admin.py 55 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554
  1. #
  2. # The Qubes OS Project, https://www.qubes-os.org/
  3. #
  4. # Copyright (C) 2017 Wojtek Porczyk <woju@invisiblethingslab.com>
  5. #
  6. # This library is free software; you can redistribute it and/or
  7. # modify it under the terms of the GNU Lesser General Public
  8. # License as published by the Free Software Foundation; either
  9. # version 2.1 of the License, or (at your option) any later version.
  10. #
  11. # This library is distributed in the hope that it will be useful,
  12. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  13. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14. # Lesser General Public License for more details.
  15. #
  16. # You should have received a copy of the GNU Lesser General Public
  17. # License along with this library; if not, see <https://www.gnu.org/licenses/>.
  18. #
  19. '''
  20. Qubes OS Management API
  21. '''
  22. import asyncio
  23. import functools
  24. import itertools
  25. import os
  26. import string
  27. import subprocess
  28. import libvirt
  29. import pkg_resources
  30. import yaml
  31. import qubes.api
  32. import qubes.backup
  33. import qubes.config
  34. import qubes.devices
  35. import qubes.firewall
  36. import qubes.storage
  37. import qubes.utils
  38. import qubes.vm
  39. import qubes.vm.adminvm
  40. import qubes.vm.qubesvm
  41. class QubesMgmtEventsDispatcher:
  42. def __init__(self, filters, send_event):
  43. self.filters = filters
  44. self.send_event = send_event
  45. def vm_handler(self, subject, event, **kwargs):
  46. # do not send internal events
  47. if event.startswith('admin-permission:'):
  48. return
  49. if event.startswith('device-get:'):
  50. return
  51. if event.startswith('device-list:'):
  52. return
  53. if event.startswith('device-list-attached:'):
  54. return
  55. if event in ('domain-is-fully-usable',):
  56. return
  57. if not list(qubes.api.apply_filters([(subject, event, kwargs)],
  58. self.filters)):
  59. return
  60. self.send_event(subject, event, **kwargs)
  61. def app_handler(self, subject, event, **kwargs):
  62. if not list(qubes.api.apply_filters([(subject, event, kwargs)],
  63. self.filters)):
  64. return
  65. self.send_event(subject, event, **kwargs)
  66. def on_domain_add(self, subject, event, vm):
  67. # pylint: disable=unused-argument
  68. vm.add_handler('*', self.vm_handler)
  69. def on_domain_delete(self, subject, event, vm):
  70. # pylint: disable=unused-argument
  71. vm.remove_handler('*', self.vm_handler)
  72. class QubesAdminAPI(qubes.api.AbstractQubesAPI):
  73. '''Implementation of Qubes Management API calls
  74. This class contains all the methods available in the main API.
  75. .. seealso::
  76. https://www.qubes-os.org/doc/mgmt1/
  77. '''
  78. SOCKNAME = '/var/run/qubesd.sock'
  79. @qubes.api.method('admin.vmclass.List', no_payload=True,
  80. scope='global', read=True)
  81. @asyncio.coroutine
  82. def vmclass_list(self):
  83. '''List all VM classes'''
  84. assert not self.arg
  85. assert self.dest.name == 'dom0'
  86. entrypoints = self.fire_event_for_filter(
  87. pkg_resources.iter_entry_points(qubes.vm.VM_ENTRY_POINT))
  88. return ''.join('{}\n'.format(ep.name)
  89. for ep in entrypoints)
  90. @qubes.api.method('admin.vm.List', no_payload=True,
  91. scope='global', read=True)
  92. @asyncio.coroutine
  93. def vm_list(self):
  94. '''List all the domains'''
  95. assert not self.arg
  96. if self.dest.name == 'dom0':
  97. domains = self.fire_event_for_filter(self.app.domains)
  98. else:
  99. domains = self.fire_event_for_filter([self.dest])
  100. return ''.join('{} class={} state={}\n'.format(
  101. vm.name,
  102. vm.__class__.__name__,
  103. vm.get_power_state())
  104. for vm in sorted(domains))
  105. @qubes.api.method('admin.vm.property.List', no_payload=True,
  106. scope='local', read=True)
  107. @asyncio.coroutine
  108. def vm_property_list(self):
  109. '''List all properties on a qube'''
  110. return self._property_list(self.dest)
  111. @qubes.api.method('admin.property.List', no_payload=True,
  112. scope='global', read=True)
  113. @asyncio.coroutine
  114. def property_list(self):
  115. '''List all global properties'''
  116. assert self.dest.name == 'dom0'
  117. return self._property_list(self.app)
  118. def _property_list(self, dest):
  119. assert not self.arg
  120. properties = self.fire_event_for_filter(dest.property_list())
  121. return ''.join('{}\n'.format(prop.__name__) for prop in properties)
  122. @qubes.api.method('admin.vm.property.Get', no_payload=True,
  123. scope='local', read=True)
  124. @asyncio.coroutine
  125. def vm_property_get(self):
  126. '''Get a value of one property'''
  127. return self._property_get(self.dest)
  128. @qubes.api.method('admin.property.Get', no_payload=True,
  129. scope='global', read=True)
  130. @asyncio.coroutine
  131. def property_get(self):
  132. '''Get a value of one global property'''
  133. assert self.dest.name == 'dom0'
  134. return self._property_get(self.app)
  135. def _property_get(self, dest):
  136. if self.arg not in dest.property_list():
  137. raise qubes.exc.QubesNoSuchPropertyError(dest, self.arg)
  138. self.fire_event_for_permission()
  139. property_def = dest.property_get_def(self.arg)
  140. # explicit list to be sure that it matches protocol spec
  141. if isinstance(property_def, qubes.vm.VMProperty):
  142. property_type = 'vm'
  143. elif property_def.type is int:
  144. property_type = 'int'
  145. elif property_def.type is bool:
  146. property_type = 'bool'
  147. elif self.arg == 'label':
  148. property_type = 'label'
  149. else:
  150. property_type = 'str'
  151. try:
  152. value = getattr(dest, self.arg)
  153. except AttributeError:
  154. return 'default=True type={} '.format(property_type)
  155. else:
  156. return 'default={} type={} {}'.format(
  157. str(dest.property_is_default(self.arg)),
  158. property_type,
  159. str(value) if value is not None else '')
  160. @qubes.api.method('admin.vm.property.GetDefault', no_payload=True,
  161. scope='local', read=True)
  162. @asyncio.coroutine
  163. def vm_property_get_default(self):
  164. '''Get a value of one property'''
  165. return self._property_get_default(self.dest)
  166. @qubes.api.method('admin.property.GetDefault', no_payload=True,
  167. scope='global', read=True)
  168. @asyncio.coroutine
  169. def property_get_default(self):
  170. '''Get a value of one global property'''
  171. assert self.dest.name == 'dom0'
  172. return self._property_get_default(self.app)
  173. def _property_get_default(self, dest):
  174. if self.arg not in dest.property_list():
  175. raise qubes.exc.QubesNoSuchPropertyError(dest, self.arg)
  176. self.fire_event_for_permission()
  177. property_def = dest.property_get_def(self.arg)
  178. # explicit list to be sure that it matches protocol spec
  179. if isinstance(property_def, qubes.vm.VMProperty):
  180. property_type = 'vm'
  181. elif property_def.type is int:
  182. property_type = 'int'
  183. elif property_def.type is bool:
  184. property_type = 'bool'
  185. elif self.arg == 'label':
  186. property_type = 'label'
  187. else:
  188. property_type = 'str'
  189. try:
  190. value = property_def.get_default(dest)
  191. except AttributeError:
  192. return None
  193. else:
  194. return 'type={} {}'.format(
  195. property_type,
  196. str(value) if value is not None else '')
  197. @qubes.api.method('admin.vm.property.Set',
  198. scope='local', write=True)
  199. @asyncio.coroutine
  200. def vm_property_set(self, untrusted_payload):
  201. '''Set property value'''
  202. return self._property_set(self.dest,
  203. untrusted_payload=untrusted_payload)
  204. @qubes.api.method('admin.property.Set',
  205. scope='global', write=True)
  206. @asyncio.coroutine
  207. def property_set(self, untrusted_payload):
  208. '''Set property value'''
  209. assert self.dest.name == 'dom0'
  210. return self._property_set(self.app,
  211. untrusted_payload=untrusted_payload)
  212. def _property_set(self, dest, untrusted_payload):
  213. if self.arg not in dest.property_list():
  214. raise qubes.exc.QubesNoSuchPropertyError(dest, self.arg)
  215. property_def = dest.property_get_def(self.arg)
  216. newvalue = property_def.sanitize(untrusted_newvalue=untrusted_payload)
  217. self.fire_event_for_permission(newvalue=newvalue)
  218. setattr(dest, self.arg, newvalue)
  219. self.app.save()
  220. @qubes.api.method('admin.vm.property.Help', no_payload=True,
  221. scope='local', read=True)
  222. @asyncio.coroutine
  223. def vm_property_help(self):
  224. '''Get help for one property'''
  225. return self._property_help(self.dest)
  226. @qubes.api.method('admin.property.Help', no_payload=True,
  227. scope='global', read=True)
  228. @asyncio.coroutine
  229. def property_help(self):
  230. '''Get help for one property'''
  231. assert self.dest.name == 'dom0'
  232. return self._property_help(self.app)
  233. def _property_help(self, dest):
  234. if self.arg not in dest.property_list():
  235. raise qubes.exc.QubesNoSuchPropertyError(dest, self.arg)
  236. self.fire_event_for_permission()
  237. try:
  238. doc = dest.property_get_def(self.arg).__doc__
  239. except AttributeError:
  240. return ''
  241. return qubes.utils.format_doc(doc)
  242. @qubes.api.method('admin.vm.property.Reset', no_payload=True,
  243. scope='local', write=True)
  244. @asyncio.coroutine
  245. def vm_property_reset(self):
  246. '''Reset a property to a default value'''
  247. return self._property_reset(self.dest)
  248. @qubes.api.method('admin.property.Reset', no_payload=True,
  249. scope='global', write=True)
  250. @asyncio.coroutine
  251. def property_reset(self):
  252. '''Reset a property to a default value'''
  253. assert self.dest.name == 'dom0'
  254. return self._property_reset(self.app)
  255. def _property_reset(self, dest):
  256. if self.arg not in dest.property_list():
  257. raise qubes.exc.QubesNoSuchPropertyError(dest, self.arg)
  258. self.fire_event_for_permission()
  259. delattr(dest, self.arg)
  260. self.app.save()
  261. @qubes.api.method('admin.vm.volume.List', no_payload=True,
  262. scope='local', read=True)
  263. @asyncio.coroutine
  264. def vm_volume_list(self):
  265. assert not self.arg
  266. volume_names = self.fire_event_for_filter(self.dest.volumes.keys())
  267. return ''.join('{}\n'.format(name) for name in volume_names)
  268. @qubes.api.method('admin.vm.volume.Info', no_payload=True,
  269. scope='local', read=True)
  270. @asyncio.coroutine
  271. def vm_volume_info(self):
  272. assert self.arg in self.dest.volumes.keys()
  273. self.fire_event_for_permission()
  274. volume = self.dest.volumes[self.arg]
  275. # properties defined in API
  276. volume_properties = [
  277. 'pool', 'vid', 'size', 'usage', 'rw', 'source', 'path',
  278. 'save_on_stop', 'snap_on_start', 'revisions_to_keep']
  279. def _serialize(value):
  280. if callable(value):
  281. value = value()
  282. if value is None:
  283. value = ''
  284. return str(value)
  285. info = ''.join('{}={}\n'.format(key, _serialize(getattr(volume, key)))
  286. for key in volume_properties)
  287. try:
  288. info += 'is_outdated={}\n'.format(volume.is_outdated())
  289. except NotImplementedError:
  290. pass
  291. return info
  292. @qubes.api.method('admin.vm.volume.ListSnapshots', no_payload=True,
  293. scope='local', read=True)
  294. @asyncio.coroutine
  295. def vm_volume_listsnapshots(self):
  296. assert self.arg in self.dest.volumes.keys()
  297. volume = self.dest.volumes[self.arg]
  298. id_to_timestamp = volume.revisions
  299. revisions = sorted(id_to_timestamp, key=id_to_timestamp.__getitem__)
  300. revisions = self.fire_event_for_filter(revisions)
  301. return ''.join('{}\n'.format(revision) for revision in revisions)
  302. @qubes.api.method('admin.vm.volume.Revert',
  303. scope='local', write=True)
  304. @asyncio.coroutine
  305. def vm_volume_revert(self, untrusted_payload):
  306. assert self.arg in self.dest.volumes.keys()
  307. untrusted_revision = untrusted_payload.decode('ascii').strip()
  308. del untrusted_payload
  309. volume = self.dest.volumes[self.arg]
  310. snapshots = volume.revisions
  311. assert untrusted_revision in snapshots
  312. revision = untrusted_revision
  313. self.fire_event_for_permission(volume=volume, revision=revision)
  314. ret = volume.revert(revision)
  315. if asyncio.iscoroutine(ret):
  316. yield from ret
  317. self.app.save()
  318. # write=True because this allow to clone VM - and most likely modify that
  319. # one - still having the same data
  320. @qubes.api.method('admin.vm.volume.CloneFrom', no_payload=True,
  321. scope='local', write=True)
  322. @asyncio.coroutine
  323. def vm_volume_clone_from(self):
  324. assert self.arg in self.dest.volumes.keys()
  325. volume = self.dest.volumes[self.arg]
  326. self.fire_event_for_permission(volume=volume)
  327. token = qubes.utils.random_string(32)
  328. # save token on self.app, as self is not persistent
  329. if not hasattr(self.app, 'api_admin_pending_clone'):
  330. self.app.api_admin_pending_clone = {}
  331. # don't handle collisions any better - if someone is so much out of
  332. # luck, can try again anyway
  333. assert token not in self.app.api_admin_pending_clone
  334. self.app.api_admin_pending_clone[token] = volume
  335. return token
  336. @qubes.api.method('admin.vm.volume.CloneTo',
  337. scope='local', write=True)
  338. @asyncio.coroutine
  339. def vm_volume_clone_to(self, untrusted_payload):
  340. assert self.arg in self.dest.volumes.keys()
  341. untrusted_token = untrusted_payload.decode('ascii').strip()
  342. del untrusted_payload
  343. assert untrusted_token in getattr(self.app,
  344. 'api_admin_pending_clone', {})
  345. token = untrusted_token
  346. del untrusted_token
  347. src_volume = self.app.api_admin_pending_clone[token]
  348. del self.app.api_admin_pending_clone[token]
  349. # make sure the volume still exists, but invalidate token anyway
  350. assert str(src_volume.pool) in self.app.pools
  351. assert src_volume in self.app.pools[str(src_volume.pool)].volumes
  352. dst_volume = self.dest.volumes[self.arg]
  353. self.fire_event_for_permission(src_volume=src_volume,
  354. dst_volume=dst_volume)
  355. op_retval = dst_volume.import_volume(src_volume)
  356. # clone/import functions may be either synchronous or asynchronous
  357. # in the later case, we need to wait for them to finish
  358. if asyncio.iscoroutine(op_retval):
  359. op_retval = yield from op_retval
  360. self.dest.volumes[self.arg] = op_retval
  361. self.app.save()
  362. @qubes.api.method('admin.vm.volume.Resize',
  363. scope='local', write=True)
  364. @asyncio.coroutine
  365. def vm_volume_resize(self, untrusted_payload):
  366. assert self.arg in self.dest.volumes.keys()
  367. untrusted_size = untrusted_payload.decode('ascii').strip()
  368. del untrusted_payload
  369. assert untrusted_size.isdigit() # only digits, forbid '-' too
  370. assert len(untrusted_size) <= 20 # limit to about 2^64
  371. size = int(untrusted_size)
  372. self.fire_event_for_permission(size=size)
  373. yield from self.dest.storage.resize(self.arg, size)
  374. self.app.save()
  375. @qubes.api.method('admin.vm.volume.Import', no_payload=True,
  376. scope='local', write=True)
  377. @asyncio.coroutine
  378. def vm_volume_import(self):
  379. '''Import volume data.
  380. Note that this function only returns a path to where data should be
  381. written, actual importing is done by a script in /etc/qubes-rpc
  382. When the script finish importing, it will trigger
  383. internal.vm.volume.ImportEnd (with either b'ok' or b'fail' as a
  384. payload) and response from that call will be actually send to the
  385. caller.
  386. '''
  387. assert self.arg in self.dest.volumes.keys()
  388. self.fire_event_for_permission()
  389. if not self.dest.is_halted():
  390. raise qubes.exc.QubesVMNotHaltedError(self.dest)
  391. path = self.dest.storage.import_data(self.arg)
  392. assert ' ' not in path
  393. size = self.dest.volumes[self.arg].size
  394. # when we know the action is allowed, inform extensions that it will
  395. # be performed
  396. self.dest.fire_event('domain-volume-import-begin', volume=self.arg)
  397. return '{} {}'.format(size, path)
  398. @qubes.api.method('admin.vm.volume.Set.revisions_to_keep',
  399. scope='local', write=True)
  400. @asyncio.coroutine
  401. def vm_volume_set_revisions_to_keep(self, untrusted_payload):
  402. assert self.arg in self.dest.volumes.keys()
  403. try:
  404. untrusted_value = int(untrusted_payload.decode('ascii'))
  405. except (UnicodeDecodeError, ValueError):
  406. raise qubes.api.ProtocolError('Invalid value')
  407. del untrusted_payload
  408. assert untrusted_value >= 0
  409. newvalue = untrusted_value
  410. del untrusted_value
  411. self.fire_event_for_permission(newvalue=newvalue)
  412. self.dest.volumes[self.arg].revisions_to_keep = newvalue
  413. self.app.save()
  414. @qubes.api.method('admin.vm.volume.Set.rw',
  415. scope='local', write=True)
  416. @asyncio.coroutine
  417. def vm_volume_set_rw(self, untrusted_payload):
  418. assert self.arg in self.dest.volumes.keys()
  419. try:
  420. newvalue = qubes.property.bool(None, None,
  421. untrusted_payload.decode('ascii'))
  422. except (UnicodeDecodeError, ValueError):
  423. raise qubes.api.ProtocolError('Invalid value')
  424. del untrusted_payload
  425. self.fire_event_for_permission(newvalue=newvalue)
  426. if not self.dest.is_halted():
  427. raise qubes.exc.QubesVMNotHaltedError(self.dest)
  428. self.dest.volumes[self.arg].rw = newvalue
  429. self.app.save()
  430. @qubes.api.method('admin.vm.tag.List', no_payload=True,
  431. scope='local', read=True)
  432. @asyncio.coroutine
  433. def vm_tag_list(self):
  434. assert not self.arg
  435. tags = self.dest.tags
  436. tags = self.fire_event_for_filter(tags)
  437. return ''.join('{}\n'.format(tag) for tag in sorted(tags))
  438. @qubes.api.method('admin.vm.tag.Get', no_payload=True,
  439. scope='local', read=True)
  440. @asyncio.coroutine
  441. def vm_tag_get(self):
  442. qubes.vm.Tags.validate_tag(self.arg)
  443. self.fire_event_for_permission()
  444. return '1' if self.arg in self.dest.tags else '0'
  445. @qubes.api.method('admin.vm.tag.Set', no_payload=True,
  446. scope='local', write=True)
  447. @asyncio.coroutine
  448. def vm_tag_set(self):
  449. qubes.vm.Tags.validate_tag(self.arg)
  450. self.fire_event_for_permission()
  451. self.dest.tags.add(self.arg)
  452. self.app.save()
  453. @qubes.api.method('admin.vm.tag.Remove', no_payload=True,
  454. scope='local', write=True)
  455. @asyncio.coroutine
  456. def vm_tag_remove(self):
  457. qubes.vm.Tags.validate_tag(self.arg)
  458. self.fire_event_for_permission()
  459. try:
  460. self.dest.tags.remove(self.arg)
  461. except KeyError:
  462. raise qubes.exc.QubesTagNotFoundError(self.dest, self.arg)
  463. self.app.save()
  464. @qubes.api.method('admin.pool.List', no_payload=True,
  465. scope='global', read=True)
  466. @asyncio.coroutine
  467. def pool_list(self):
  468. assert not self.arg
  469. assert self.dest.name == 'dom0'
  470. pools = self.fire_event_for_filter(self.app.pools)
  471. return ''.join('{}\n'.format(pool) for pool in pools)
  472. @qubes.api.method('admin.pool.ListDrivers', no_payload=True,
  473. scope='global', read=True)
  474. @asyncio.coroutine
  475. def pool_listdrivers(self):
  476. assert self.dest.name == 'dom0'
  477. assert not self.arg
  478. drivers = self.fire_event_for_filter(qubes.storage.pool_drivers())
  479. return ''.join('{} {}\n'.format(
  480. driver,
  481. ' '.join(qubes.storage.driver_parameters(driver)))
  482. for driver in drivers)
  483. @qubes.api.method('admin.pool.Info', no_payload=True,
  484. scope='global', read=True)
  485. @asyncio.coroutine
  486. def pool_info(self):
  487. assert self.dest.name == 'dom0'
  488. assert self.arg in self.app.pools.keys()
  489. pool = self.app.pools[self.arg]
  490. self.fire_event_for_permission(pool=pool)
  491. other_info = ''
  492. pool_size = pool.size
  493. if pool_size is not None:
  494. other_info += 'size={}\n'.format(pool_size)
  495. pool_usage = pool.usage
  496. if pool_usage is not None:
  497. other_info += 'usage={}\n'.format(pool_usage)
  498. try:
  499. included_in = pool.included_in(self.app)
  500. if included_in:
  501. other_info += 'included_in={}\n'.format(str(included_in))
  502. except NotImplementedError:
  503. pass
  504. return ''.join('{}={}\n'.format(prop, val)
  505. for prop, val in sorted(pool.config.items())) + \
  506. other_info
  507. @qubes.api.method('admin.pool.Add',
  508. scope='global', write=True)
  509. @asyncio.coroutine
  510. def pool_add(self, untrusted_payload):
  511. assert self.dest.name == 'dom0'
  512. drivers = qubes.storage.pool_drivers()
  513. assert self.arg in drivers
  514. untrusted_pool_config = untrusted_payload.decode('ascii').splitlines()
  515. del untrusted_payload
  516. assert all(('=' in line) for line in untrusted_pool_config)
  517. # pairs of (option, value)
  518. untrusted_pool_config = [line.split('=', 1)
  519. for line in untrusted_pool_config]
  520. # reject duplicated options
  521. assert len(set(x[0] for x in untrusted_pool_config)) == \
  522. len([x[0] for x in untrusted_pool_config])
  523. # and convert to dict
  524. untrusted_pool_config = dict(untrusted_pool_config)
  525. assert 'name' in untrusted_pool_config
  526. untrusted_pool_name = untrusted_pool_config.pop('name')
  527. allowed_chars = string.ascii_letters + string.digits + '-_.'
  528. assert all(c in allowed_chars for c in untrusted_pool_name)
  529. pool_name = untrusted_pool_name
  530. assert pool_name not in self.app.pools
  531. driver_parameters = qubes.storage.driver_parameters(self.arg)
  532. assert all(key in driver_parameters for key in untrusted_pool_config)
  533. pool_config = untrusted_pool_config
  534. self.fire_event_for_permission(name=pool_name,
  535. pool_config=pool_config)
  536. self.app.add_pool(name=pool_name, driver=self.arg, **pool_config)
  537. self.app.save()
  538. @qubes.api.method('admin.pool.Remove', no_payload=True,
  539. scope='global', write=True)
  540. @asyncio.coroutine
  541. def pool_remove(self):
  542. assert self.dest.name == 'dom0'
  543. assert self.arg in self.app.pools.keys()
  544. self.fire_event_for_permission()
  545. self.app.remove_pool(self.arg)
  546. self.app.save()
  547. @qubes.api.method('admin.pool.Set.revisions_to_keep',
  548. scope='global', write=True)
  549. @asyncio.coroutine
  550. def pool_set_revisions_to_keep(self, untrusted_payload):
  551. assert self.dest.name == 'dom0'
  552. assert self.arg in self.app.pools.keys()
  553. pool = self.app.pools[self.arg]
  554. try:
  555. untrusted_value = int(untrusted_payload.decode('ascii'))
  556. except (UnicodeDecodeError, ValueError):
  557. raise qubes.api.ProtocolError('Invalid value')
  558. del untrusted_payload
  559. assert untrusted_value >= 0
  560. newvalue = untrusted_value
  561. del untrusted_value
  562. self.fire_event_for_permission(newvalue=newvalue)
  563. pool.revisions_to_keep = newvalue
  564. self.app.save()
  565. @qubes.api.method('admin.label.List', no_payload=True,
  566. scope='global', read=True)
  567. @asyncio.coroutine
  568. def label_list(self):
  569. assert self.dest.name == 'dom0'
  570. assert not self.arg
  571. labels = self.fire_event_for_filter(self.app.labels.values())
  572. return ''.join('{}\n'.format(label.name) for label in labels)
  573. @qubes.api.method('admin.label.Get', no_payload=True,
  574. scope='global', read=True)
  575. @asyncio.coroutine
  576. def label_get(self):
  577. assert self.dest.name == 'dom0'
  578. try:
  579. label = self.app.get_label(self.arg)
  580. except KeyError:
  581. raise qubes.exc.QubesValueError
  582. self.fire_event_for_permission(label=label)
  583. return label.color
  584. @qubes.api.method('admin.label.Index', no_payload=True,
  585. scope='global', read=True)
  586. @asyncio.coroutine
  587. def label_index(self):
  588. assert self.dest.name == 'dom0'
  589. try:
  590. label = self.app.get_label(self.arg)
  591. except KeyError:
  592. raise qubes.exc.QubesValueError
  593. self.fire_event_for_permission(label=label)
  594. return str(label.index)
  595. @qubes.api.method('admin.label.Create',
  596. scope='global', write=True)
  597. @asyncio.coroutine
  598. def label_create(self, untrusted_payload):
  599. assert self.dest.name == 'dom0'
  600. # don't confuse label name with label index
  601. assert not self.arg.isdigit()
  602. allowed_chars = string.ascii_letters + string.digits + '-_.'
  603. assert all(c in allowed_chars for c in self.arg)
  604. try:
  605. self.app.get_label(self.arg)
  606. except KeyError:
  607. # ok, no such label yet
  608. pass
  609. else:
  610. raise qubes.exc.QubesValueError('label already exists')
  611. untrusted_payload = untrusted_payload.decode('ascii').strip()
  612. assert len(untrusted_payload) == 8
  613. assert untrusted_payload.startswith('0x')
  614. # besides prefix, only hex digits are allowed
  615. assert all(x in string.hexdigits for x in untrusted_payload[2:])
  616. # SEE: #2732
  617. color = untrusted_payload
  618. self.fire_event_for_permission(color=color)
  619. # allocate new index, but make sure it's outside of default labels set
  620. new_index = max(
  621. qubes.config.max_default_label, *self.app.labels.keys()) + 1
  622. label = qubes.Label(new_index, color, self.arg)
  623. self.app.labels[new_index] = label
  624. self.app.save()
  625. @qubes.api.method('admin.label.Remove', no_payload=True,
  626. scope='global', write=True)
  627. @asyncio.coroutine
  628. def label_remove(self):
  629. assert self.dest.name == 'dom0'
  630. try:
  631. label = self.app.get_label(self.arg)
  632. except KeyError:
  633. raise qubes.exc.QubesValueError
  634. # don't allow removing default labels
  635. assert label.index > qubes.config.max_default_label
  636. # FIXME: this should be in app.add_label()
  637. for vm in self.app.domains:
  638. if vm.label == label:
  639. raise qubes.exc.QubesException('label still in use')
  640. self.fire_event_for_permission(label=label)
  641. del self.app.labels[label.index]
  642. self.app.save()
  643. @qubes.api.method('admin.vm.Start', no_payload=True,
  644. scope='local', execute=True)
  645. @asyncio.coroutine
  646. def vm_start(self):
  647. assert not self.arg
  648. self.fire_event_for_permission()
  649. try:
  650. yield from self.dest.start()
  651. except libvirt.libvirtError as e:
  652. # change to QubesException, so will be reported to the user
  653. raise qubes.exc.QubesException('Start failed: ' + str(e) +
  654. ', see /var/log/libvirt/libxl/libxl-driver.log for details')
  655. @qubes.api.method('admin.vm.Shutdown', no_payload=True,
  656. scope='local', execute=True)
  657. @asyncio.coroutine
  658. def vm_shutdown(self):
  659. assert not self.arg
  660. self.fire_event_for_permission()
  661. yield from self.dest.shutdown()
  662. @qubes.api.method('admin.vm.Pause', no_payload=True,
  663. scope='local', execute=True)
  664. @asyncio.coroutine
  665. def vm_pause(self):
  666. assert not self.arg
  667. self.fire_event_for_permission()
  668. yield from self.dest.pause()
  669. @qubes.api.method('admin.vm.Unpause', no_payload=True,
  670. scope='local', execute=True)
  671. @asyncio.coroutine
  672. def vm_unpause(self):
  673. assert not self.arg
  674. self.fire_event_for_permission()
  675. yield from self.dest.unpause()
  676. @qubes.api.method('admin.vm.Kill', no_payload=True,
  677. scope='local', execute=True)
  678. @asyncio.coroutine
  679. def vm_kill(self):
  680. assert not self.arg
  681. self.fire_event_for_permission()
  682. yield from self.dest.kill()
  683. @qubes.api.method('admin.Events', no_payload=True,
  684. scope='global', read=True)
  685. @asyncio.coroutine
  686. def events(self):
  687. assert not self.arg
  688. # run until client connection is terminated
  689. self.cancellable = True
  690. wait_for_cancel = asyncio.get_event_loop().create_future()
  691. # cache event filters, to not call an event each time an event arrives
  692. event_filters = self.fire_event_for_permission()
  693. dispatcher = QubesMgmtEventsDispatcher(event_filters, self.send_event)
  694. if self.dest.name == 'dom0':
  695. self.app.add_handler('*', dispatcher.app_handler)
  696. self.app.add_handler('domain-add', dispatcher.on_domain_add)
  697. self.app.add_handler('domain-delete', dispatcher.on_domain_delete)
  698. for vm in self.app.domains:
  699. vm.add_handler('*', dispatcher.vm_handler)
  700. else:
  701. self.dest.add_handler('*', dispatcher.vm_handler)
  702. # send artificial event as a confirmation that connection is established
  703. self.send_event(self.app, 'connection-established')
  704. try:
  705. yield from wait_for_cancel
  706. except asyncio.CancelledError:
  707. # the above waiting was already interrupted, this is all we need
  708. pass
  709. if self.dest.name == 'dom0':
  710. self.app.remove_handler('*', dispatcher.app_handler)
  711. self.app.remove_handler('domain-add', dispatcher.on_domain_add)
  712. self.app.remove_handler('domain-delete',
  713. dispatcher.on_domain_delete)
  714. for vm in self.app.domains:
  715. vm.remove_handler('*', dispatcher.vm_handler)
  716. else:
  717. self.dest.remove_handler('*', dispatcher.vm_handler)
  718. @qubes.api.method('admin.vm.feature.List', no_payload=True,
  719. scope='local', read=True)
  720. @asyncio.coroutine
  721. def vm_feature_list(self):
  722. assert not self.arg
  723. features = self.fire_event_for_filter(self.dest.features.keys())
  724. return ''.join('{}\n'.format(feature) for feature in features)
  725. @qubes.api.method('admin.vm.feature.Get', no_payload=True,
  726. scope='local', read=True)
  727. @asyncio.coroutine
  728. def vm_feature_get(self):
  729. # validation of self.arg done by qrexec-policy is enough
  730. self.fire_event_for_permission()
  731. try:
  732. value = self.dest.features[self.arg]
  733. except KeyError:
  734. raise qubes.exc.QubesFeatureNotFoundError(self.dest, self.arg)
  735. return value
  736. @qubes.api.method('admin.vm.feature.CheckWithTemplate', no_payload=True,
  737. scope='local', read=True)
  738. @asyncio.coroutine
  739. def vm_feature_checkwithtemplate(self):
  740. # validation of self.arg done by qrexec-policy is enough
  741. self.fire_event_for_permission()
  742. try:
  743. value = self.dest.features.check_with_template(self.arg)
  744. except KeyError:
  745. raise qubes.exc.QubesFeatureNotFoundError(self.dest, self.arg)
  746. return value
  747. @qubes.api.method('admin.vm.feature.CheckWithNetvm', no_payload=True,
  748. scope='local', read=True)
  749. @asyncio.coroutine
  750. def vm_feature_checkwithnetvm(self):
  751. # validation of self.arg done by qrexec-policy is enough
  752. self.fire_event_for_permission()
  753. try:
  754. value = self.dest.features.check_with_netvm(self.arg)
  755. except KeyError:
  756. raise qubes.exc.QubesFeatureNotFoundError(self.dest, self.arg)
  757. return value
  758. @qubes.api.method('admin.vm.feature.Remove', no_payload=True,
  759. scope='local', write=True)
  760. @asyncio.coroutine
  761. def vm_feature_remove(self):
  762. # validation of self.arg done by qrexec-policy is enough
  763. self.fire_event_for_permission()
  764. try:
  765. del self.dest.features[self.arg]
  766. except KeyError:
  767. raise qubes.exc.QubesFeatureNotFoundError(self.dest, self.arg)
  768. self.app.save()
  769. @qubes.api.method('admin.vm.feature.Set',
  770. scope='local', write=True)
  771. @asyncio.coroutine
  772. def vm_feature_set(self, untrusted_payload):
  773. # validation of self.arg done by qrexec-policy is enough
  774. value = untrusted_payload.decode('ascii', errors='strict')
  775. del untrusted_payload
  776. self.fire_event_for_permission(value=value)
  777. self.dest.features[self.arg] = value
  778. self.app.save()
  779. @qubes.api.method('admin.vm.Create.{endpoint}', endpoints=(ep.name
  780. for ep in pkg_resources.iter_entry_points(qubes.vm.VM_ENTRY_POINT)),
  781. scope='global', write=True)
  782. @asyncio.coroutine
  783. def vm_create(self, endpoint, untrusted_payload=None):
  784. return self._vm_create(endpoint, allow_pool=False,
  785. untrusted_payload=untrusted_payload)
  786. @qubes.api.method('admin.vm.CreateInPool.{endpoint}', endpoints=(ep.name
  787. for ep in pkg_resources.iter_entry_points(qubes.vm.VM_ENTRY_POINT)),
  788. scope='global', write=True)
  789. @asyncio.coroutine
  790. def vm_create_in_pool(self, endpoint, untrusted_payload=None):
  791. return self._vm_create(endpoint, allow_pool=True,
  792. untrusted_payload=untrusted_payload)
  793. def _vm_create(self, vm_type, allow_pool=False, untrusted_payload=None):
  794. assert self.dest.name == 'dom0'
  795. kwargs = {}
  796. pool = None
  797. pools = {}
  798. # this will raise exception if none is found
  799. vm_class = qubes.utils.get_entry_point_one(qubes.vm.VM_ENTRY_POINT,
  800. vm_type)
  801. # if argument is given, it needs to be a valid template, and only
  802. # when given VM class do need a template
  803. if hasattr(vm_class, 'template'):
  804. if self.arg:
  805. assert self.arg in self.app.domains
  806. kwargs['template'] = self.app.domains[self.arg]
  807. else:
  808. assert not self.arg
  809. for untrusted_param in untrusted_payload.decode('ascii',
  810. errors='strict').split(' '):
  811. untrusted_key, untrusted_value = untrusted_param.split('=', 1)
  812. if untrusted_key in kwargs:
  813. raise qubes.api.ProtocolError('duplicated parameters')
  814. if untrusted_key == 'name':
  815. qubes.vm.validate_name(None, None, untrusted_value)
  816. kwargs['name'] = untrusted_value
  817. elif untrusted_key == 'label':
  818. # don't confuse label name with label index
  819. assert not untrusted_value.isdigit()
  820. allowed_chars = string.ascii_letters + string.digits + '-_.'
  821. assert all(c in allowed_chars for c in untrusted_value)
  822. try:
  823. kwargs['label'] = self.app.get_label(untrusted_value)
  824. except KeyError:
  825. raise qubes.exc.QubesValueError
  826. elif untrusted_key == 'pool' and allow_pool:
  827. if pool is not None:
  828. raise qubes.api.ProtocolError('duplicated pool parameter')
  829. pool = self.app.get_pool(untrusted_value)
  830. elif untrusted_key.startswith('pool:') and allow_pool:
  831. untrusted_volume = untrusted_key.split(':', 1)[1]
  832. # kind of ugly, but actual list of volumes is available only
  833. # after creating a VM
  834. assert untrusted_volume in ['root', 'private', 'volatile',
  835. 'kernel']
  836. volume = untrusted_volume
  837. if volume in pools:
  838. raise qubes.api.ProtocolError(
  839. 'duplicated pool:{} parameter'.format(volume))
  840. pools[volume] = self.app.get_pool(untrusted_value)
  841. else:
  842. raise qubes.api.ProtocolError('Invalid param name')
  843. del untrusted_payload
  844. if 'name' not in kwargs or 'label' not in kwargs:
  845. raise qubes.api.ProtocolError('Missing name or label')
  846. if pool and pools:
  847. raise qubes.api.ProtocolError(
  848. 'Only one of \'pool=\' and \'pool:volume=\' can be used')
  849. if kwargs['name'] in self.app.domains:
  850. raise qubes.exc.QubesValueError(
  851. 'VM {} already exists'.format(kwargs['name']))
  852. self.fire_event_for_permission(pool=pool, pools=pools, **kwargs)
  853. vm = self.app.add_new_vm(vm_class, **kwargs)
  854. # TODO: move this to extension (in race-free fashion)
  855. vm.tags.add('created-by-' + str(self.src))
  856. try:
  857. yield from vm.create_on_disk(pool=pool, pools=pools)
  858. except:
  859. del self.app.domains[vm]
  860. raise
  861. self.app.save()
  862. @qubes.api.method('admin.vm.CreateDisposable', no_payload=True,
  863. scope='global', write=True)
  864. @asyncio.coroutine
  865. def create_disposable(self):
  866. assert not self.arg
  867. if self.dest.name == 'dom0':
  868. dispvm_template = self.src.default_dispvm
  869. else:
  870. dispvm_template = self.dest
  871. self.fire_event_for_permission(dispvm_template=dispvm_template)
  872. dispvm = yield from qubes.vm.dispvm.DispVM.from_appvm(dispvm_template)
  873. # TODO: move this to extension (in race-free fashion, better than here)
  874. dispvm.tags.add('disp-created-by-' + str(self.src))
  875. return dispvm.name
  876. @qubes.api.method('admin.vm.Remove', no_payload=True,
  877. scope='global', write=True)
  878. @asyncio.coroutine
  879. def vm_remove(self):
  880. assert not self.arg
  881. self.fire_event_for_permission()
  882. if not self.dest.is_halted():
  883. raise qubes.exc.QubesVMNotHaltedError(self.dest)
  884. if self.dest.installed_by_rpm:
  885. raise qubes.exc.QubesVMInUseError(self.dest, \
  886. "VM installed by package manager: " + self.dest.name)
  887. del self.app.domains[self.dest]
  888. try:
  889. yield from self.dest.remove_from_disk()
  890. except: # pylint: disable=bare-except
  891. self.app.log.exception('Error while removing VM \'%s\' files',
  892. self.dest.name)
  893. self.app.save()
  894. @qubes.api.method('admin.vm.device.{endpoint}.Available', endpoints=(ep.name
  895. for ep in pkg_resources.iter_entry_points('qubes.devices')),
  896. no_payload=True,
  897. scope='local', read=True)
  898. @asyncio.coroutine
  899. def vm_device_available(self, endpoint):
  900. devclass = endpoint
  901. devices = self.dest.devices[devclass].available()
  902. if self.arg:
  903. devices = [dev for dev in devices if dev.ident == self.arg]
  904. # no duplicated devices, but device may not exists, in which case
  905. # the list is empty
  906. assert len(devices) <= 1
  907. devices = self.fire_event_for_filter(devices, devclass=devclass)
  908. dev_info = {}
  909. for dev in devices:
  910. non_default_attrs = set(attr for attr in dir(dev) if
  911. not attr.startswith('_')).difference((
  912. 'backend_domain', 'ident', 'frontend_domain',
  913. 'description', 'options', 'regex'))
  914. properties_txt = ' '.join(
  915. '{}={!s}'.format(prop, value) for prop, value
  916. in itertools.chain(
  917. ((key, getattr(dev, key)) for key in non_default_attrs),
  918. # keep description as the last one, according to API
  919. # specification
  920. (('description', dev.description),)
  921. ))
  922. assert '\n' not in properties_txt
  923. dev_info[dev.ident] = properties_txt
  924. return ''.join('{} {}\n'.format(ident, dev_info[ident])
  925. for ident in sorted(dev_info))
  926. @qubes.api.method('admin.vm.device.{endpoint}.List', endpoints=(ep.name
  927. for ep in pkg_resources.iter_entry_points('qubes.devices')),
  928. no_payload=True,
  929. scope='local', read=True)
  930. @asyncio.coroutine
  931. def vm_device_list(self, endpoint):
  932. devclass = endpoint
  933. device_assignments = self.dest.devices[devclass].assignments()
  934. if self.arg:
  935. select_backend, select_ident = self.arg.split('+', 1)
  936. device_assignments = [dev for dev in device_assignments
  937. if (str(dev.backend_domain), dev.ident)
  938. == (select_backend, select_ident)]
  939. # no duplicated devices, but device may not exists, in which case
  940. # the list is empty
  941. assert len(device_assignments) <= 1
  942. device_assignments = self.fire_event_for_filter(device_assignments,
  943. devclass=devclass)
  944. dev_info = {}
  945. for dev in device_assignments:
  946. properties_txt = ' '.join(
  947. '{}={!s}'.format(opt, value) for opt, value
  948. in itertools.chain(
  949. dev.options.items(),
  950. (('persistent', 'yes' if dev.persistent else 'no'),)
  951. ))
  952. assert '\n' not in properties_txt
  953. ident = '{!s}+{!s}'.format(dev.backend_domain, dev.ident)
  954. dev_info[ident] = properties_txt
  955. return ''.join('{} {}\n'.format(ident, dev_info[ident])
  956. for ident in sorted(dev_info))
  957. # Attach/Detach action can both modify persistent state (with
  958. # persistent=True) and volatile state of running VM (with persistent=False).
  959. # For this reason, write=True + execute=True
  960. @qubes.api.method('admin.vm.device.{endpoint}.Attach', endpoints=(ep.name
  961. for ep in pkg_resources.iter_entry_points('qubes.devices')),
  962. scope='local', write=True, execute=True)
  963. @asyncio.coroutine
  964. def vm_device_attach(self, endpoint, untrusted_payload):
  965. devclass = endpoint
  966. options = {}
  967. persistent = False
  968. for untrusted_option in untrusted_payload.decode('ascii').split():
  969. try:
  970. untrusted_key, untrusted_value = untrusted_option.split('=', 1)
  971. except ValueError:
  972. raise qubes.api.ProtocolError('Invalid options format')
  973. if untrusted_key == 'persistent':
  974. persistent = qubes.property.bool(None, None, untrusted_value)
  975. else:
  976. allowed_chars_key = string.digits + string.ascii_letters + '-_.'
  977. allowed_chars_value = allowed_chars_key + ',+:'
  978. if any(x not in allowed_chars_key for x in untrusted_key):
  979. raise qubes.api.ProtocolError(
  980. 'Invalid chars in option name')
  981. if any(x not in allowed_chars_value for x in untrusted_value):
  982. raise qubes.api.ProtocolError(
  983. 'Invalid chars in option value')
  984. options[untrusted_key] = untrusted_value
  985. # qrexec already verified that no strange characters are in self.arg
  986. backend_domain, ident = self.arg.split('+', 1)
  987. # may raise KeyError, either on domain or ident
  988. dev = self.app.domains[backend_domain].devices[devclass][ident]
  989. self.fire_event_for_permission(device=dev,
  990. devclass=devclass, persistent=persistent,
  991. options=options)
  992. assignment = qubes.devices.DeviceAssignment(
  993. dev.backend_domain, dev.ident,
  994. options=options, persistent=persistent)
  995. yield from self.dest.devices[devclass].attach(assignment)
  996. self.app.save()
  997. # Attach/Detach action can both modify persistent state (with
  998. # persistent=True) and volatile state of running VM (with persistent=False).
  999. # For this reason, write=True + execute=True
  1000. @qubes.api.method('admin.vm.device.{endpoint}.Detach', endpoints=(ep.name
  1001. for ep in pkg_resources.iter_entry_points('qubes.devices')),
  1002. no_payload=True,
  1003. scope='local', write=True, execute=True)
  1004. @asyncio.coroutine
  1005. def vm_device_detach(self, endpoint):
  1006. devclass = endpoint
  1007. # qrexec already verified that no strange characters are in self.arg
  1008. backend_domain, ident = self.arg.split('+', 1)
  1009. # may raise KeyError; if device isn't found, it will be UnknownDevice
  1010. # instance - but allow it, otherwise it will be impossible to detach
  1011. # already removed device
  1012. dev = self.app.domains[backend_domain].devices[devclass][ident]
  1013. self.fire_event_for_permission(device=dev,
  1014. devclass=devclass)
  1015. assignment = qubes.devices.DeviceAssignment(
  1016. dev.backend_domain, dev.ident)
  1017. yield from self.dest.devices[devclass].detach(assignment)
  1018. self.app.save()
  1019. # Attach/Detach action can both modify persistent state (with
  1020. # persistent=True) and volatile state of running VM (with persistent=False).
  1021. # For this reason, write=True + execute=True
  1022. @qubes.api.method('admin.vm.device.{endpoint}.Set.persistent',
  1023. endpoints=(ep.name
  1024. for ep in pkg_resources.iter_entry_points('qubes.devices')),
  1025. scope='local', write=True, execute=True)
  1026. @asyncio.coroutine
  1027. def vm_device_set_persistent(self, endpoint, untrusted_payload):
  1028. devclass = endpoint
  1029. assert untrusted_payload in (b'True', b'False')
  1030. persistent = untrusted_payload == b'True'
  1031. del untrusted_payload
  1032. # qrexec already verified that no strange characters are in self.arg
  1033. backend_domain, ident = self.arg.split('+', 1)
  1034. # device must be already attached
  1035. matching_devices = [dev for dev
  1036. in self.dest.devices[devclass].attached()
  1037. if dev.backend_domain.name == backend_domain and dev.ident == ident]
  1038. assert len(matching_devices) == 1
  1039. dev = matching_devices[0]
  1040. self.fire_event_for_permission(device=dev,
  1041. persistent=persistent)
  1042. self.dest.devices[devclass].update_persistent(dev, persistent)
  1043. self.app.save()
  1044. @qubes.api.method('admin.vm.firewall.Get', no_payload=True,
  1045. scope='local', read=True)
  1046. @asyncio.coroutine
  1047. def vm_firewall_get(self):
  1048. assert not self.arg
  1049. self.fire_event_for_permission()
  1050. return ''.join('{}\n'.format(rule.api_rule)
  1051. for rule in self.dest.firewall.rules
  1052. if rule.api_rule is not None)
  1053. @qubes.api.method('admin.vm.firewall.Set',
  1054. scope='local', write=True)
  1055. @asyncio.coroutine
  1056. def vm_firewall_set(self, untrusted_payload):
  1057. assert not self.arg
  1058. rules = []
  1059. for untrusted_line in untrusted_payload.decode('ascii',
  1060. errors='strict').splitlines():
  1061. rule = qubes.firewall.Rule.from_api_string(
  1062. untrusted_rule=untrusted_line)
  1063. rules.append(rule)
  1064. self.fire_event_for_permission(rules=rules)
  1065. self.dest.firewall.rules = rules
  1066. self.dest.firewall.save()
  1067. @qubes.api.method('admin.vm.firewall.Reload', no_payload=True,
  1068. scope='local', execute=True)
  1069. @asyncio.coroutine
  1070. def vm_firewall_reload(self):
  1071. assert not self.arg
  1072. self.fire_event_for_permission()
  1073. self.dest.fire_event('firewall-changed')
  1074. @asyncio.coroutine
  1075. def _load_backup_profile(self, profile_name, skip_passphrase=False):
  1076. '''Load backup profile and return :py:class:`qubes.backup.Backup`
  1077. instance
  1078. :param profile_name: name of the profile
  1079. :param skip_passphrase: do not load passphrase - only backup summary
  1080. can be retrieved when this option is in use
  1081. '''
  1082. profile_path = os.path.join(
  1083. qubes.config.backup_profile_dir, profile_name + '.conf')
  1084. with open(profile_path) as profile_file:
  1085. profile_data = yaml.safe_load(profile_file)
  1086. try:
  1087. dest_vm = profile_data['destination_vm']
  1088. dest_path = profile_data['destination_path']
  1089. include_vms = profile_data['include']
  1090. if include_vms is not None:
  1091. # convert old keywords to new keywords
  1092. include_vms = [vm.replace('$', '@') for vm in include_vms]
  1093. exclude_vms = profile_data.get('exclude', [])
  1094. # convert old keywords to new keywords
  1095. exclude_vms = [vm.replace('$', '@') for vm in exclude_vms]
  1096. compression = profile_data.get('compression', True)
  1097. except KeyError as err:
  1098. raise qubes.exc.QubesException(
  1099. 'Invalid backup profile - missing {}'.format(err))
  1100. try:
  1101. dest_vm = self.app.domains[dest_vm]
  1102. except KeyError:
  1103. raise qubes.exc.QubesException(
  1104. 'Invalid destination_vm specified in backup profile')
  1105. if isinstance(dest_vm, qubes.vm.adminvm.AdminVM):
  1106. dest_vm = None
  1107. if skip_passphrase:
  1108. passphrase = None
  1109. elif 'passphrase_text' in profile_data:
  1110. passphrase = profile_data['passphrase_text']
  1111. elif 'passphrase_vm' in profile_data:
  1112. passphrase_vm_name = profile_data['passphrase_vm']
  1113. try:
  1114. passphrase_vm = self.app.domains[passphrase_vm_name]
  1115. except KeyError:
  1116. raise qubes.exc.QubesException(
  1117. 'Invalid backup profile - invalid passphrase_vm')
  1118. try:
  1119. passphrase, _ = yield from passphrase_vm.run_service_for_stdio(
  1120. 'qubes.BackupPassphrase+' + self.arg)
  1121. # make it foolproof against "echo passphrase" implementation
  1122. passphrase = passphrase.strip()
  1123. assert b'\n' not in passphrase
  1124. except subprocess.CalledProcessError:
  1125. raise qubes.exc.QubesException(
  1126. 'Failed to retrieve passphrase from \'{}\' VM'.format(
  1127. passphrase_vm_name))
  1128. else:
  1129. raise qubes.exc.QubesException(
  1130. 'Invalid backup profile - you need to '
  1131. 'specify passphrase_text or passphrase_vm')
  1132. # handle include
  1133. if include_vms is None:
  1134. vms_to_backup = None
  1135. else:
  1136. vms_to_backup = set(vm for vm in self.app.domains
  1137. if any(qubes.utils.match_vm_name_with_special(vm, name)
  1138. for name in include_vms))
  1139. # handle exclude
  1140. vms_to_exclude = set(vm.name for vm in self.app.domains
  1141. if any(qubes.utils.match_vm_name_with_special(vm, name)
  1142. for name in exclude_vms))
  1143. kwargs = {
  1144. 'target_vm': dest_vm,
  1145. 'target_dir': dest_path,
  1146. 'compressed': bool(compression),
  1147. 'passphrase': passphrase,
  1148. }
  1149. if isinstance(compression, str):
  1150. kwargs['compression_filter'] = compression
  1151. backup = qubes.backup.Backup(self.app, vms_to_backup, vms_to_exclude,
  1152. **kwargs)
  1153. return backup
  1154. def _backup_progress_callback(self, profile_name, progress):
  1155. self.app.fire_event('backup-progress', backup_profile=profile_name,
  1156. progress=progress)
  1157. @qubes.api.method('admin.backup.Execute', no_payload=True,
  1158. scope='global', read=True, execute=True)
  1159. @asyncio.coroutine
  1160. def backup_execute(self):
  1161. assert self.dest.name == 'dom0'
  1162. assert self.arg
  1163. assert '/' not in self.arg
  1164. self.fire_event_for_permission()
  1165. profile_path = os.path.join(qubes.config.backup_profile_dir,
  1166. self.arg + '.conf')
  1167. if not os.path.exists(profile_path):
  1168. raise qubes.api.PermissionDenied(
  1169. 'Backup profile {} does not exist'.format(self.arg))
  1170. if not hasattr(self.app, 'api_admin_running_backups'):
  1171. self.app.api_admin_running_backups = {}
  1172. backup = yield from self._load_backup_profile(self.arg)
  1173. backup.progress_callback = functools.partial(
  1174. self._backup_progress_callback, self.arg)
  1175. # forbid running the same backup operation twice at the time
  1176. assert self.arg not in self.app.api_admin_running_backups
  1177. backup_task = asyncio.ensure_future(backup.backup_do())
  1178. self.app.api_admin_running_backups[self.arg] = backup_task
  1179. try:
  1180. yield from backup_task
  1181. except asyncio.CancelledError:
  1182. raise qubes.exc.QubesException('Backup cancelled')
  1183. finally:
  1184. del self.app.api_admin_running_backups[self.arg]
  1185. @qubes.api.method('admin.backup.Cancel', no_payload=True,
  1186. scope='global', execute=True)
  1187. @asyncio.coroutine
  1188. def backup_cancel(self):
  1189. assert self.dest.name == 'dom0'
  1190. assert self.arg
  1191. assert '/' not in self.arg
  1192. self.fire_event_for_permission()
  1193. if not hasattr(self.app, 'api_admin_running_backups'):
  1194. self.app.api_admin_running_backups = {}
  1195. if self.arg not in self.app.api_admin_running_backups:
  1196. raise qubes.exc.QubesException('Backup operation not running')
  1197. self.app.api_admin_running_backups[self.arg].cancel()
  1198. @qubes.api.method('admin.backup.Info', no_payload=True,
  1199. scope='local', read=True)
  1200. @asyncio.coroutine
  1201. def backup_info(self):
  1202. assert self.dest.name == 'dom0'
  1203. assert self.arg
  1204. assert '/' not in self.arg
  1205. self.fire_event_for_permission()
  1206. profile_path = os.path.join(qubes.config.backup_profile_dir,
  1207. self.arg + '.conf')
  1208. if not os.path.exists(profile_path):
  1209. raise qubes.api.PermissionDenied(
  1210. 'Backup profile {} does not exist'.format(self.arg))
  1211. backup = yield from self._load_backup_profile(self.arg,
  1212. skip_passphrase=True)
  1213. return backup.get_backup_summary()
  1214. def _send_stats_single(self, info_time, info, only_vm, filters,
  1215. id_to_name_map):
  1216. '''A single iteration of sending VM stats
  1217. :param info_time: time of previous iteration
  1218. :param info: information retrieved in previous iteration
  1219. :param only_vm: send information only about this VM
  1220. :param filters: filters to apply on stats before sending
  1221. :param id_to_name_map: ID->VM name map, may be modified
  1222. :return: tuple(info_time, info) - new information (to be passed to
  1223. the next iteration)
  1224. '''
  1225. (info_time, info) = self.app.host.get_vm_stats(info_time, info,
  1226. only_vm=only_vm)
  1227. for vm_id, vm_info in info.items():
  1228. if vm_id not in id_to_name_map:
  1229. try:
  1230. name = \
  1231. self.app.vmm.libvirt_conn.lookupByID(vm_id).name()
  1232. except libvirt.libvirtError as err:
  1233. if err.get_error_code() == libvirt.VIR_ERR_NO_DOMAIN:
  1234. # stubdomain or so
  1235. name = None
  1236. else:
  1237. raise
  1238. id_to_name_map[vm_id] = name
  1239. else:
  1240. name = id_to_name_map[vm_id]
  1241. # skip VMs with unknown name
  1242. if name is None:
  1243. continue
  1244. if not list(qubes.api.apply_filters([name], filters)):
  1245. continue
  1246. self.send_event(name, 'vm-stats',
  1247. memory_kb=int(vm_info['memory_kb']),
  1248. cpu_time=int(vm_info['cpu_time'] / 1000000),
  1249. cpu_usage=int(vm_info['cpu_usage']))
  1250. return info_time, info
  1251. @qubes.api.method('admin.vm.Stats', no_payload=True,
  1252. scope='global', read=True)
  1253. @asyncio.coroutine
  1254. def vm_stats(self):
  1255. assert not self.arg
  1256. # run until client connection is terminated
  1257. self.cancellable = True
  1258. # cache event filters, to not call an event each time an event arrives
  1259. stats_filters = self.fire_event_for_permission()
  1260. only_vm = None
  1261. if self.dest.name != 'dom0':
  1262. only_vm = self.dest
  1263. self.send_event(self.app, 'connection-established')
  1264. info_time = None
  1265. info = None
  1266. id_to_name_map = {0: 'dom0'}
  1267. try:
  1268. while True:
  1269. info_time, info = self._send_stats_single(info_time, info,
  1270. only_vm, stats_filters, id_to_name_map)
  1271. yield from asyncio.sleep(self.app.stats_interval)
  1272. except asyncio.CancelledError:
  1273. # valid method to terminate this loop
  1274. pass