qfile-daemon-dvm 7.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182
  1. #!/usr/bin/python2
  2. # coding=utf-8
  3. #
  4. # The Qubes OS Project, http://www.qubes-os.org
  5. #
  6. # Copyright (C) 2010 Rafal Wojtczuk <rafal@invisiblethingslab.com>
  7. # Copyright (C) 2013-2015 Marek Marczykowski-Górecki
  8. # <marmarek@invisiblethingslab.com>
  9. #
  10. # This program is free software; you can redistribute it and/or
  11. # modify it under the terms of the GNU General Public License
  12. # as published by the Free Software Foundation; either version 2
  13. # of the License, or (at your option) any later version.
  14. #
  15. # This program is distributed in the hope that it will be useful,
  16. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  17. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  18. # GNU General Public License for more details.
  19. #
  20. # You should have received a copy of the GNU General Public License
  21. # along with this program; if not, write to the Free Software
  22. # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  23. #
  24. #
  25. import os
  26. import subprocess
  27. import sys
  28. import shutil
  29. import time
  30. from qubes.qubes import QubesVmCollection
  31. from qubes.qubes import QubesDispVmLabels
  32. from qubes.notify import tray_notify, tray_notify_error, tray_notify_init
  33. current_savefile = '/var/run/qubes/current-savefile'
  34. current_dvm_conf = '/var/run/qubes/current-dvm.conf'
  35. current_savefile_vmdir = '/var/lib/qubes/dvmdata/vmdir'
  36. class QfileDaemonDvm:
  37. def __init__(self, name):
  38. self.name = name
  39. @staticmethod
  40. def get_disp_templ():
  41. vmdir = os.readlink(current_savefile_vmdir)
  42. return vmdir.split('/')[-1]
  43. def do_get_dvm(self):
  44. tray_notify("Starting new DispVM...", "red")
  45. qvm_collection = QubesVmCollection()
  46. qvm_collection.lock_db_for_writing()
  47. tar_process = subprocess.Popen(
  48. ['bsdtar', '-C', current_savefile_vmdir,
  49. '-xSUf', os.path.join(current_savefile_vmdir, 'saved-cows.tar')])
  50. qvm_collection.load()
  51. print >>sys.stderr, "time=%s, collection loaded" % (str(time.time()))
  52. vm = qvm_collection.get_vm_by_name(self.name)
  53. if vm is None:
  54. sys.stderr.write('Domain ' + self.name + ' does not exist ?')
  55. qvm_collection.unlock_db()
  56. return None
  57. label = vm.label
  58. if len(sys.argv) > 4 and len(sys.argv[4]) > 0:
  59. assert sys.argv[4] in QubesDispVmLabels.keys(), "Invalid label"
  60. label = QubesDispVmLabels[sys.argv[4]]
  61. disp_templ = self.get_disp_templ()
  62. vm_disptempl = qvm_collection.get_vm_by_name(disp_templ)
  63. if vm_disptempl is None:
  64. sys.stderr.write('Domain ' + disp_templ + ' does not exist ?')
  65. qvm_collection.unlock_db()
  66. return None
  67. dispvm = qvm_collection.add_new_vm('QubesDisposableVm',
  68. disp_template=vm_disptempl,
  69. label=label)
  70. print >>sys.stderr, "time=%s, VM created" % (str(time.time()))
  71. # By default inherit firewall rules from calling VM
  72. if os.path.exists(vm.firewall_conf):
  73. disp_firewall_conf = '/var/run/qubes/%s-firewall.xml' % dispvm.name
  74. shutil.copy(vm.firewall_conf, disp_firewall_conf)
  75. dispvm.firewall_conf = disp_firewall_conf
  76. if len(sys.argv) > 5 and len(sys.argv[5]) > 0:
  77. assert os.path.exists(sys.argv[5]), "Invalid firewall.conf location"
  78. dispvm.firewall_conf = sys.argv[5]
  79. if vm.qid != 0:
  80. dispvm.uses_default_netvm = False
  81. # netvm can be changed before restore,
  82. # but cannot be enabled/disabled
  83. if (dispvm.netvm is None) == (vm.dispvm_netvm is None):
  84. dispvm.netvm = vm.dispvm_netvm
  85. # Wait for tar to finish
  86. if tar_process.wait() != 0:
  87. sys.stderr.write('Failed to unpack saved-cows.tar')
  88. qvm_collection.unlock_db()
  89. return None
  90. print >>sys.stderr, "time=%s, VM starting" % (str(time.time()))
  91. dispvm.start()
  92. if vm.qid != 0:
  93. # if need to enable/disable netvm, do it while DispVM is alive
  94. if (dispvm.netvm is None) != (vm.dispvm_netvm is None):
  95. dispvm.netvm = vm.dispvm_netvm
  96. print >>sys.stderr, "time=%s, VM started" % (str(time.time()))
  97. qvm_collection.save()
  98. qvm_collection.unlock_db()
  99. # Reload firewall rules
  100. print >>sys.stderr, "time=%s, reloading firewall" % (str(time.time()))
  101. for vm in qvm_collection.values():
  102. if vm.is_proxyvm() and vm.is_running():
  103. vm.write_iptables_qubesdb_entry()
  104. return dispvm
  105. @staticmethod
  106. def dvm_setup_ok():
  107. dvmdata_dir = '/var/lib/qubes/dvmdata/'
  108. if not os.path.isfile(current_savefile):
  109. return False
  110. if not os.path.isfile(dvmdata_dir+'default-savefile') or \
  111. not os.path.isfile(dvmdata_dir+'savefile-root'):
  112. return False
  113. dvm_mtime = os.stat(current_savefile).st_mtime
  114. root_mtime = os.stat(dvmdata_dir+'savefile-root').st_mtime
  115. if dvm_mtime < root_mtime:
  116. template_name = os.path.basename(
  117. os.path.dirname(os.readlink(dvmdata_dir+'savefile-root')))
  118. if subprocess.call(["xl", "domid", template_name],
  119. stdout=open(os.devnull, "w")) == 0:
  120. tray_notify("For optimum performance, you should not "
  121. "start DispVM when its template is running.", "red")
  122. return False
  123. return True
  124. def get_dvm(self):
  125. if not self.dvm_setup_ok():
  126. if os.system("/usr/lib/qubes/"
  127. "qubes-update-dispvm-savefile-with-progress.sh"
  128. " >/dev/null </dev/null") != 0:
  129. tray_notify_error("DVM savefile creation failed")
  130. return None
  131. return self.do_get_dvm()
  132. @staticmethod
  133. def remove_disposable_from_qdb(name):
  134. qvm_collection = QubesVmCollection()
  135. qvm_collection.lock_db_for_writing()
  136. qvm_collection.load()
  137. vm = qvm_collection.get_vm_by_name(name)
  138. if vm is None:
  139. qvm_collection.unlock_db()
  140. return False
  141. qvm_collection.pop(vm.qid)
  142. qvm_collection.save()
  143. qvm_collection.unlock_db()
  144. def main():
  145. exec_index = sys.argv[1]
  146. src_vmname = sys.argv[2]
  147. user = sys.argv[3]
  148. # accessed directly by get_dvm()
  149. # sys.argv[4] - override label
  150. # sys.argv[5] - override firewall
  151. print >>sys.stderr, "time=%s, qfile-daemon-dvm init" % (str(time.time()))
  152. tray_notify_init()
  153. print >>sys.stderr, "time=%s, creating DispVM" % (str(time.time()))
  154. qfile = QfileDaemonDvm(src_vmname)
  155. dispvm = qfile.get_dvm()
  156. if dispvm is not None:
  157. print >>sys.stderr, "time=%s, starting VM process" % (str(time.time()))
  158. subprocess.call(['/usr/lib/qubes/qrexec-client', '-d', dispvm.name,
  159. user+':exec /usr/lib/qubes/qubes-rpc-multiplexer ' +
  160. exec_index + " " + src_vmname])
  161. dispvm.force_shutdown()
  162. qfile.remove_disposable_from_qdb(dispvm.name)
  163. main()