d18c1291f vm/systemd: generate opts for GUI based on debug-mode (#567) 2012-05-22 16:50:25 +02:00
Marek Marczykowski
3d783f7fa3 dom0: expose debug mode in xenstore (#567) 2012-05-22 15:51:09 +02:00
Marek Marczykowski
987a490179 dom0/core: don't force maxmem=memory for NetVM (#572) 2012-05-20 02:10:50 +02:00
Marek Marczykowski
44cec03c33 dom0/update-notify: ensure correct permissions for update stat file 2012-05-16 07:56:40 +02:00
Marek Marczykowski
8d7811827f dom0/qubes-updates: stat file for qubes-manager 2012-05-14 04:57:57 +02:00
Marek Marczykowski
1e496fbfb7 dom0/qubes-updates: one more qubes-dom0-update typo fix 2012-05-14 04:57:57 +02:00
Joanna Rutkowska
b39ab20314 version 1.7.23-vm 2012-05-12 13:45:12 +02:00
Joanna Rutkowska
8a83f2aa63 Merge branch 'master' of git.qubes-os.org:/var/lib/qubes/git/marmarek/core 2012-05-12 13:36:16 +02:00
Marek Marczykowski
0ebd1d0de6 vm/spec: fix /etc/hosts if it was broken by previous version 2012-05-08 23:44:07 +02:00
Marek Marczykowski
21d86b81fc vm: do not override /etc/hosts, just add VMNAME to 127.0.0.1 2012-05-08 23:43:57 +02:00
Marek Marczykowski
e249db1e13 Merge branch 'master' of ssh://git.qubes-os.org/var/lib/qubes/git/joanna/core 2012-05-08 23:22:29 +02:00
Joanna Rutkowska
d9b009d6fe version 1.7.22 2012-05-08 18:36:30 +02:00
Joanna Rutkowska
40037957bd Merge branch 'master' of git.qubes-os.org:/var/lib/qubes/git/marmarek/core 2012-05-08 18:31:55 +02:00
Joanna Rutkowska
abd1f30c3e vm: Add localhost alias to /etc/hosts 
... or otherwise, some programs will hang for many secconds trying to resolve localhost.
 2012-05-08 18:30:27 +02:00
Marek Marczykowski
783ea78292 dom0: var name fix, and one minor sanity check 2012-05-08 15:55:46 +02:00
Marek Marczykowski
26985f85c7 version 1.7.21 2012-05-08 13:20:14 +02:00
Marek Marczykowski
50a58c6331 dom0/dom0-update: clean up metadata caches after downloading updates (#558) 2012-05-07 15:49:38 +02:00
Marek Marczykowski
a5c80d4015 dom0/qvm-pci: add info about required restart after PCI device add/remove 2012-05-07 15:49:37 +02:00
Marek Marczykowski
2798e83f64 Merge branch 'master' of ssh://git.qubes-os.org/var/lib/qubes/git/joanna/core 2012-05-02 00:10:41 +02:00
Marek Marczykowski
82851b7a88 vm/systemd: do not depend on proc-xen.mount (#466) 
local-fs.target already covers /proc/xen
 2012-05-02 00:09:00 +02:00
Marek Marczykowski
ebe74d1661 vm: include /proc/xen in fstab (#466) 2012-05-02 00:09:00 +02:00
Marek Marczykowski
b771cb9f90 dom0/qvm-backup: chown user dir before backup (#492) 2012-05-02 00:09:00 +02:00
Marek Marczykowski
9edc845184 dom0: create appmenus for NetVMs, using separate whitelist (#538) 2012-05-02 00:09:00 +02:00
Marek Marczykowski
7b81659593 dom0: create appmenus template and icon for all VMs 2012-05-02 00:09:00 +02:00
Marek Marczykowski
950d848ede vm: notify dom0 when updates available in VM (#475) 2012-05-02 00:09:00 +02:00
Marek Marczykowski
370ad33c44 dom0: provide service for VM to notify about updates availability (#475) 2012-05-02 00:09:00 +02:00
Marek Marczykowski
9c7ab91491 dom0: remove unused reset_vm_configs.py 2012-05-02 00:09:00 +02:00
Joanna Rutkowska
9d0af1731c version 1.7.20 2012-05-01 11:01:16 +02:00
Marek Marczykowski
db6eb497a6 dom0/core: do not relay on any max xid (#445) 
What is really required is the maximum number of domains, not its IDs. Use max
QID as maximum number of domains.
 2012-04-28 03:26:20 +02:00
Marek Marczykowski
c0f1d3c53b dom0/qvm-ls: show 'n/a' in disk usage for dom0 2012-04-28 03:26:20 +02:00
Marek Marczykowski
0c43635806 dom0: add missing 2> /dev/null to unbind_pci_device.sh (#550) 2012-04-28 03:26:20 +02:00
Marek Marczykowski
07e1ca35e7 dom0+vm/hotplug-script: improve error checking, log only important messages (#477) 2012-04-25 23:43:50 +02:00
Marek Marczykowski
daa82bb62c dom0: fix check-updates cron job 2012-04-25 23:43:50 +02:00
Marek Marczykowski
87d4e1586d vm/qubes-dom0-update: display info when no updates available 2012-04-25 23:43:50 +02:00