admin.py 60 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667
  1. #
  2. # The Qubes OS Project, https://www.qubes-os.org/
  3. #
  4. # Copyright (C) 2017 Wojtek Porczyk <woju@invisiblethingslab.com>
  5. #
  6. # This library is free software; you can redistribute it and/or
  7. # modify it under the terms of the GNU Lesser General Public
  8. # License as published by the Free Software Foundation; either
  9. # version 2.1 of the License, or (at your option) any later version.
  10. #
  11. # This library is distributed in the hope that it will be useful,
  12. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  13. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14. # Lesser General Public License for more details.
  15. #
  16. # You should have received a copy of the GNU Lesser General Public
  17. # License along with this library; if not, see <https://www.gnu.org/licenses/>.
  18. #
  19. '''
  20. Qubes OS Management API
  21. '''
  22. import asyncio
  23. import functools
  24. import itertools
  25. import os
  26. import string
  27. import subprocess
  28. import libvirt
  29. import lxml.etree
  30. import pkg_resources
  31. import yaml
  32. import qubes.api
  33. import qubes.backup
  34. import qubes.config
  35. import qubes.devices
  36. import qubes.firewall
  37. import qubes.storage
  38. import qubes.utils
  39. import qubes.vm
  40. import qubes.vm.adminvm
  41. import qubes.vm.qubesvm
  42. class QubesMgmtEventsDispatcher:
  43. def __init__(self, filters, send_event):
  44. self.filters = filters
  45. self.send_event = send_event
  46. def vm_handler(self, subject, event, **kwargs):
  47. # do not send internal events
  48. if event.startswith('admin-permission:'):
  49. return
  50. if event.startswith('device-get:'):
  51. return
  52. if event.startswith('device-list:'):
  53. return
  54. if event.startswith('device-list-attached:'):
  55. return
  56. if event in ('domain-is-fully-usable',):
  57. return
  58. if not list(qubes.api.apply_filters([(subject, event, kwargs)],
  59. self.filters)):
  60. return
  61. self.send_event(subject, event, **kwargs)
  62. def app_handler(self, subject, event, **kwargs):
  63. if not list(qubes.api.apply_filters([(subject, event, kwargs)],
  64. self.filters)):
  65. return
  66. self.send_event(subject, event, **kwargs)
  67. def on_domain_add(self, subject, event, vm):
  68. # pylint: disable=unused-argument
  69. vm.add_handler('*', self.vm_handler)
  70. def on_domain_delete(self, subject, event, vm):
  71. # pylint: disable=unused-argument
  72. vm.remove_handler('*', self.vm_handler)
  73. class QubesAdminAPI(qubes.api.AbstractQubesAPI):
  74. """Implementation of Qubes Management API calls
  75. This class contains all the methods available in the main API.
  76. .. seealso::
  77. https://www.qubes-os.org/doc/mgmt1/
  78. """
  79. SOCKNAME = '/var/run/qubesd.sock'
  80. @qubes.api.method('admin.vmclass.List', no_payload=True,
  81. scope='global', read=True)
  82. @asyncio.coroutine
  83. def vmclass_list(self):
  84. """List all VM classes"""
  85. self.enforce(not self.arg)
  86. self.enforce(self.dest.name == 'dom0')
  87. entrypoints = self.fire_event_for_filter(
  88. pkg_resources.iter_entry_points(qubes.vm.VM_ENTRY_POINT))
  89. return ''.join('{}\n'.format(ep.name)
  90. for ep in entrypoints)
  91. @qubes.api.method('admin.vm.List', no_payload=True,
  92. scope='global', read=True)
  93. @asyncio.coroutine
  94. def vm_list(self):
  95. """List all the domains"""
  96. self.enforce(not self.arg)
  97. if self.dest.name == 'dom0':
  98. domains = self.fire_event_for_filter(self.app.domains)
  99. else:
  100. domains = self.fire_event_for_filter([self.dest])
  101. return ''.join('{} class={} state={}\n'.format(
  102. vm.name,
  103. vm.__class__.__name__,
  104. vm.get_power_state())
  105. for vm in sorted(domains))
  106. @qubes.api.method('admin.vm.property.List', no_payload=True,
  107. scope='local', read=True)
  108. @asyncio.coroutine
  109. def vm_property_list(self):
  110. """List all properties on a qube"""
  111. return self._property_list(self.dest)
  112. @qubes.api.method('admin.property.List', no_payload=True,
  113. scope='global', read=True)
  114. @asyncio.coroutine
  115. def property_list(self):
  116. """List all global properties"""
  117. self.enforce(self.dest.name == 'dom0')
  118. return self._property_list(self.app)
  119. def _property_list(self, dest):
  120. self.enforce(not self.arg)
  121. properties = self.fire_event_for_filter(dest.property_list())
  122. return ''.join('{}\n'.format(prop.__name__) for prop in properties)
  123. @qubes.api.method('admin.vm.property.Get', no_payload=True,
  124. scope='local', read=True)
  125. @asyncio.coroutine
  126. def vm_property_get(self):
  127. """Get a value of one property"""
  128. return self._property_get(self.dest)
  129. @qubes.api.method('admin.property.Get', no_payload=True,
  130. scope='global', read=True)
  131. @asyncio.coroutine
  132. def property_get(self):
  133. """Get a value of one global property"""
  134. self.enforce(self.dest.name == 'dom0')
  135. return self._property_get(self.app)
  136. def _property_get(self, dest):
  137. if self.arg not in dest.property_list():
  138. raise qubes.exc.QubesNoSuchPropertyError(dest, self.arg)
  139. self.fire_event_for_permission()
  140. return self._serialize_property(dest, self.arg)
  141. @staticmethod
  142. def _serialize_property(dest, prop):
  143. property_def = dest.property_get_def(prop)
  144. # explicit list to be sure that it matches protocol spec
  145. if isinstance(property_def, qubes.vm.VMProperty):
  146. property_type = 'vm'
  147. elif property_def.type is int:
  148. property_type = 'int'
  149. elif property_def.type is bool:
  150. property_type = 'bool'
  151. elif prop == 'label':
  152. property_type = 'label'
  153. else:
  154. property_type = 'str'
  155. try:
  156. value = getattr(dest, str(prop))
  157. except AttributeError:
  158. return 'default=True type={} '.format(property_type)
  159. else:
  160. return 'default={} type={} {}'.format(
  161. str(dest.property_is_default(prop)),
  162. property_type,
  163. str(value) if value is not None else '')
  164. @qubes.api.method('admin.vm.property.GetAll', no_payload=True,
  165. scope='local', read=True)
  166. @asyncio.coroutine
  167. def vm_property_get_all(self):
  168. """Get values of all VM properties"""
  169. return self._property_get_all(self.dest)
  170. @qubes.api.method('admin.property.GetAll', no_payload=True,
  171. scope='global', read=True)
  172. @asyncio.coroutine
  173. def property_get_all(self):
  174. """Get value all global properties"""
  175. self.enforce(self.dest.name == 'dom0')
  176. return self._property_get_all(self.app)
  177. def _property_get_all(self, dest):
  178. self.enforce(not self.arg)
  179. properties = dest.property_list()
  180. properties = self.fire_event_for_filter(properties)
  181. return ''.join(
  182. '{} {}\n'.format(str(prop),
  183. self._serialize_property(dest, prop).
  184. replace('\\', '\\\\').replace('\n', '\\n'))
  185. for prop in sorted(properties))
  186. @qubes.api.method('admin.vm.property.GetDefault', no_payload=True,
  187. scope='local', read=True)
  188. @asyncio.coroutine
  189. def vm_property_get_default(self):
  190. """Get a value of one property"""
  191. return self._property_get_default(self.dest)
  192. @qubes.api.method('admin.property.GetDefault', no_payload=True,
  193. scope='global', read=True)
  194. @asyncio.coroutine
  195. def property_get_default(self):
  196. """Get a value of one global property"""
  197. self.enforce(self.dest.name == 'dom0')
  198. return self._property_get_default(self.app)
  199. def _property_get_default(self, dest):
  200. if self.arg not in dest.property_list():
  201. raise qubes.exc.QubesNoSuchPropertyError(dest, self.arg)
  202. self.fire_event_for_permission()
  203. property_def = dest.property_get_def(self.arg)
  204. # explicit list to be sure that it matches protocol spec
  205. if isinstance(property_def, qubes.vm.VMProperty):
  206. property_type = 'vm'
  207. elif property_def.type is int:
  208. property_type = 'int'
  209. elif property_def.type is bool:
  210. property_type = 'bool'
  211. elif self.arg == 'label':
  212. property_type = 'label'
  213. else:
  214. property_type = 'str'
  215. try:
  216. value = property_def.get_default(dest)
  217. except AttributeError:
  218. return None
  219. else:
  220. return 'type={} {}'.format(
  221. property_type,
  222. str(value) if value is not None else '')
  223. @qubes.api.method('admin.vm.property.Set',
  224. scope='local', write=True)
  225. @asyncio.coroutine
  226. def vm_property_set(self, untrusted_payload):
  227. """Set property value"""
  228. return self._property_set(self.dest,
  229. untrusted_payload=untrusted_payload)
  230. @qubes.api.method('admin.property.Set',
  231. scope='global', write=True)
  232. @asyncio.coroutine
  233. def property_set(self, untrusted_payload):
  234. """Set property value"""
  235. self.enforce(self.dest.name == 'dom0')
  236. return self._property_set(self.app,
  237. untrusted_payload=untrusted_payload)
  238. def _property_set(self, dest, untrusted_payload):
  239. if self.arg not in dest.property_list():
  240. raise qubes.exc.QubesNoSuchPropertyError(dest, self.arg)
  241. property_def = dest.property_get_def(self.arg)
  242. newvalue = property_def.sanitize(untrusted_newvalue=untrusted_payload)
  243. self.fire_event_for_permission(newvalue=newvalue)
  244. setattr(dest, self.arg, newvalue)
  245. self.app.save()
  246. @qubes.api.method('admin.vm.property.Help', no_payload=True,
  247. scope='local', read=True)
  248. @asyncio.coroutine
  249. def vm_property_help(self):
  250. """Get help for one property"""
  251. return self._property_help(self.dest)
  252. @qubes.api.method('admin.property.Help', no_payload=True,
  253. scope='global', read=True)
  254. @asyncio.coroutine
  255. def property_help(self):
  256. """Get help for one property"""
  257. self.enforce(self.dest.name == 'dom0')
  258. return self._property_help(self.app)
  259. def _property_help(self, dest):
  260. if self.arg not in dest.property_list():
  261. raise qubes.exc.QubesNoSuchPropertyError(dest, self.arg)
  262. self.fire_event_for_permission()
  263. try:
  264. doc = dest.property_get_def(self.arg).__doc__
  265. except AttributeError:
  266. return ''
  267. return qubes.utils.format_doc(doc)
  268. @qubes.api.method('admin.vm.property.Reset', no_payload=True,
  269. scope='local', write=True)
  270. @asyncio.coroutine
  271. def vm_property_reset(self):
  272. """Reset a property to a default value"""
  273. return self._property_reset(self.dest)
  274. @qubes.api.method('admin.property.Reset', no_payload=True,
  275. scope='global', write=True)
  276. @asyncio.coroutine
  277. def property_reset(self):
  278. """Reset a property to a default value"""
  279. self.enforce(self.dest.name == 'dom0')
  280. return self._property_reset(self.app)
  281. def _property_reset(self, dest):
  282. if self.arg not in dest.property_list():
  283. raise qubes.exc.QubesNoSuchPropertyError(dest, self.arg)
  284. self.fire_event_for_permission()
  285. delattr(dest, self.arg)
  286. self.app.save()
  287. @qubes.api.method('admin.vm.volume.List', no_payload=True,
  288. scope='local', read=True)
  289. @asyncio.coroutine
  290. def vm_volume_list(self):
  291. self.enforce(not self.arg)
  292. volume_names = self.fire_event_for_filter(self.dest.volumes.keys())
  293. return ''.join('{}\n'.format(name) for name in volume_names)
  294. @qubes.api.method('admin.vm.volume.Info', no_payload=True,
  295. scope='local', read=True)
  296. @asyncio.coroutine
  297. def vm_volume_info(self):
  298. self.enforce(self.arg in self.dest.volumes.keys())
  299. self.fire_event_for_permission()
  300. volume = self.dest.volumes[self.arg]
  301. # properties defined in API
  302. volume_properties = [
  303. 'pool', 'vid', 'size', 'usage', 'rw', 'source', 'path',
  304. 'save_on_stop', 'snap_on_start', 'revisions_to_keep']
  305. def _serialize(value):
  306. if callable(value):
  307. value = value()
  308. if value is None:
  309. value = ''
  310. return str(value)
  311. info = ''.join('{}={}\n'.format(key, _serialize(getattr(volume, key)))
  312. for key in volume_properties)
  313. try:
  314. info += 'is_outdated={}\n'.format(volume.is_outdated())
  315. except NotImplementedError:
  316. pass
  317. return info
  318. @qubes.api.method('admin.vm.volume.ListSnapshots', no_payload=True,
  319. scope='local', read=True)
  320. @asyncio.coroutine
  321. def vm_volume_listsnapshots(self):
  322. self.enforce(self.arg in self.dest.volumes.keys())
  323. volume = self.dest.volumes[self.arg]
  324. id_to_timestamp = volume.revisions
  325. revisions = sorted(id_to_timestamp, key=id_to_timestamp.__getitem__)
  326. revisions = self.fire_event_for_filter(revisions)
  327. return ''.join('{}\n'.format(revision) for revision in revisions)
  328. @qubes.api.method('admin.vm.volume.Revert',
  329. scope='local', write=True)
  330. @asyncio.coroutine
  331. def vm_volume_revert(self, untrusted_payload):
  332. self.enforce(self.arg in self.dest.volumes.keys())
  333. untrusted_revision = untrusted_payload.decode('ascii').strip()
  334. del untrusted_payload
  335. volume = self.dest.volumes[self.arg]
  336. snapshots = volume.revisions
  337. self.enforce(untrusted_revision in snapshots)
  338. revision = untrusted_revision
  339. self.fire_event_for_permission(volume=volume, revision=revision)
  340. yield from qubes.utils.coro_maybe(volume.revert(revision))
  341. self.app.save()
  342. # write=True because this allow to clone VM - and most likely modify that
  343. # one - still having the same data
  344. @qubes.api.method('admin.vm.volume.CloneFrom', no_payload=True,
  345. scope='local', write=True)
  346. @asyncio.coroutine
  347. def vm_volume_clone_from(self):
  348. self.enforce(self.arg in self.dest.volumes.keys())
  349. volume = self.dest.volumes[self.arg]
  350. self.fire_event_for_permission(volume=volume)
  351. token = qubes.utils.random_string(32)
  352. # save token on self.app, as self is not persistent
  353. if not hasattr(self.app, 'api_admin_pending_clone'):
  354. self.app.api_admin_pending_clone = {}
  355. # don't handle collisions any better - if someone is so much out of
  356. # luck, can try again anyway
  357. self.enforce(token not in self.app.api_admin_pending_clone)
  358. self.app.api_admin_pending_clone[token] = volume
  359. return token
  360. @qubes.api.method('admin.vm.volume.CloneTo',
  361. scope='local', write=True)
  362. @asyncio.coroutine
  363. def vm_volume_clone_to(self, untrusted_payload):
  364. self.enforce(self.arg in self.dest.volumes.keys())
  365. untrusted_token = untrusted_payload.decode('ascii').strip()
  366. del untrusted_payload
  367. self.enforce(
  368. untrusted_token in getattr(self.app, 'api_admin_pending_clone', {}))
  369. token = untrusted_token
  370. del untrusted_token
  371. src_volume = self.app.api_admin_pending_clone[token]
  372. del self.app.api_admin_pending_clone[token]
  373. # make sure the volume still exists, but invalidate token anyway
  374. self.enforce(str(src_volume.pool) in self.app.pools)
  375. self.enforce(src_volume in self.app.pools[str(src_volume.pool)].volumes)
  376. dst_volume = self.dest.volumes[self.arg]
  377. self.fire_event_for_permission(src_volume=src_volume,
  378. dst_volume=dst_volume)
  379. self.dest.volumes[self.arg] = yield from qubes.utils.coro_maybe(
  380. dst_volume.import_volume(src_volume))
  381. self.app.save()
  382. @qubes.api.method('admin.vm.volume.Resize',
  383. scope='local', write=True)
  384. @asyncio.coroutine
  385. def vm_volume_resize(self, untrusted_payload):
  386. self.enforce(self.arg in self.dest.volumes.keys())
  387. untrusted_size = untrusted_payload.decode('ascii').strip()
  388. del untrusted_payload
  389. self.enforce(untrusted_size.isdigit()) # only digits, forbid '-' too
  390. self.enforce(len(untrusted_size) <= 20) # limit to about 2^64
  391. size = int(untrusted_size)
  392. self.fire_event_for_permission(size=size)
  393. try:
  394. yield from self.dest.storage.resize(self.arg, size)
  395. finally: # even if calling qubes.ResizeDisk inside the VM failed
  396. self.app.save()
  397. @qubes.api.method('admin.vm.volume.Set.revisions_to_keep',
  398. scope='local', write=True)
  399. @asyncio.coroutine
  400. def vm_volume_set_revisions_to_keep(self, untrusted_payload):
  401. self.enforce(self.arg in self.dest.volumes.keys())
  402. try:
  403. untrusted_value = int(untrusted_payload.decode('ascii'))
  404. except (UnicodeDecodeError, ValueError):
  405. raise qubes.api.ProtocolError('Invalid value')
  406. del untrusted_payload
  407. self.enforce(untrusted_value >= 0)
  408. newvalue = untrusted_value
  409. del untrusted_value
  410. self.fire_event_for_permission(newvalue=newvalue)
  411. self.dest.volumes[self.arg].revisions_to_keep = newvalue
  412. self.app.save()
  413. @qubes.api.method('admin.vm.volume.Set.rw',
  414. scope='local', write=True)
  415. @asyncio.coroutine
  416. def vm_volume_set_rw(self, untrusted_payload):
  417. self.enforce(self.arg in self.dest.volumes.keys())
  418. try:
  419. newvalue = qubes.property.bool(None, None,
  420. untrusted_payload.decode('ascii'))
  421. except (UnicodeDecodeError, ValueError):
  422. raise qubes.api.ProtocolError('Invalid value')
  423. del untrusted_payload
  424. self.fire_event_for_permission(newvalue=newvalue)
  425. if not self.dest.is_halted():
  426. raise qubes.exc.QubesVMNotHaltedError(self.dest)
  427. self.dest.volumes[self.arg].rw = newvalue
  428. self.app.save()
  429. @qubes.api.method('admin.vm.tag.List', no_payload=True,
  430. scope='local', read=True)
  431. @asyncio.coroutine
  432. def vm_tag_list(self):
  433. self.enforce(not self.arg)
  434. tags = self.dest.tags
  435. tags = self.fire_event_for_filter(tags)
  436. return ''.join('{}\n'.format(tag) for tag in sorted(tags))
  437. @qubes.api.method('admin.vm.tag.Get', no_payload=True,
  438. scope='local', read=True)
  439. @asyncio.coroutine
  440. def vm_tag_get(self):
  441. qubes.vm.Tags.validate_tag(self.arg)
  442. self.fire_event_for_permission()
  443. return '1' if self.arg in self.dest.tags else '0'
  444. @qubes.api.method('admin.vm.tag.Set', no_payload=True,
  445. scope='local', write=True)
  446. @asyncio.coroutine
  447. def vm_tag_set(self):
  448. qubes.vm.Tags.validate_tag(self.arg)
  449. self.fire_event_for_permission()
  450. self.dest.tags.add(self.arg)
  451. self.app.save()
  452. @qubes.api.method('admin.vm.tag.Remove', no_payload=True,
  453. scope='local', write=True)
  454. @asyncio.coroutine
  455. def vm_tag_remove(self):
  456. qubes.vm.Tags.validate_tag(self.arg)
  457. self.fire_event_for_permission()
  458. try:
  459. self.dest.tags.remove(self.arg)
  460. except KeyError:
  461. raise qubes.exc.QubesTagNotFoundError(self.dest, self.arg)
  462. self.app.save()
  463. @qubes.api.method('admin.vm.Console', no_payload=True,
  464. scope='local', write=True)
  465. @asyncio.coroutine
  466. def vm_console(self):
  467. self.enforce(not self.arg)
  468. self.fire_event_for_permission()
  469. if not self.dest.is_running():
  470. raise qubes.exc.QubesVMNotRunningError(self.dest)
  471. xml_desc = lxml.etree.fromstring(self.dest.libvirt_domain.XMLDesc())
  472. ttypath = xml_desc.xpath('string(/domain/devices/console/@tty)')
  473. # this value is returned to /etc/qubes-rpc/admin.vm.Console script,
  474. # which will call socat on it
  475. return ttypath
  476. @qubes.api.method('admin.pool.List', no_payload=True,
  477. scope='global', read=True)
  478. @asyncio.coroutine
  479. def pool_list(self):
  480. self.enforce(not self.arg)
  481. self.enforce(self.dest.name == 'dom0')
  482. pools = self.fire_event_for_filter(self.app.pools)
  483. return ''.join('{}\n'.format(pool) for pool in pools)
  484. @qubes.api.method('admin.pool.ListDrivers', no_payload=True,
  485. scope='global', read=True)
  486. @asyncio.coroutine
  487. def pool_listdrivers(self):
  488. self.enforce(self.dest.name == 'dom0')
  489. self.enforce(not self.arg)
  490. drivers = self.fire_event_for_filter(qubes.storage.pool_drivers())
  491. return ''.join('{} {}\n'.format(
  492. driver,
  493. ' '.join(qubes.storage.driver_parameters(driver)))
  494. for driver in drivers)
  495. @qubes.api.method('admin.pool.Info', no_payload=True,
  496. scope='global', read=True)
  497. @asyncio.coroutine
  498. def pool_info(self):
  499. self.enforce(self.dest.name == 'dom0')
  500. self.enforce(self.arg in self.app.pools.keys())
  501. pool = self.app.pools[self.arg]
  502. self.fire_event_for_permission(pool=pool)
  503. other_info = ''
  504. # Deprecated: remove this when all tools using this call are updated
  505. pool_size = pool.size
  506. if pool_size is not None:
  507. other_info += 'size={}\n'.format(pool_size)
  508. pool_usage = pool.usage
  509. if pool_usage is not None:
  510. other_info += 'usage={}\n'.format(pool_usage)
  511. try:
  512. included_in = pool.included_in(self.app)
  513. if included_in:
  514. other_info += 'included_in={}\n'.format(str(included_in))
  515. except NotImplementedError:
  516. pass
  517. return ''.join('{}={}\n'.format(prop, val)
  518. for prop, val in sorted(pool.config.items())) + \
  519. other_info
  520. @qubes.api.method('admin.pool.UsageDetails', no_payload=True,
  521. scope='global', read=True)
  522. @asyncio.coroutine
  523. def pool_usage(self):
  524. self.enforce(self.dest.name == 'dom0')
  525. self.enforce(self.arg in self.app.pools.keys())
  526. pool = self.app.pools[self.arg]
  527. self.fire_event_for_permission(pool=pool)
  528. usage = ''
  529. pool_details = pool.usage_details
  530. for name in sorted(pool_details):
  531. usage += '{}={}\n'.format(name, pool_details[name])
  532. return usage
  533. @qubes.api.method('admin.pool.Add',
  534. scope='global', write=True)
  535. @asyncio.coroutine
  536. def pool_add(self, untrusted_payload):
  537. self.enforce(self.dest.name == 'dom0')
  538. drivers = qubes.storage.pool_drivers()
  539. self.enforce(self.arg in drivers)
  540. untrusted_pool_config = untrusted_payload.decode('ascii').splitlines()
  541. del untrusted_payload
  542. self.enforce(all(('=' in line) for line in untrusted_pool_config))
  543. # pairs of (option, value)
  544. untrusted_pool_config = [line.split('=', 1)
  545. for line in untrusted_pool_config]
  546. # reject duplicated options
  547. self.enforce(
  548. len(set(x[0] for x in untrusted_pool_config)) ==
  549. len([x[0] for x in untrusted_pool_config]))
  550. # and convert to dict
  551. untrusted_pool_config = dict(untrusted_pool_config)
  552. self.enforce('name' in untrusted_pool_config)
  553. untrusted_pool_name = untrusted_pool_config.pop('name')
  554. allowed_chars = string.ascii_letters + string.digits + '-_.'
  555. self.enforce(all(c in allowed_chars for c in untrusted_pool_name))
  556. pool_name = untrusted_pool_name
  557. self.enforce(pool_name not in self.app.pools)
  558. driver_parameters = qubes.storage.driver_parameters(self.arg)
  559. unexpected_parameters = [key for key in untrusted_pool_config
  560. if key not in driver_parameters]
  561. if unexpected_parameters:
  562. raise qubes.exc.QubesException(
  563. 'unexpected driver options: ' + ' '.join(unexpected_parameters))
  564. pool_config = untrusted_pool_config
  565. self.fire_event_for_permission(name=pool_name,
  566. pool_config=pool_config)
  567. yield from self.app.add_pool(name=pool_name, driver=self.arg,
  568. **pool_config)
  569. self.app.save()
  570. @qubes.api.method('admin.pool.Remove', no_payload=True,
  571. scope='global', write=True)
  572. @asyncio.coroutine
  573. def pool_remove(self):
  574. self.enforce(self.dest.name == 'dom0')
  575. self.enforce(self.arg in self.app.pools.keys())
  576. self.fire_event_for_permission()
  577. yield from self.app.remove_pool(self.arg)
  578. self.app.save()
  579. @qubes.api.method('admin.pool.volume.List', no_payload=True,
  580. scope='global', read=True)
  581. @asyncio.coroutine
  582. def pool_volume_list(self):
  583. self.enforce(self.dest.name == 'dom0')
  584. self.enforce(self.arg in self.app.pools.keys())
  585. pool = self.app.pools[self.arg]
  586. volume_names = self.fire_event_for_filter(pool.volumes.keys())
  587. return ''.join('{}\n'.format(name) for name in volume_names)
  588. @qubes.api.method('admin.pool.Set.revisions_to_keep',
  589. scope='global', write=True)
  590. @asyncio.coroutine
  591. def pool_set_revisions_to_keep(self, untrusted_payload):
  592. self.enforce(self.dest.name == 'dom0')
  593. self.enforce(self.arg in self.app.pools.keys())
  594. pool = self.app.pools[self.arg]
  595. try:
  596. untrusted_value = int(untrusted_payload.decode('ascii'))
  597. except (UnicodeDecodeError, ValueError):
  598. raise qubes.api.ProtocolError('Invalid value')
  599. del untrusted_payload
  600. self.enforce(untrusted_value >= 0)
  601. newvalue = untrusted_value
  602. del untrusted_value
  603. self.fire_event_for_permission(newvalue=newvalue)
  604. pool.revisions_to_keep = newvalue
  605. self.app.save()
  606. @qubes.api.method('admin.label.List', no_payload=True,
  607. scope='global', read=True)
  608. @asyncio.coroutine
  609. def label_list(self):
  610. self.enforce(self.dest.name == 'dom0')
  611. self.enforce(not self.arg)
  612. labels = self.fire_event_for_filter(self.app.labels.values())
  613. return ''.join('{}\n'.format(label.name) for label in labels)
  614. @qubes.api.method('admin.label.Get', no_payload=True,
  615. scope='global', read=True)
  616. @asyncio.coroutine
  617. def label_get(self):
  618. self.enforce(self.dest.name == 'dom0')
  619. try:
  620. label = self.app.get_label(self.arg)
  621. except KeyError:
  622. raise qubes.exc.QubesValueError
  623. self.fire_event_for_permission(label=label)
  624. return label.color
  625. @qubes.api.method('admin.label.Index', no_payload=True,
  626. scope='global', read=True)
  627. @asyncio.coroutine
  628. def label_index(self):
  629. self.enforce(self.dest.name == 'dom0')
  630. try:
  631. label = self.app.get_label(self.arg)
  632. except KeyError:
  633. raise qubes.exc.QubesValueError
  634. self.fire_event_for_permission(label=label)
  635. return str(label.index)
  636. @qubes.api.method('admin.label.Create',
  637. scope='global', write=True)
  638. @asyncio.coroutine
  639. def label_create(self, untrusted_payload):
  640. self.enforce(self.dest.name == 'dom0')
  641. # don't confuse label name with label index
  642. self.enforce(not self.arg.isdigit())
  643. allowed_chars = string.ascii_letters + string.digits + '-_.'
  644. self.enforce(all(c in allowed_chars for c in self.arg))
  645. try:
  646. self.app.get_label(self.arg)
  647. except KeyError:
  648. # ok, no such label yet
  649. pass
  650. else:
  651. raise qubes.exc.QubesValueError('label already exists')
  652. untrusted_payload = untrusted_payload.decode('ascii').strip()
  653. self.enforce(len(untrusted_payload) == 8)
  654. self.enforce(untrusted_payload.startswith('0x'))
  655. # besides prefix, only hex digits are allowed
  656. self.enforce(all(x in string.hexdigits for x in untrusted_payload[2:]))
  657. # SEE: #2732
  658. color = untrusted_payload
  659. self.fire_event_for_permission(color=color)
  660. # allocate new index, but make sure it's outside of default labels set
  661. new_index = max(
  662. qubes.config.max_default_label, *self.app.labels.keys()) + 1
  663. label = qubes.Label(new_index, color, self.arg)
  664. self.app.labels[new_index] = label
  665. self.app.save()
  666. @qubes.api.method('admin.label.Remove', no_payload=True,
  667. scope='global', write=True)
  668. @asyncio.coroutine
  669. def label_remove(self):
  670. self.enforce(self.dest.name == 'dom0')
  671. try:
  672. label = self.app.get_label(self.arg)
  673. except KeyError:
  674. raise qubes.exc.QubesValueError
  675. # don't allow removing default labels
  676. self.enforce(label.index > qubes.config.max_default_label)
  677. # FIXME: this should be in app.add_label()
  678. for vm in self.app.domains:
  679. if vm.label == label:
  680. raise qubes.exc.QubesException('label still in use')
  681. self.fire_event_for_permission(label=label)
  682. del self.app.labels[label.index]
  683. self.app.save()
  684. @qubes.api.method('admin.vm.Start', no_payload=True,
  685. scope='local', execute=True)
  686. @asyncio.coroutine
  687. def vm_start(self):
  688. self.enforce(not self.arg)
  689. self.fire_event_for_permission()
  690. try:
  691. yield from self.dest.start()
  692. except libvirt.libvirtError as e:
  693. # change to QubesException, so will be reported to the user
  694. raise qubes.exc.QubesException('Start failed: ' + str(e) +
  695. ', see /var/log/libvirt/libxl/libxl-driver.log for details')
  696. @qubes.api.method('admin.vm.Shutdown', no_payload=True,
  697. scope='local', execute=True)
  698. @asyncio.coroutine
  699. def vm_shutdown(self):
  700. force = (self.arg == 'force')
  701. self.fire_event_for_permission(force=force)
  702. yield from self.dest.shutdown(force=force)
  703. @qubes.api.method('admin.vm.Pause', no_payload=True,
  704. scope='local', execute=True)
  705. @asyncio.coroutine
  706. def vm_pause(self):
  707. self.enforce(not self.arg)
  708. self.fire_event_for_permission()
  709. yield from self.dest.pause()
  710. @qubes.api.method('admin.vm.Unpause', no_payload=True,
  711. scope='local', execute=True)
  712. @asyncio.coroutine
  713. def vm_unpause(self):
  714. self.enforce(not self.arg)
  715. self.fire_event_for_permission()
  716. yield from self.dest.unpause()
  717. @qubes.api.method('admin.vm.Kill', no_payload=True,
  718. scope='local', execute=True)
  719. @asyncio.coroutine
  720. def vm_kill(self):
  721. self.enforce(not self.arg)
  722. self.fire_event_for_permission()
  723. yield from self.dest.kill()
  724. @qubes.api.method('admin.Events', no_payload=True,
  725. scope='global', read=True)
  726. @asyncio.coroutine
  727. def events(self):
  728. self.enforce(not self.arg)
  729. # run until client connection is terminated
  730. self.cancellable = True
  731. wait_for_cancel = asyncio.get_event_loop().create_future()
  732. # cache event filters, to not call an event each time an event arrives
  733. event_filters = self.fire_event_for_permission()
  734. dispatcher = QubesMgmtEventsDispatcher(event_filters, self.send_event)
  735. if self.dest.name == 'dom0':
  736. self.app.add_handler('*', dispatcher.app_handler)
  737. self.app.add_handler('domain-add', dispatcher.on_domain_add)
  738. self.app.add_handler('domain-delete', dispatcher.on_domain_delete)
  739. for vm in self.app.domains:
  740. vm.add_handler('*', dispatcher.vm_handler)
  741. else:
  742. self.dest.add_handler('*', dispatcher.vm_handler)
  743. # send artificial event as a confirmation that connection is established
  744. self.send_event(self.app, 'connection-established')
  745. try:
  746. yield from wait_for_cancel
  747. except asyncio.CancelledError:
  748. # the above waiting was already interrupted, this is all we need
  749. pass
  750. if self.dest.name == 'dom0':
  751. self.app.remove_handler('*', dispatcher.app_handler)
  752. self.app.remove_handler('domain-add', dispatcher.on_domain_add)
  753. self.app.remove_handler('domain-delete',
  754. dispatcher.on_domain_delete)
  755. for vm in self.app.domains:
  756. vm.remove_handler('*', dispatcher.vm_handler)
  757. else:
  758. self.dest.remove_handler('*', dispatcher.vm_handler)
  759. @qubes.api.method('admin.vm.feature.List', no_payload=True,
  760. scope='local', read=True)
  761. @asyncio.coroutine
  762. def vm_feature_list(self):
  763. self.enforce(not self.arg)
  764. features = self.fire_event_for_filter(self.dest.features.keys())
  765. return ''.join('{}\n'.format(feature) for feature in features)
  766. @qubes.api.method('admin.vm.feature.Get', no_payload=True,
  767. scope='local', read=True)
  768. @asyncio.coroutine
  769. def vm_feature_get(self):
  770. # validation of self.arg done by qrexec-policy is enough
  771. self.fire_event_for_permission()
  772. try:
  773. value = self.dest.features[self.arg]
  774. except KeyError:
  775. raise qubes.exc.QubesFeatureNotFoundError(self.dest, self.arg)
  776. return value
  777. @qubes.api.method('admin.vm.feature.CheckWithTemplate', no_payload=True,
  778. scope='local', read=True)
  779. @asyncio.coroutine
  780. def vm_feature_checkwithtemplate(self):
  781. # validation of self.arg done by qrexec-policy is enough
  782. self.fire_event_for_permission()
  783. try:
  784. value = self.dest.features.check_with_template(self.arg)
  785. except KeyError:
  786. raise qubes.exc.QubesFeatureNotFoundError(self.dest, self.arg)
  787. return value
  788. @qubes.api.method('admin.vm.feature.CheckWithNetvm', no_payload=True,
  789. scope='local', read=True)
  790. @asyncio.coroutine
  791. def vm_feature_checkwithnetvm(self):
  792. # validation of self.arg done by qrexec-policy is enough
  793. self.fire_event_for_permission()
  794. try:
  795. value = self.dest.features.check_with_netvm(self.arg)
  796. except KeyError:
  797. raise qubes.exc.QubesFeatureNotFoundError(self.dest, self.arg)
  798. return value
  799. @qubes.api.method('admin.vm.feature.CheckWithAdminVM', no_payload=True,
  800. scope='local', read=True)
  801. @asyncio.coroutine
  802. def vm_feature_checkwithadminvm(self):
  803. # validation of self.arg done by qrexec-policy is enough
  804. self.fire_event_for_permission()
  805. try:
  806. value = self.dest.features.check_with_adminvm(self.arg)
  807. except KeyError:
  808. raise qubes.exc.QubesFeatureNotFoundError(self.dest, self.arg)
  809. return value
  810. @qubes.api.method('admin.vm.feature.CheckWithTemplateAndAdminVM',
  811. no_payload=True, scope='local', read=True)
  812. @asyncio.coroutine
  813. def vm_feature_checkwithtpladminvm(self):
  814. # validation of self.arg done by qrexec-policy is enough
  815. self.fire_event_for_permission()
  816. try:
  817. value = self.dest.features.check_with_template_and_adminvm(self.arg)
  818. except KeyError:
  819. raise qubes.exc.QubesFeatureNotFoundError(self.dest, self.arg)
  820. return value
  821. @qubes.api.method('admin.vm.feature.Remove', no_payload=True,
  822. scope='local', write=True)
  823. @asyncio.coroutine
  824. def vm_feature_remove(self):
  825. # validation of self.arg done by qrexec-policy is enough
  826. self.fire_event_for_permission()
  827. try:
  828. del self.dest.features[self.arg]
  829. except KeyError:
  830. raise qubes.exc.QubesFeatureNotFoundError(self.dest, self.arg)
  831. self.app.save()
  832. @qubes.api.method('admin.vm.feature.Set',
  833. scope='local', write=True)
  834. @asyncio.coroutine
  835. def vm_feature_set(self, untrusted_payload):
  836. # validation of self.arg done by qrexec-policy is enough
  837. value = untrusted_payload.decode('ascii', errors='strict')
  838. del untrusted_payload
  839. self.fire_event_for_permission(value=value)
  840. self.dest.features[self.arg] = value
  841. self.app.save()
  842. @qubes.api.method('admin.vm.Create.{endpoint}', endpoints=(ep.name
  843. for ep in pkg_resources.iter_entry_points(qubes.vm.VM_ENTRY_POINT)),
  844. scope='global', write=True)
  845. @asyncio.coroutine
  846. def vm_create(self, endpoint, untrusted_payload=None):
  847. return self._vm_create(endpoint, allow_pool=False,
  848. untrusted_payload=untrusted_payload)
  849. @qubes.api.method('admin.vm.CreateInPool.{endpoint}', endpoints=(ep.name
  850. for ep in pkg_resources.iter_entry_points(qubes.vm.VM_ENTRY_POINT)),
  851. scope='global', write=True)
  852. @asyncio.coroutine
  853. def vm_create_in_pool(self, endpoint, untrusted_payload=None):
  854. return self._vm_create(endpoint, allow_pool=True,
  855. untrusted_payload=untrusted_payload)
  856. def _vm_create(self, vm_type, allow_pool=False, untrusted_payload=None):
  857. self.enforce(self.dest.name == 'dom0')
  858. kwargs = {}
  859. pool = None
  860. pools = {}
  861. # this will raise exception if none is found
  862. vm_class = qubes.utils.get_entry_point_one(qubes.vm.VM_ENTRY_POINT,
  863. vm_type)
  864. # if argument is given, it needs to be a valid template, and only
  865. # when given VM class do need a template
  866. if self.arg:
  867. if hasattr(vm_class, 'template'):
  868. if self.arg not in self.app.domains:
  869. raise qubes.api.PermissionDenied(
  870. 'Template {} does not exist'.format(self.arg))
  871. kwargs['template'] = self.app.domains[self.arg]
  872. else:
  873. raise qubes.exc.QubesValueError(
  874. '{} cannot be based on template'.format(vm_type))
  875. for untrusted_param in untrusted_payload.decode('ascii',
  876. errors='strict').split(' '):
  877. untrusted_key, untrusted_value = untrusted_param.split('=', 1)
  878. if untrusted_key in kwargs:
  879. raise qubes.api.ProtocolError('duplicated parameters')
  880. if untrusted_key == 'name':
  881. qubes.vm.validate_name(None, None, untrusted_value)
  882. kwargs['name'] = untrusted_value
  883. elif untrusted_key == 'label':
  884. # don't confuse label name with label index
  885. self.enforce(not untrusted_value.isdigit())
  886. allowed_chars = string.ascii_letters + string.digits + '-_.'
  887. self.enforce(all(c in allowed_chars for c in untrusted_value))
  888. try:
  889. kwargs['label'] = self.app.get_label(untrusted_value)
  890. except KeyError:
  891. raise qubes.exc.QubesValueError
  892. elif untrusted_key == 'pool' and allow_pool:
  893. if pool is not None:
  894. raise qubes.api.ProtocolError('duplicated pool parameter')
  895. pool = self.app.get_pool(untrusted_value)
  896. elif untrusted_key.startswith('pool:') and allow_pool:
  897. untrusted_volume = untrusted_key.split(':', 1)[1]
  898. # kind of ugly, but actual list of volumes is available only
  899. # after creating a VM
  900. self.enforce(untrusted_volume in [
  901. 'root', 'private', 'volatile', 'kernel'])
  902. volume = untrusted_volume
  903. if volume in pools:
  904. raise qubes.api.ProtocolError(
  905. 'duplicated pool:{} parameter'.format(volume))
  906. pools[volume] = self.app.get_pool(untrusted_value)
  907. else:
  908. raise qubes.api.ProtocolError('Invalid param name')
  909. del untrusted_payload
  910. if 'name' not in kwargs or 'label' not in kwargs:
  911. raise qubes.api.ProtocolError('Missing name or label')
  912. if pool and pools:
  913. raise qubes.api.ProtocolError(
  914. 'Only one of \'pool=\' and \'pool:volume=\' can be used')
  915. if kwargs['name'] in self.app.domains:
  916. raise qubes.exc.QubesValueError(
  917. 'VM {} already exists'.format(kwargs['name']))
  918. self.fire_event_for_permission(pool=pool, pools=pools, **kwargs)
  919. vm = self.app.add_new_vm(vm_class, **kwargs)
  920. # TODO: move this to extension (in race-free fashion)
  921. vm.tags.add('created-by-' + str(self.src))
  922. try:
  923. yield from vm.create_on_disk(pool=pool, pools=pools)
  924. except:
  925. del self.app.domains[vm]
  926. raise
  927. self.app.save()
  928. @qubes.api.method('admin.vm.CreateDisposable', no_payload=True,
  929. scope='global', write=True)
  930. @asyncio.coroutine
  931. def create_disposable(self):
  932. self.enforce(not self.arg)
  933. if self.dest.name == 'dom0':
  934. dispvm_template = self.src.default_dispvm
  935. else:
  936. dispvm_template = self.dest
  937. self.fire_event_for_permission(dispvm_template=dispvm_template)
  938. dispvm = yield from qubes.vm.dispvm.DispVM.from_appvm(dispvm_template)
  939. # TODO: move this to extension (in race-free fashion, better than here)
  940. dispvm.tags.add('disp-created-by-' + str(self.src))
  941. return dispvm.name
  942. @qubes.api.method('admin.vm.Remove', no_payload=True,
  943. scope='global', write=True)
  944. @asyncio.coroutine
  945. def vm_remove(self):
  946. self.enforce(not self.arg)
  947. self.fire_event_for_permission()
  948. with (yield from self.dest.startup_lock):
  949. if not self.dest.is_halted():
  950. raise qubes.exc.QubesVMNotHaltedError(self.dest)
  951. if self.dest.installed_by_rpm:
  952. raise qubes.exc.QubesVMInUseError(self.dest,
  953. "VM installed by package manager: " + self.dest.name)
  954. del self.app.domains[self.dest]
  955. try:
  956. yield from self.dest.remove_from_disk()
  957. except: # pylint: disable=bare-except
  958. self.app.log.exception('Error while removing VM \'%s\' files',
  959. self.dest.name)
  960. self.app.save()
  961. @qubes.api.method('admin.deviceclass.List', no_payload=True,
  962. scope='global', read=True)
  963. @asyncio.coroutine
  964. def deviceclass_list(self):
  965. """List all DEVICES classes"""
  966. self.enforce(not self.arg)
  967. self.enforce(self.dest.name == 'dom0')
  968. entrypoints = self.fire_event_for_filter(
  969. pkg_resources.iter_entry_points('qubes.devices'))
  970. return ''.join('{}\n'.format(ep.name) for ep in entrypoints)
  971. @qubes.api.method('admin.vm.device.{endpoint}.Available', endpoints=(ep.name
  972. for ep in pkg_resources.iter_entry_points('qubes.devices')),
  973. no_payload=True,
  974. scope='local', read=True)
  975. @asyncio.coroutine
  976. def vm_device_available(self, endpoint):
  977. devclass = endpoint
  978. devices = self.dest.devices[devclass].available()
  979. if self.arg:
  980. devices = [dev for dev in devices if dev.ident == self.arg]
  981. # no duplicated devices, but device may not exists, in which case
  982. # the list is empty
  983. self.enforce(len(devices) <= 1)
  984. devices = self.fire_event_for_filter(devices, devclass=devclass)
  985. dev_info = {}
  986. for dev in devices:
  987. non_default_attrs = set(attr for attr in dir(dev) if
  988. not attr.startswith('_')).difference((
  989. 'backend_domain', 'ident', 'frontend_domain',
  990. 'description', 'options', 'regex'))
  991. properties_txt = ' '.join(
  992. '{}={!s}'.format(prop, value) for prop, value
  993. in itertools.chain(
  994. ((key, getattr(dev, key)) for key in non_default_attrs),
  995. # keep description as the last one, according to API
  996. # specification
  997. (('description', dev.description),)
  998. ))
  999. self.enforce('\n' not in properties_txt)
  1000. dev_info[dev.ident] = properties_txt
  1001. return ''.join('{} {}\n'.format(ident, dev_info[ident])
  1002. for ident in sorted(dev_info))
  1003. @qubes.api.method('admin.vm.device.{endpoint}.List', endpoints=(ep.name
  1004. for ep in pkg_resources.iter_entry_points('qubes.devices')),
  1005. no_payload=True,
  1006. scope='local', read=True)
  1007. @asyncio.coroutine
  1008. def vm_device_list(self, endpoint):
  1009. devclass = endpoint
  1010. device_assignments = self.dest.devices[devclass].assignments()
  1011. if self.arg:
  1012. select_backend, select_ident = self.arg.split('+', 1)
  1013. device_assignments = [dev for dev in device_assignments
  1014. if (str(dev.backend_domain), dev.ident)
  1015. == (select_backend, select_ident)]
  1016. # no duplicated devices, but device may not exists, in which case
  1017. # the list is empty
  1018. self.enforce(len(device_assignments) <= 1)
  1019. device_assignments = self.fire_event_for_filter(device_assignments,
  1020. devclass=devclass)
  1021. dev_info = {}
  1022. for dev in device_assignments:
  1023. properties_txt = ' '.join(
  1024. '{}={!s}'.format(opt, value) for opt, value
  1025. in itertools.chain(
  1026. dev.options.items(),
  1027. (('persistent', 'yes' if dev.persistent else 'no'),)
  1028. ))
  1029. self.enforce('\n' not in properties_txt)
  1030. ident = '{!s}+{!s}'.format(dev.backend_domain, dev.ident)
  1031. dev_info[ident] = properties_txt
  1032. return ''.join('{} {}\n'.format(ident, dev_info[ident])
  1033. for ident in sorted(dev_info))
  1034. # Attach/Detach action can both modify persistent state (with
  1035. # persistent=True) and volatile state of running VM (with persistent=False).
  1036. # For this reason, write=True + execute=True
  1037. @qubes.api.method('admin.vm.device.{endpoint}.Attach', endpoints=(ep.name
  1038. for ep in pkg_resources.iter_entry_points('qubes.devices')),
  1039. scope='local', write=True, execute=True)
  1040. @asyncio.coroutine
  1041. def vm_device_attach(self, endpoint, untrusted_payload):
  1042. devclass = endpoint
  1043. options = {}
  1044. persistent = False
  1045. for untrusted_option in untrusted_payload.decode('ascii').split():
  1046. try:
  1047. untrusted_key, untrusted_value = untrusted_option.split('=', 1)
  1048. except ValueError:
  1049. raise qubes.api.ProtocolError('Invalid options format')
  1050. if untrusted_key == 'persistent':
  1051. persistent = qubes.property.bool(None, None, untrusted_value)
  1052. else:
  1053. allowed_chars_key = string.digits + string.ascii_letters + '-_.'
  1054. allowed_chars_value = allowed_chars_key + ',+:'
  1055. if any(x not in allowed_chars_key for x in untrusted_key):
  1056. raise qubes.api.ProtocolError(
  1057. 'Invalid chars in option name')
  1058. if any(x not in allowed_chars_value for x in untrusted_value):
  1059. raise qubes.api.ProtocolError(
  1060. 'Invalid chars in option value')
  1061. options[untrusted_key] = untrusted_value
  1062. # qrexec already verified that no strange characters are in self.arg
  1063. backend_domain, ident = self.arg.split('+', 1)
  1064. # may raise KeyError, either on domain or ident
  1065. dev = self.app.domains[backend_domain].devices[devclass][ident]
  1066. self.fire_event_for_permission(device=dev,
  1067. devclass=devclass, persistent=persistent,
  1068. options=options)
  1069. assignment = qubes.devices.DeviceAssignment(
  1070. dev.backend_domain, dev.ident,
  1071. options=options, persistent=persistent)
  1072. yield from self.dest.devices[devclass].attach(assignment)
  1073. self.app.save()
  1074. # Attach/Detach action can both modify persistent state (with
  1075. # persistent=True) and volatile state of running VM (with persistent=False).
  1076. # For this reason, write=True + execute=True
  1077. @qubes.api.method('admin.vm.device.{endpoint}.Detach', endpoints=(ep.name
  1078. for ep in pkg_resources.iter_entry_points('qubes.devices')),
  1079. no_payload=True,
  1080. scope='local', write=True, execute=True)
  1081. @asyncio.coroutine
  1082. def vm_device_detach(self, endpoint):
  1083. devclass = endpoint
  1084. # qrexec already verified that no strange characters are in self.arg
  1085. backend_domain, ident = self.arg.split('+', 1)
  1086. # may raise KeyError; if device isn't found, it will be UnknownDevice
  1087. # instance - but allow it, otherwise it will be impossible to detach
  1088. # already removed device
  1089. dev = self.app.domains[backend_domain].devices[devclass][ident]
  1090. self.fire_event_for_permission(device=dev,
  1091. devclass=devclass)
  1092. assignment = qubes.devices.DeviceAssignment(
  1093. dev.backend_domain, dev.ident)
  1094. yield from self.dest.devices[devclass].detach(assignment)
  1095. self.app.save()
  1096. # Attach/Detach action can both modify persistent state (with
  1097. # persistent=True) and volatile state of running VM (with persistent=False).
  1098. # For this reason, write=True + execute=True
  1099. @qubes.api.method('admin.vm.device.{endpoint}.Set.persistent',
  1100. endpoints=(ep.name
  1101. for ep in pkg_resources.iter_entry_points('qubes.devices')),
  1102. scope='local', write=True, execute=True)
  1103. @asyncio.coroutine
  1104. def vm_device_set_persistent(self, endpoint, untrusted_payload):
  1105. devclass = endpoint
  1106. self.enforce(untrusted_payload in (b'True', b'False'))
  1107. persistent = untrusted_payload == b'True'
  1108. del untrusted_payload
  1109. # qrexec already verified that no strange characters are in self.arg
  1110. backend_domain, ident = self.arg.split('+', 1)
  1111. # device must be already attached
  1112. matching_devices = [dev for dev
  1113. in self.dest.devices[devclass].attached()
  1114. if dev.backend_domain.name == backend_domain and dev.ident == ident]
  1115. self.enforce(len(matching_devices) == 1)
  1116. dev = matching_devices[0]
  1117. self.fire_event_for_permission(device=dev,
  1118. persistent=persistent)
  1119. self.dest.devices[devclass].update_persistent(dev, persistent)
  1120. self.app.save()
  1121. @qubes.api.method('admin.vm.firewall.Get', no_payload=True,
  1122. scope='local', read=True)
  1123. @asyncio.coroutine
  1124. def vm_firewall_get(self):
  1125. self.enforce(not self.arg)
  1126. self.fire_event_for_permission()
  1127. return ''.join('{}\n'.format(rule.api_rule)
  1128. for rule in self.dest.firewall.rules
  1129. if rule.api_rule is not None)
  1130. @qubes.api.method('admin.vm.firewall.Set',
  1131. scope='local', write=True)
  1132. @asyncio.coroutine
  1133. def vm_firewall_set(self, untrusted_payload):
  1134. self.enforce(not self.arg)
  1135. rules = []
  1136. for untrusted_line in untrusted_payload.decode('ascii',
  1137. errors='strict').splitlines():
  1138. rule = qubes.firewall.Rule.from_api_string(
  1139. untrusted_rule=untrusted_line)
  1140. rules.append(rule)
  1141. self.fire_event_for_permission(rules=rules)
  1142. self.dest.firewall.rules = rules
  1143. self.dest.firewall.save()
  1144. @qubes.api.method('admin.vm.firewall.Reload', no_payload=True,
  1145. scope='local', execute=True)
  1146. @asyncio.coroutine
  1147. def vm_firewall_reload(self):
  1148. self.enforce(not self.arg)
  1149. self.fire_event_for_permission()
  1150. self.dest.fire_event('firewall-changed')
  1151. @asyncio.coroutine
  1152. def _load_backup_profile(self, profile_name, skip_passphrase=False):
  1153. """Load backup profile and return :py:class:`qubes.backup.Backup`
  1154. instance
  1155. :param profile_name: name of the profile
  1156. :param skip_passphrase: do not load passphrase - only backup summary
  1157. can be retrieved when this option is in use
  1158. """
  1159. profile_path = os.path.join(
  1160. qubes.config.backup_profile_dir, profile_name + '.conf')
  1161. with open(profile_path) as profile_file:
  1162. profile_data = yaml.safe_load(profile_file)
  1163. try:
  1164. dest_vm = profile_data['destination_vm']
  1165. dest_path = profile_data['destination_path']
  1166. include_vms = profile_data['include']
  1167. if include_vms is not None:
  1168. # convert old keywords to new keywords
  1169. include_vms = [vm.replace('$', '@') for vm in include_vms]
  1170. exclude_vms = profile_data.get('exclude', [])
  1171. # convert old keywords to new keywords
  1172. exclude_vms = [vm.replace('$', '@') for vm in exclude_vms]
  1173. compression = profile_data.get('compression', True)
  1174. except KeyError as err:
  1175. raise qubes.exc.QubesException(
  1176. 'Invalid backup profile - missing {}'.format(err))
  1177. try:
  1178. dest_vm = self.app.domains[dest_vm]
  1179. except KeyError:
  1180. raise qubes.exc.QubesException(
  1181. 'Invalid destination_vm specified in backup profile')
  1182. if isinstance(dest_vm, qubes.vm.adminvm.AdminVM):
  1183. dest_vm = None
  1184. if skip_passphrase:
  1185. passphrase = None
  1186. elif 'passphrase_text' in profile_data:
  1187. passphrase = profile_data['passphrase_text']
  1188. elif 'passphrase_vm' in profile_data:
  1189. passphrase_vm_name = profile_data['passphrase_vm']
  1190. try:
  1191. passphrase_vm = self.app.domains[passphrase_vm_name]
  1192. except KeyError:
  1193. raise qubes.exc.QubesException(
  1194. 'Invalid backup profile - invalid passphrase_vm')
  1195. try:
  1196. passphrase, _ = yield from passphrase_vm.run_service_for_stdio(
  1197. 'qubes.BackupPassphrase+' + self.arg)
  1198. # make it foolproof against "echo passphrase" implementation
  1199. passphrase = passphrase.strip()
  1200. self.enforce(b'\n' not in passphrase)
  1201. except subprocess.CalledProcessError:
  1202. raise qubes.exc.QubesException(
  1203. 'Failed to retrieve passphrase from \'{}\' VM'.format(
  1204. passphrase_vm_name))
  1205. else:
  1206. raise qubes.exc.QubesException(
  1207. 'Invalid backup profile - you need to '
  1208. 'specify passphrase_text or passphrase_vm')
  1209. # handle include
  1210. if include_vms is None:
  1211. vms_to_backup = None
  1212. else:
  1213. vms_to_backup = set(vm for vm in self.app.domains
  1214. if any(qubes.utils.match_vm_name_with_special(vm, name)
  1215. for name in include_vms))
  1216. # handle exclude
  1217. vms_to_exclude = set(vm.name for vm in self.app.domains
  1218. if any(qubes.utils.match_vm_name_with_special(vm, name)
  1219. for name in exclude_vms))
  1220. kwargs = {
  1221. 'target_vm': dest_vm,
  1222. 'target_dir': dest_path,
  1223. 'compressed': bool(compression),
  1224. 'passphrase': passphrase,
  1225. }
  1226. if isinstance(compression, str):
  1227. kwargs['compression_filter'] = compression
  1228. backup = qubes.backup.Backup(self.app, vms_to_backup, vms_to_exclude,
  1229. **kwargs)
  1230. return backup
  1231. def _backup_progress_callback(self, profile_name, progress):
  1232. self.app.fire_event('backup-progress', backup_profile=profile_name,
  1233. progress=progress)
  1234. @qubes.api.method('admin.backup.Execute', no_payload=True,
  1235. scope='global', read=True, execute=True)
  1236. @asyncio.coroutine
  1237. def backup_execute(self):
  1238. self.enforce(self.dest.name == 'dom0')
  1239. self.enforce(self.arg)
  1240. self.enforce('/' not in self.arg)
  1241. self.fire_event_for_permission()
  1242. profile_path = os.path.join(qubes.config.backup_profile_dir,
  1243. self.arg + '.conf')
  1244. if not os.path.exists(profile_path):
  1245. raise qubes.api.PermissionDenied(
  1246. 'Backup profile {} does not exist'.format(self.arg))
  1247. if not hasattr(self.app, 'api_admin_running_backups'):
  1248. self.app.api_admin_running_backups = {}
  1249. backup = yield from self._load_backup_profile(self.arg)
  1250. backup.progress_callback = functools.partial(
  1251. self._backup_progress_callback, self.arg)
  1252. # forbid running the same backup operation twice at the time
  1253. if self.arg in self.app.api_admin_running_backups:
  1254. raise qubes.exc.BackupAlreadyRunningError()
  1255. backup_task = asyncio.ensure_future(backup.backup_do())
  1256. self.app.api_admin_running_backups[self.arg] = backup_task
  1257. try:
  1258. yield from backup_task
  1259. except asyncio.CancelledError:
  1260. raise qubes.exc.QubesException('Backup cancelled')
  1261. finally:
  1262. del self.app.api_admin_running_backups[self.arg]
  1263. @qubes.api.method('admin.backup.Cancel', no_payload=True,
  1264. scope='global', execute=True)
  1265. @asyncio.coroutine
  1266. def backup_cancel(self):
  1267. self.enforce(self.dest.name == 'dom0')
  1268. self.enforce(self.arg)
  1269. self.enforce('/' not in self.arg)
  1270. self.fire_event_for_permission()
  1271. if not hasattr(self.app, 'api_admin_running_backups'):
  1272. self.app.api_admin_running_backups = {}
  1273. if self.arg not in self.app.api_admin_running_backups:
  1274. raise qubes.exc.QubesException('Backup operation not running')
  1275. self.app.api_admin_running_backups[self.arg].cancel()
  1276. @qubes.api.method('admin.backup.Info', no_payload=True,
  1277. scope='local', read=True)
  1278. @asyncio.coroutine
  1279. def backup_info(self):
  1280. self.enforce(self.dest.name == 'dom0')
  1281. self.enforce(self.arg)
  1282. self.enforce('/' not in self.arg)
  1283. self.fire_event_for_permission()
  1284. profile_path = os.path.join(qubes.config.backup_profile_dir,
  1285. self.arg + '.conf')
  1286. if not os.path.exists(profile_path):
  1287. raise qubes.api.PermissionDenied(
  1288. 'Backup profile {} does not exist'.format(self.arg))
  1289. backup = yield from self._load_backup_profile(self.arg,
  1290. skip_passphrase=True)
  1291. return backup.get_backup_summary()
  1292. def _send_stats_single(self, info_time, info, only_vm, filters,
  1293. id_to_name_map):
  1294. """A single iteration of sending VM stats
  1295. :param info_time: time of previous iteration
  1296. :param info: information retrieved in previous iteration
  1297. :param only_vm: send information only about this VM
  1298. :param filters: filters to apply on stats before sending
  1299. :param id_to_name_map: ID->VM name map, may be modified
  1300. :return: tuple(info_time, info) - new information (to be passed to
  1301. the next iteration)
  1302. """
  1303. (info_time, info) = self.app.host.get_vm_stats(info_time, info,
  1304. only_vm=only_vm)
  1305. for vm_id, vm_info in info.items():
  1306. if vm_id not in id_to_name_map:
  1307. try:
  1308. name = \
  1309. self.app.vmm.libvirt_conn.lookupByID(vm_id).name()
  1310. except libvirt.libvirtError as err:
  1311. if err.get_error_code() == libvirt.VIR_ERR_NO_DOMAIN:
  1312. # stubdomain or so
  1313. name = None
  1314. else:
  1315. raise
  1316. id_to_name_map[vm_id] = name
  1317. else:
  1318. name = id_to_name_map[vm_id]
  1319. # skip VMs with unknown name
  1320. if name is None:
  1321. continue
  1322. if not list(qubes.api.apply_filters([name], filters)):
  1323. continue
  1324. self.send_event(name, 'vm-stats',
  1325. memory_kb=int(vm_info['memory_kb']),
  1326. cpu_time=int(vm_info['cpu_time'] / 1000000),
  1327. cpu_usage=int(vm_info['cpu_usage']),
  1328. cpu_usage_raw=int(vm_info['cpu_usage_raw']))
  1329. return info_time, info
  1330. @qubes.api.method('admin.vm.Stats', no_payload=True,
  1331. scope='global', read=True)
  1332. @asyncio.coroutine
  1333. def vm_stats(self):
  1334. self.enforce(not self.arg)
  1335. # run until client connection is terminated
  1336. self.cancellable = True
  1337. # cache event filters, to not call an event each time an event arrives
  1338. stats_filters = self.fire_event_for_permission()
  1339. only_vm = None
  1340. if self.dest.name != 'dom0':
  1341. only_vm = self.dest
  1342. self.send_event(self.app, 'connection-established')
  1343. info_time = None
  1344. info = None
  1345. id_to_name_map = {0: 'dom0'}
  1346. try:
  1347. while True:
  1348. info_time, info = self._send_stats_single(info_time, info,
  1349. only_vm, stats_filters, id_to_name_map)
  1350. yield from asyncio.sleep(self.app.stats_interval)
  1351. except asyncio.CancelledError:
  1352. # valid method to terminate this loop
  1353. pass
  1354. @qubes.api.method('admin.vm.CurrentState', no_payload=True,
  1355. scope='local', read=True)
  1356. @asyncio.coroutine
  1357. def vm_current_state(self):
  1358. self.enforce(not self.arg)
  1359. self.fire_event_for_permission()
  1360. state = {
  1361. 'mem': self.dest.get_mem(),
  1362. 'mem_static_max': self.dest.get_mem_static_max(),
  1363. 'cputime': self.dest.get_cputime(),
  1364. 'power_state': self.dest.get_power_state(),
  1365. }
  1366. return ' '.join('{}={}'.format(k, v) for k, v in state.items())