app.py 39 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210
  1. #
  2. # The Qubes OS Project, https://www.qubes-os.org/
  3. #
  4. # Copyright (C) 2010-2015 Joanna Rutkowska <joanna@invisiblethingslab.com>
  5. # Copyright (C) 2011-2015 Marek Marczykowski-Górecki
  6. # <marmarek@invisiblethingslab.com>
  7. # Copyright (C) 2014-2015 Wojtek Porczyk <woju@invisiblethingslab.com>
  8. #
  9. # This program is free software; you can redistribute it and/or modify
  10. # it under the terms of the GNU General Public License as published by
  11. # the Free Software Foundation; either version 2 of the License, or
  12. # (at your option) any later version.
  13. #
  14. # This program is distributed in the hope that it will be useful,
  15. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  16. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  17. # GNU General Public License for more details.
  18. #
  19. # You should have received a copy of the GNU General Public License along
  20. # with this program; if not, write to the Free Software Foundation, Inc.,
  21. # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  22. #
  23. import collections
  24. import errno
  25. import functools
  26. import grp
  27. import logging
  28. import os
  29. import random
  30. import subprocess
  31. import sys
  32. import tempfile
  33. import time
  34. import uuid
  35. import lxml.etree
  36. import jinja2
  37. import libvirt
  38. try:
  39. import xen.lowlevel.xs # pylint: disable=wrong-import-order
  40. import xen.lowlevel.xc # pylint: disable=wrong-import-order
  41. except ImportError:
  42. pass
  43. if os.name == 'posix':
  44. # pylint: disable=wrong-import-order
  45. import fcntl
  46. elif os.name == 'nt':
  47. # pylint: disable=import-error
  48. import win32con
  49. import win32file
  50. import pywintypes
  51. else:
  52. raise RuntimeError("Qubes works only on POSIX or WinNT systems")
  53. # pylint: disable=wrong-import-position
  54. import qubes
  55. import qubes.ext
  56. import qubes.utils
  57. import qubes.storage
  58. import qubes.vm
  59. import qubes.vm.adminvm
  60. import qubes.vm.qubesvm
  61. import qubes.vm.templatevm
  62. # pylint: enable=wrong-import-position
  63. class VirDomainWrapper(object):
  64. # pylint: disable=too-few-public-methods
  65. def __init__(self, connection, vm):
  66. self._connection = connection
  67. self._vm = vm
  68. def _reconnect_if_dead(self):
  69. is_dead = not self._vm.connect().isAlive()
  70. if is_dead:
  71. # pylint: disable=protected-access
  72. self._connection._reconnect_if_dead()
  73. self._vm = self._connection._conn.lookupByUUID(self._vm.UUID())
  74. return is_dead
  75. def __getattr__(self, attrname):
  76. attr = getattr(self._vm, attrname)
  77. if not isinstance(attr, collections.Callable):
  78. return attr
  79. @functools.wraps(attr)
  80. def wrapper(*args, **kwargs):
  81. try:
  82. return attr(*args, **kwargs)
  83. except libvirt.libvirtError:
  84. if self._reconnect_if_dead():
  85. return getattr(self._vm, attrname)(*args, **kwargs)
  86. raise
  87. return wrapper
  88. class VirConnectWrapper(object):
  89. # pylint: disable=too-few-public-methods
  90. def __init__(self, uri):
  91. self._conn = libvirt.open(uri)
  92. def _reconnect_if_dead(self):
  93. is_dead = not self._conn.isAlive()
  94. if is_dead:
  95. self._conn = libvirt.open(self._conn.getURI())
  96. # TODO: re-register event handlers
  97. return is_dead
  98. def _wrap_domain(self, ret):
  99. if isinstance(ret, libvirt.virDomain):
  100. ret = VirDomainWrapper(self, ret)
  101. return ret
  102. def __getattr__(self, attrname):
  103. attr = getattr(self._conn, attrname)
  104. if not isinstance(attr, collections.Callable):
  105. return attr
  106. if attrname == 'close':
  107. return attr
  108. @functools.wraps(attr)
  109. def wrapper(*args, **kwargs):
  110. try:
  111. return self._wrap_domain(attr(*args, **kwargs))
  112. except libvirt.libvirtError:
  113. if self._reconnect_if_dead():
  114. return self._wrap_domain(
  115. getattr(self._conn, attrname)(*args, **kwargs))
  116. raise
  117. return wrapper
  118. class VMMConnection(object):
  119. '''Connection to Virtual Machine Manager (libvirt)'''
  120. def __init__(self, offline_mode=None):
  121. '''
  122. :param offline_mode: enable/disable offline mode; default is to
  123. enable when running in chroot as root, otherwise disable
  124. '''
  125. self._libvirt_conn = None
  126. self._xs = None
  127. self._xc = None
  128. if offline_mode is None:
  129. offline_mode = bool(os.getuid() == 0 and
  130. os.stat('/') != os.stat('/proc/1/root/.'))
  131. self._offline_mode = offline_mode
  132. @property
  133. def offline_mode(self):
  134. '''Check or enable offline mode (do not actually connect to vmm)'''
  135. return self._offline_mode
  136. def _libvirt_error_handler(self, ctx, error):
  137. pass
  138. def init_vmm_connection(self):
  139. '''Initialise connection
  140. This method is automatically called when getting'''
  141. if self._libvirt_conn is not None:
  142. # Already initialized
  143. return
  144. if self._offline_mode:
  145. # Do not initialize in offline mode
  146. raise qubes.exc.QubesException(
  147. 'VMM operations disabled in offline mode')
  148. if 'xen.lowlevel.xs' in sys.modules:
  149. self._xs = xen.lowlevel.xs.xs()
  150. if 'xen.lowlevel.xc' in sys.modules:
  151. self._xc = xen.lowlevel.xc.xc()
  152. self._libvirt_conn = VirConnectWrapper(
  153. qubes.config.defaults['libvirt_uri'])
  154. libvirt.registerErrorHandler(self._libvirt_error_handler, None)
  155. @property
  156. def libvirt_conn(self):
  157. '''Connection to libvirt'''
  158. self.init_vmm_connection()
  159. return self._libvirt_conn
  160. @property
  161. def xs(self):
  162. '''Connection to Xen Store
  163. This property in available only when running on Xen.
  164. '''
  165. # XXX what about the case when we run under KVM,
  166. # but xen modules are importable?
  167. if 'xen.lowlevel.xs' not in sys.modules:
  168. raise AttributeError(
  169. 'xs object is available under Xen hypervisor only')
  170. self.init_vmm_connection()
  171. return self._xs
  172. @property
  173. def xc(self):
  174. '''Connection to Xen
  175. This property in available only when running on Xen.
  176. '''
  177. # XXX what about the case when we run under KVM,
  178. # but xen modules are importable?
  179. if 'xen.lowlevel.xc' not in sys.modules:
  180. raise AttributeError(
  181. 'xc object is available under Xen hypervisor only')
  182. self.init_vmm_connection()
  183. return self._xc
  184. def register_event_handlers(self, app):
  185. '''Register libvirt event handlers, which will translate libvirt
  186. events into qubes.events. This function should be called only in
  187. 'qubesd' process and only when mainloop has been already set.
  188. '''
  189. self.libvirt_conn.domainEventRegisterAny(
  190. None, # any domain
  191. libvirt.VIR_DOMAIN_EVENT_ID_LIFECYCLE,
  192. self._domain_event_callback,
  193. app
  194. )
  195. @staticmethod
  196. def _domain_event_callback(_conn, domain, event, _detail, opaque):
  197. '''Generic libvirt event handler (virConnectDomainEventCallback),
  198. translate libvirt event into qubes.events.
  199. '''
  200. app = opaque
  201. try:
  202. vm = app.domains[domain.name()]
  203. except KeyError:
  204. # ignore events for unknown domains
  205. return
  206. if event == libvirt.VIR_DOMAIN_EVENT_STOPPED:
  207. vm.fire_event('domain-shutdown')
  208. def __del__(self):
  209. if self._libvirt_conn:
  210. self._libvirt_conn.close()
  211. class QubesHost(object):
  212. '''Basic information about host machine
  213. :param qubes.Qubes app: Qubes application context (must have \
  214. :py:attr:`Qubes.vmm` attribute defined)
  215. '''
  216. def __init__(self, app):
  217. self.app = app
  218. self._no_cpus = None
  219. self._total_mem = None
  220. self._physinfo = None
  221. def _fetch(self):
  222. if self._no_cpus is not None:
  223. return
  224. # pylint: disable=unused-variable
  225. (model, memory, cpus, mhz, nodes, socket, cores, threads) = \
  226. self.app.vmm.libvirt_conn.getInfo()
  227. self._total_mem = int(memory) * 1024
  228. self._no_cpus = cpus
  229. self.app.log.debug('QubesHost: no_cpus={} memory_total={}'.format(
  230. self.no_cpus, self.memory_total))
  231. try:
  232. self.app.log.debug('QubesHost: xen_free_memory={}'.format(
  233. self.get_free_xen_memory()))
  234. except NotImplementedError:
  235. pass
  236. @property
  237. def memory_total(self):
  238. '''Total memory, in kbytes'''
  239. if self.app.vmm.offline_mode:
  240. return 2**64-1
  241. self._fetch()
  242. return self._total_mem
  243. @property
  244. def no_cpus(self):
  245. '''Number of CPUs'''
  246. if self.app.vmm.offline_mode:
  247. return 42
  248. self._fetch()
  249. return self._no_cpus
  250. def get_free_xen_memory(self):
  251. '''Get free memory from Xen's physinfo.
  252. :raises NotImplementedError: when not under Xen
  253. '''
  254. try:
  255. self._physinfo = self.app.xc.physinfo()
  256. except AttributeError:
  257. raise NotImplementedError('This function requires Xen hypervisor')
  258. return int(self._physinfo['free_memory'])
  259. def get_vm_stats(self, previous_time=None, previous=None, only_vm=None):
  260. '''Measure cpu usage for all domains at once.
  261. If previous measurements are given, CPU usage will be given in
  262. percents of time. Otherwise only absolute value (seconds).
  263. Return a tuple of (measurements_time, measurements),
  264. where measurements is a dictionary with key: domid, value: dict:
  265. - cpu_time - absolute CPU usage (seconds since its startup)
  266. - cpu_usage - CPU usage in %
  267. - memory_kb - current memory assigned, in kb
  268. This function requires Xen hypervisor.
  269. ..warning:
  270. This function may return info about implementation-specific VMs,
  271. like stubdomains for HVM
  272. :param previous: previous measurement
  273. :param previous_time: time of previous measurement
  274. :param only_vm: get measurements only for this VM
  275. :raises NotImplementedError: when not under Xen
  276. '''
  277. if (previous_time is None) != (previous is None):
  278. raise ValueError(
  279. 'previous and previous_time must be given together (or none)')
  280. if previous is None:
  281. previous = {}
  282. current_time = time.time()
  283. current = {}
  284. try:
  285. if only_vm:
  286. xid = only_vm.xid
  287. if xid < 0:
  288. raise qubes.exc.QubesVMNotRunningError(only_vm)
  289. info = self.app.vmm.xc.domain_getinfo(xid, 1)
  290. if info[0]['domid'] != xid:
  291. raise qubes.exc.QubesVMNotRunningError(only_vm)
  292. else:
  293. info = self.app.vmm.xc.domain_getinfo(0, 1024)
  294. except AttributeError:
  295. raise NotImplementedError(
  296. 'This function requires Xen hypervisor')
  297. # TODO: add stubdomain stats to actual VMs
  298. for vm in info:
  299. domid = vm['domid']
  300. current[domid] = {}
  301. current[domid]['memory_kb'] = vm['mem_kb']
  302. current[domid]['cpu_time'] = int(
  303. vm['cpu_time'] / max(vm['online_vcpus'], 1))
  304. if domid in previous:
  305. current[domid]['cpu_usage'] = int(
  306. (current[domid]['cpu_time'] - previous[domid]['cpu_time'])
  307. / 1000 ** 3 * 100 / (current_time - previous_time))
  308. if current[domid]['cpu_usage'] < 0:
  309. # VM has been rebooted
  310. current[domid]['cpu_usage'] = 0
  311. else:
  312. current[domid]['cpu_usage'] = 0
  313. return (current_time, current)
  314. class VMCollection(object):
  315. '''A collection of Qubes VMs
  316. VMCollection supports ``in`` operator. You may test for ``qid``, ``name``
  317. and whole VM object's presence.
  318. Iterating over VMCollection will yield machine objects.
  319. '''
  320. def __init__(self, app):
  321. self.app = app
  322. self._dict = dict()
  323. def __repr__(self):
  324. return '<{} {!r}>'.format(
  325. self.__class__.__name__, list(sorted(self.keys())))
  326. def items(self):
  327. '''Iterate over ``(qid, vm)`` pairs'''
  328. for qid in self.qids():
  329. yield (qid, self[qid])
  330. def qids(self):
  331. '''Iterate over all qids
  332. qids are sorted by numerical order.
  333. '''
  334. return iter(sorted(self._dict.keys()))
  335. keys = qids
  336. def names(self):
  337. '''Iterate over all names
  338. names are sorted by lexical order.
  339. '''
  340. return iter(sorted(vm.name for vm in self._dict.values()))
  341. def vms(self):
  342. '''Iterate over all machines
  343. vms are sorted by qid.
  344. '''
  345. return iter(sorted(self._dict.values()))
  346. __iter__ = vms
  347. values = vms
  348. def add(self, value, _enable_events=True):
  349. '''Add VM to collection
  350. :param qubes.vm.BaseVM value: VM to add
  351. :raises TypeError: when value is of wrong type
  352. :raises ValueError: when there is already VM which has equal ``qid``
  353. '''
  354. # this violates duck typing, but is needed
  355. # for VMProperty to function correctly
  356. if not isinstance(value, qubes.vm.BaseVM):
  357. raise TypeError('{} holds only BaseVM instances'.format(
  358. self.__class__.__name__))
  359. if value.qid in self:
  360. raise ValueError('This collection already holds VM that has '
  361. 'qid={!r} ({!r})'.format(value.qid, self[value.qid]))
  362. if value.name in self:
  363. raise ValueError('A VM named {!s} already exists'
  364. .format(value.name))
  365. self._dict[value.qid] = value
  366. if _enable_events:
  367. value.events_enabled = True
  368. self.app.fire_event('domain-add', vm=value)
  369. return value
  370. def __getitem__(self, key):
  371. if isinstance(key, int):
  372. return self._dict[key]
  373. if isinstance(key, str):
  374. for vm in self:
  375. if vm.name == key:
  376. return vm
  377. raise KeyError(key)
  378. if isinstance(key, qubes.vm.BaseVM):
  379. key = key.uuid
  380. if isinstance(key, uuid.UUID):
  381. for vm in self:
  382. if vm.uuid == key:
  383. return vm
  384. raise KeyError(key)
  385. raise KeyError(key)
  386. def __delitem__(self, key):
  387. vm = self[key]
  388. if not vm.is_halted():
  389. raise qubes.exc.QubesVMNotHaltedError(vm)
  390. self.app.fire_event('domain-pre-delete', pre_event=True, vm=vm)
  391. try:
  392. vm.libvirt_domain.undefine()
  393. except libvirt.libvirtError as e:
  394. if e.get_error_code() == libvirt.VIR_ERR_NO_DOMAIN:
  395. # already undefined
  396. pass
  397. del self._dict[vm.qid]
  398. self.app.fire_event('domain-delete', vm=vm)
  399. def __contains__(self, key):
  400. return any((key == vm or key == vm.qid or key == vm.name)
  401. for vm in self)
  402. def __len__(self):
  403. return len(self._dict)
  404. def get_vms_based_on(self, template):
  405. template = self[template]
  406. return set(vm for vm in self
  407. if hasattr(vm, 'template') and vm.template == template)
  408. def get_vms_connected_to(self, netvm):
  409. new_vms = set([self[netvm]])
  410. dependent_vms = set()
  411. # Dependency resolving only makes sense on NetVM (or derivative)
  412. # if not self[netvm_qid].is_netvm():
  413. # return set([])
  414. while new_vms:
  415. cur_vm = new_vms.pop()
  416. for vm in cur_vm.connected_vms:
  417. if vm in dependent_vms:
  418. continue
  419. dependent_vms.add(vm)
  420. # if vm.is_netvm():
  421. new_vms.add(vm)
  422. return dependent_vms
  423. # XXX with Qubes Admin Api this will probably lead to race condition
  424. # whole process of creating and adding should be synchronised
  425. def get_new_unused_qid(self):
  426. used_ids = set(self.qids())
  427. for i in range(1, qubes.config.max_qid):
  428. if i not in used_ids:
  429. return i
  430. raise LookupError("Cannot find unused qid!")
  431. def get_new_unused_netid(self):
  432. used_ids = set([vm.netid for vm in self]) # if vm.is_netvm()])
  433. for i in range(1, qubes.config.max_netid):
  434. if i not in used_ids:
  435. return i
  436. raise LookupError("Cannot find unused netid!")
  437. def get_new_unused_dispid(self):
  438. for _ in range(int(qubes.config.max_dispid ** 0.5)):
  439. dispid = random.SystemRandom().randrange(qubes.config.max_dispid)
  440. if not any(getattr(vm, 'dispid', None) == dispid for vm in self):
  441. return dispid
  442. raise LookupError((
  443. 'https://xkcd.com/221/',
  444. 'http://dilbert.com/strip/2001-10-25')[random.randint(0, 1)])
  445. def _default_pool(app):
  446. ''' Default storage pool.
  447. 1. If there is one named 'default', use it.
  448. 2. Check if root fs is on LVM thin - use that
  449. 3. Look for file-based pool pointing /var/lib/qubes
  450. 4. Fail
  451. '''
  452. if 'default' in app.pools:
  453. return app.pools['default']
  454. else:
  455. rootfs = os.stat('/')
  456. root_major = (rootfs.st_dev & 0xff00) >> 8
  457. root_minor = rootfs.st_dev & 0xff
  458. for pool in app.pools.values():
  459. if pool.config.get('driver', None) != 'lvm_thin':
  460. continue
  461. thin_pool = pool.config['thin_pool']
  462. thin_volumes = subprocess.check_output(
  463. ['lvs', '--select', 'pool_lv=' + thin_pool,
  464. '-o', 'lv_kernel_major,lv_kernel_minor', '--noheadings'])
  465. thin_volumes = thin_volumes.decode()
  466. if any([str(root_major), str(root_minor)] == thin_vol.split()
  467. for thin_vol in thin_volumes.splitlines()):
  468. return pool
  469. # not a thin volume? look for file pools
  470. for pool in app.pools.values():
  471. if pool.config.get('driver', None) != 'file':
  472. continue
  473. if pool.config['dir_path'] == qubes.config.qubes_base_dir:
  474. return pool
  475. raise AttributeError('Cannot determine default storage pool')
  476. def _setter_pool(app, prop, value):
  477. if isinstance(value, qubes.storage.Pool):
  478. return value
  479. try:
  480. return app.pools[value]
  481. except KeyError:
  482. raise qubes.exc.QubesPropertyValueError(app, prop, value,
  483. 'No such storage pool')
  484. class Qubes(qubes.PropertyHolder):
  485. '''Main Qubes application
  486. :param str store: path to ``qubes.xml``
  487. The store is loaded in stages:
  488. 1. In the first stage there are loaded some basic features from store
  489. (currently labels).
  490. 2. In the second stage stubs for all VMs are loaded. They are filled
  491. with their basic properties, like ``qid`` and ``name``.
  492. 3. In the third stage all global properties are loaded. They often
  493. reference VMs, like default netvm, so they should be filled after
  494. loading VMs.
  495. 4. In the fourth stage all remaining VM properties are loaded. They
  496. also need all VMs loaded, because they represent dependencies
  497. between VMs like aforementioned netvm.
  498. 5. In the fifth stage there are some fixups to ensure sane system
  499. operation.
  500. This class emits following events:
  501. .. event:: domain-add (subject, event, vm)
  502. When domain is added.
  503. :param subject: Event emitter
  504. :param event: Event name (``'domain-add'``)
  505. :param vm: Domain object
  506. .. event:: domain-pre-delete (subject, event, vm)
  507. When domain is deleted. VM still has reference to ``app`` object,
  508. and is contained within VMCollection. You may prevent removal by
  509. raising an exception.
  510. :param subject: Event emitter
  511. :param event: Event name (``'domain-pre-delete'``)
  512. :param vm: Domain object
  513. .. event:: domain-delete (subject, event, vm)
  514. When domain is deleted. VM still has reference to ``app`` object,
  515. but is not contained within VMCollection.
  516. :param subject: Event emitter
  517. :param event: Event name (``'domain-delete'``)
  518. :param vm: Domain object
  519. Methods and attributes:
  520. '''
  521. default_netvm = qubes.VMProperty('default_netvm', load_stage=3,
  522. default=None, allow_none=True,
  523. doc='''Default NetVM for AppVMs. Initial state is `None`, which means
  524. that AppVMs are not connected to the Internet.''')
  525. default_fw_netvm = qubes.VMProperty('default_fw_netvm', load_stage=3,
  526. default=None, allow_none=True,
  527. doc='''Default NetVM for ProxyVMs. Initial state is `None`, which means
  528. that ProxyVMs (including FirewallVM) are not connected to the
  529. Internet.''')
  530. default_template = qubes.VMProperty('default_template', load_stage=3,
  531. vmclass=qubes.vm.templatevm.TemplateVM,
  532. doc='Default template for new AppVMs')
  533. updatevm = qubes.VMProperty('updatevm', load_stage=3,
  534. allow_none=True,
  535. doc='''Which VM to use as `yum` proxy for updating AdminVM and
  536. TemplateVMs''')
  537. clockvm = qubes.VMProperty('clockvm', load_stage=3,
  538. default=None, allow_none=True,
  539. doc='Which VM to use as NTP proxy for updating AdminVM')
  540. default_kernel = qubes.property('default_kernel', load_stage=3,
  541. doc='Which kernel to use when not overriden in VM')
  542. default_dispvm = qubes.VMProperty('default_dispvm', load_stage=3,
  543. doc='Default DispVM base for service calls')
  544. default_pool = qubes.property('default_pool', load_stage=3,
  545. default=_default_pool,
  546. setter=_setter_pool,
  547. doc='Default storage pool')
  548. default_pool_private = qubes.property('default_pool_private', load_stage=3,
  549. default=lambda app: app.default_pool,
  550. setter=_setter_pool,
  551. doc='Default storage pool for private volumes')
  552. default_pool_root = qubes.property('default_pool_root', load_stage=3,
  553. default=lambda app: app.default_pool,
  554. setter=_setter_pool,
  555. doc='Default storage pool for root volumes')
  556. default_pool_volatile = qubes.property('default_pool_volatile',
  557. load_stage=3,
  558. default=lambda app: app.default_pool,
  559. setter=_setter_pool,
  560. doc='Default storage pool for volatile volumes')
  561. default_pool_kernel = qubes.property('default_pool_kernel', load_stage=3,
  562. default=lambda app: app.default_pool,
  563. setter=_setter_pool,
  564. doc='Default storage pool for kernel volumes')
  565. stats_interval = qubes.property('stats_interval',
  566. default=3,
  567. type=int,
  568. doc='Interval in seconds for VM stats reporting (memory, CPU usage)')
  569. # TODO #1637 #892
  570. check_updates_vm = qubes.property('check_updates_vm',
  571. type=bool, setter=qubes.property.bool,
  572. default=True,
  573. doc='check for updates inside qubes')
  574. def __init__(self, store=None, load=True, offline_mode=None, lock=False,
  575. **kwargs):
  576. #: logger instance for logging global messages
  577. self.log = logging.getLogger('app')
  578. self._extensions = qubes.ext.get_extensions()
  579. #: collection of all VMs managed by this Qubes instance
  580. self.domains = VMCollection(self)
  581. #: collection of all available labels for VMs
  582. self.labels = {}
  583. #: collection of all pools
  584. self.pools = {}
  585. #: Connection to VMM
  586. self.vmm = VMMConnection(offline_mode=offline_mode)
  587. #: Information about host system
  588. self.host = QubesHost(self)
  589. if store is not None:
  590. self._store = store
  591. else:
  592. self._store = os.environ.get('QUBES_XML_PATH',
  593. os.path.join(
  594. qubes.config.qubes_base_dir,
  595. qubes.config.system_path['qubes_store_filename']))
  596. super(Qubes, self).__init__(xml=None, **kwargs)
  597. self.__load_timestamp = None
  598. self.__locked_fh = None
  599. #: jinja2 environment for libvirt XML templates
  600. self.env = jinja2.Environment(
  601. loader=jinja2.FileSystemLoader([
  602. '/etc/qubes/templates',
  603. '/usr/share/qubes/templates',
  604. ]),
  605. undefined=jinja2.StrictUndefined)
  606. if load:
  607. self.load(lock=lock)
  608. self.events_enabled = True
  609. @property
  610. def store(self):
  611. return self._store
  612. def load(self, lock=False):
  613. '''Open qubes.xml
  614. :throws EnvironmentError: failure on parsing store
  615. :throws xml.parsers.expat.ExpatError: failure on parsing store
  616. :raises lxml.etree.XMLSyntaxError: on syntax error in qubes.xml
  617. '''
  618. fh = self._acquire_lock()
  619. self.xml = lxml.etree.parse(fh)
  620. # stage 1: load labels and pools
  621. for node in self.xml.xpath('./labels/label'):
  622. label = qubes.Label.fromxml(node)
  623. self.labels[label.index] = label
  624. for node in self.xml.xpath('./pools/pool'):
  625. name = node.get('name')
  626. assert name, "Pool name '%s' is invalid " % name
  627. try:
  628. self.pools[name] = self._get_pool(**node.attrib)
  629. except qubes.exc.QubesException as e:
  630. self.log.error(str(e))
  631. # stage 2: load VMs
  632. for node in self.xml.xpath('./domains/domain'):
  633. # pylint: disable=no-member
  634. cls = self.get_vm_class(node.get('class'))
  635. vm = cls(self, node)
  636. vm.load_properties(load_stage=2)
  637. vm.init_log()
  638. self.domains.add(vm, _enable_events=False)
  639. if 0 not in self.domains:
  640. self.domains.add(
  641. qubes.vm.adminvm.AdminVM(self, None, qid=0, name='dom0'),
  642. _enable_events=False)
  643. # stage 3: load global properties
  644. self.load_properties(load_stage=3)
  645. # stage 4: fill all remaining VM properties
  646. for vm in self.domains:
  647. vm.load_properties(load_stage=4)
  648. vm.load_extras()
  649. # stage 5: misc fixups
  650. self.property_require('default_fw_netvm', allow_none=True)
  651. self.property_require('default_netvm', allow_none=True)
  652. self.property_require('default_template')
  653. self.property_require('clockvm', allow_none=True)
  654. self.property_require('updatevm', allow_none=True)
  655. for vm in self.domains:
  656. vm.events_enabled = True
  657. vm.fire_event('domain-load')
  658. # get a file timestamp (before closing it - still holding the lock!),
  659. # to detect whether anyone else have modified it in the meantime
  660. self.__load_timestamp = os.path.getmtime(self._store)
  661. if not lock:
  662. self._release_lock()
  663. def __xml__(self):
  664. element = lxml.etree.Element('qubes')
  665. element.append(self.xml_labels())
  666. pools_xml = lxml.etree.Element('pools')
  667. for pool in self.pools.values():
  668. xml = pool.__xml__()
  669. if xml is not None:
  670. pools_xml.append(xml)
  671. element.append(pools_xml)
  672. element.append(self.xml_properties())
  673. domains = lxml.etree.Element('domains')
  674. for vm in self.domains:
  675. domains.append(vm.__xml__())
  676. element.append(domains)
  677. return element
  678. def save(self, lock=True):
  679. '''Save all data to qubes.xml
  680. There are several problems with saving :file:`qubes.xml` which must be
  681. mitigated:
  682. - Running out of disk space. No space left should not result in empty
  683. file. This is done by writing to temporary file and then renaming.
  684. - Attempts to write two or more files concurrently. This is done by
  685. sophisticated locking.
  686. :param bool lock: keep file locked after saving
  687. :throws EnvironmentError: failure on saving
  688. '''
  689. if not self.__locked_fh:
  690. self._acquire_lock(for_save=True)
  691. fh_new = tempfile.NamedTemporaryFile(
  692. prefix=self._store, delete=False)
  693. lxml.etree.ElementTree(self.__xml__()).write(
  694. fh_new, encoding='utf-8', pretty_print=True)
  695. fh_new.flush()
  696. try:
  697. os.chown(fh_new.name, -1, grp.getgrnam('qubes').gr_gid)
  698. os.chmod(fh_new.name, 0o660)
  699. except KeyError: # group 'qubes' not found
  700. # don't change mode if no 'qubes' group in the system
  701. pass
  702. os.rename(fh_new.name, self._store)
  703. # update stored mtime, in case of multiple save() calls without
  704. # loading qubes.xml again
  705. self.__load_timestamp = os.path.getmtime(self._store)
  706. # this releases lock for all other processes,
  707. # but they should instantly block on the new descriptor
  708. self.__locked_fh.close()
  709. self.__locked_fh = fh_new
  710. if not lock:
  711. self._release_lock()
  712. def _acquire_lock(self, for_save=False):
  713. assert self.__locked_fh is None, 'double lock'
  714. while True:
  715. try:
  716. fd = os.open(self._store,
  717. os.O_RDWR | (os.O_CREAT * int(for_save)))
  718. except OSError as e:
  719. if not for_save and e.errno == errno.ENOENT:
  720. raise qubes.exc.QubesException(
  721. 'Qubes XML store {!r} is missing; '
  722. 'use qubes-create tool'.format(self._store))
  723. raise
  724. # While we were waiting for lock, someone could have unlink()ed
  725. # (or rename()d) our file out of the filesystem. We have to
  726. # ensure we got lock on something linked to filesystem.
  727. # If not, try again.
  728. if os.fstat(fd) != os.stat(self._store):
  729. os.close(fd)
  730. continue
  731. if self.__load_timestamp and \
  732. os.path.getmtime(self._store) != self.__load_timestamp:
  733. os.close(fd)
  734. raise qubes.exc.QubesException(
  735. 'Someone else modified qubes.xml in the meantime')
  736. break
  737. if os.name == 'posix':
  738. fcntl.lockf(fd, fcntl.LOCK_EX)
  739. elif os.name == 'nt':
  740. # pylint: disable=protected-access
  741. overlapped = pywintypes.OVERLAPPED()
  742. win32file.LockFileEx(
  743. win32file._get_osfhandle(fd),
  744. win32con.LOCKFILE_EXCLUSIVE_LOCK, 0, -0x10000, overlapped)
  745. self.__locked_fh = os.fdopen(fd, 'r+b')
  746. return self.__locked_fh
  747. def _release_lock(self):
  748. assert self.__locked_fh is not None, 'double release'
  749. # intentionally do not call explicit unlock to not unlock the file
  750. # before all buffers are flushed
  751. self.__locked_fh.close()
  752. self.__locked_fh = None
  753. def load_initial_values(self):
  754. self.labels = {
  755. 1: qubes.Label(1, '0xcc0000', 'red'),
  756. 2: qubes.Label(2, '0xf57900', 'orange'),
  757. 3: qubes.Label(3, '0xedd400', 'yellow'),
  758. 4: qubes.Label(4, '0x73d216', 'green'),
  759. 5: qubes.Label(5, '0x555753', 'gray'),
  760. 6: qubes.Label(6, '0x3465a4', 'blue'),
  761. 7: qubes.Label(7, '0x75507b', 'purple'),
  762. 8: qubes.Label(8, '0x000000', 'black'),
  763. }
  764. assert max(self.labels.keys()) == qubes.config.max_default_label
  765. # check if the default LVM Thin pool qubes_dom0/pool00 exists
  766. if os.path.exists('/dev/mapper/qubes_dom0-pool00-tpool'):
  767. self.add_pool(volume_group='qubes_dom0', thin_pool='pool00',
  768. name='lvm', driver='lvm_thin')
  769. # pool based on /var/lib/qubes will be created here:
  770. for name, config in qubes.config.defaults['pool_configs'].items():
  771. self.pools[name] = self._get_pool(**config)
  772. self.default_pool_kernel = 'linux-kernel'
  773. self.domains.add(
  774. qubes.vm.adminvm.AdminVM(self, None, label='black'))
  775. @classmethod
  776. def create_empty_store(cls, *args, **kwargs):
  777. self = cls(*args, load=False, **kwargs)
  778. if os.path.exists(self.store):
  779. raise qubes.exc.QubesException(
  780. '{} already exists, aborting'.format(self.store))
  781. self.load_initial_values()
  782. # TODO py3 get lock= as keyword-only arg
  783. self.save(kwargs.get('lock'))
  784. return self
  785. def xml_labels(self):
  786. '''Serialise labels
  787. :rtype: lxml.etree._Element
  788. '''
  789. labels = lxml.etree.Element('labels')
  790. for label in sorted(self.labels.values(), key=lambda labl: labl.index):
  791. labels.append(label.__xml__())
  792. return labels
  793. @staticmethod
  794. def get_vm_class(clsname):
  795. '''Find the class for a domain.
  796. Classes are registered as setuptools' entry points in ``qubes.vm``
  797. group. Any package may supply their own classes.
  798. :param str clsname: name of the class
  799. :return type: class
  800. '''
  801. try:
  802. return qubes.utils.get_entry_point_one(
  803. qubes.vm.VM_ENTRY_POINT, clsname)
  804. except KeyError:
  805. raise qubes.exc.QubesException(
  806. 'no such VM class: {!r}'.format(clsname))
  807. # don't catch TypeError
  808. def add_new_vm(self, cls, qid=None, **kwargs):
  809. '''Add new Virtual Machine to collection
  810. '''
  811. if qid is None:
  812. qid = self.domains.get_new_unused_qid()
  813. if isinstance(cls, str):
  814. cls = self.get_vm_class(cls)
  815. # handle default template; specifically allow template=None (do not
  816. # override it with default template)
  817. if 'template' not in kwargs and hasattr(cls, 'template'):
  818. kwargs['template'] = self.default_template
  819. elif 'template' in kwargs and isinstance(kwargs['template'], str):
  820. kwargs['template'] = self.domains[kwargs['template']]
  821. return self.domains.add(cls(self, None, qid=qid, **kwargs))
  822. def get_label(self, label):
  823. '''Get label as identified by index or name
  824. :throws KeyError: when label is not found
  825. '''
  826. # first search for index, verbatim
  827. try:
  828. return self.labels[label]
  829. except KeyError:
  830. pass
  831. # then search for name
  832. for i in self.labels.values():
  833. if i.name == label:
  834. return i
  835. # last call, if label is a number represented as str, search in indices
  836. try:
  837. return self.labels[int(label)]
  838. except (KeyError, ValueError):
  839. pass
  840. raise KeyError(label)
  841. def add_pool(self, name, **kwargs):
  842. """ Add a storage pool to config."""
  843. if name in self.pools.keys():
  844. raise qubes.exc.QubesException('pool named %s already exists \n' %
  845. name)
  846. kwargs['name'] = name
  847. pool = self._get_pool(**kwargs)
  848. pool.setup()
  849. self.pools[name] = pool
  850. return pool
  851. def remove_pool(self, name):
  852. """ Remove a storage pool from config file. """
  853. try:
  854. pool = self.pools[name]
  855. del self.pools[name]
  856. pool.destroy()
  857. except KeyError:
  858. return
  859. def get_pool(self, pool):
  860. ''' Returns a :py:class:`qubes.storage.Pool` instance '''
  861. if isinstance(pool, qubes.storage.Pool):
  862. return pool
  863. try:
  864. return self.pools[pool]
  865. except KeyError:
  866. raise qubes.exc.QubesException('Unknown storage pool ' + pool)
  867. @staticmethod
  868. def _get_pool(**kwargs):
  869. try:
  870. name = kwargs['name']
  871. assert name, 'Name needs to be an non empty string'
  872. except KeyError:
  873. raise qubes.exc.QubesException('No pool name for pool')
  874. try:
  875. driver = kwargs['driver']
  876. except KeyError:
  877. raise qubes.exc.QubesException('No driver specified for pool ' +
  878. name)
  879. try:
  880. klass = qubes.utils.get_entry_point_one(
  881. qubes.storage.STORAGE_ENTRY_POINT, driver)
  882. del kwargs['driver']
  883. return klass(**kwargs)
  884. except KeyError:
  885. raise qubes.exc.QubesException('No driver %s for pool %s' %
  886. (driver, name))
  887. @qubes.events.handler('domain-pre-delete')
  888. def on_domain_pre_deleted(self, event, vm):
  889. # pylint: disable=unused-argument
  890. if isinstance(vm, qubes.vm.templatevm.TemplateVM):
  891. appvms = self.domains.get_vms_based_on(vm)
  892. if appvms:
  893. raise qubes.exc.QubesException(
  894. 'Cannot remove template that has dependent AppVMs. '
  895. 'Affected are: {}'.format(', '.join(
  896. appvm.name for appvm in sorted(appvms))))
  897. @qubes.events.handler('domain-delete')
  898. def on_domain_deleted(self, event, vm):
  899. # pylint: disable=unused-argument
  900. for propname in (
  901. 'default_netvm',
  902. 'default_fw_netvm',
  903. 'clockvm',
  904. 'updatevm',
  905. 'default_template',
  906. ):
  907. try:
  908. if getattr(self, propname) == vm:
  909. delattr(self, propname)
  910. except AttributeError:
  911. pass
  912. @qubes.events.handler('property-pre-set:clockvm')
  913. def on_property_pre_set_clockvm(self, event, name, newvalue, oldvalue=None):
  914. # pylint: disable=unused-argument,no-self-use
  915. if newvalue is None:
  916. return
  917. if 'service.clocksync' not in newvalue.features:
  918. newvalue.features['service.clocksync'] = True
  919. @qubes.events.handler('property-set:clockvm')
  920. def on_property_set_clockvm(self, event, name, newvalue, oldvalue=None):
  921. # pylint: disable=unused-argument,no-self-use
  922. if oldvalue and oldvalue.features.get('service.clocksync', False):
  923. del oldvalue.features['service.clocksync']
  924. @qubes.events.handler(
  925. 'property-pre-set:default_netvm',
  926. 'property-pre-set:default_fw_netvm')
  927. def on_property_pre_set_default_netvm(self, event, name, newvalue,
  928. oldvalue=None):
  929. # pylint: disable=unused-argument,invalid-name
  930. if newvalue is not None and oldvalue is not None \
  931. and oldvalue.is_running() and not newvalue.is_running() \
  932. and self.domains.get_vms_connected_to(oldvalue):
  933. raise qubes.exc.QubesVMNotRunningError(newvalue,
  934. 'Cannot change {!r} to domain that '
  935. 'is not running ({!r}).'.format(name, newvalue.name))
  936. @qubes.events.handler('property-set:default_fw_netvm')
  937. def on_property_set_default_fw_netvm(self, event, name, newvalue,
  938. oldvalue=None):
  939. # pylint: disable=unused-argument,invalid-name
  940. for vm in self.domains:
  941. if not vm.provides_network and vm.property_is_default('netvm'):
  942. # fire property-del:netvm as it is responsible for resetting
  943. # netvm to it's default value
  944. vm.fire_event('property-del:netvm',
  945. name='netvm', newvalue=newvalue, oldvalue=oldvalue)
  946. @qubes.events.handler('property-set:default_netvm')
  947. def on_property_set_default_netvm(self, event, name, newvalue,
  948. oldvalue=None):
  949. # pylint: disable=unused-argument
  950. for vm in self.domains:
  951. if hasattr(vm, 'netvm') and vm.property_is_default('netvm'):
  952. # fire property-del:netvm as it is responsible for resetting
  953. # netvm to it's default value
  954. vm.fire_event('property-del:netvm',
  955. name='netvm', oldvalue=oldvalue)