admin.py 53 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501
  1. #
  2. # The Qubes OS Project, https://www.qubes-os.org/
  3. #
  4. # Copyright (C) 2017 Wojtek Porczyk <woju@invisiblethingslab.com>
  5. #
  6. # This library is free software; you can redistribute it and/or
  7. # modify it under the terms of the GNU Lesser General Public
  8. # License as published by the Free Software Foundation; either
  9. # version 2.1 of the License, or (at your option) any later version.
  10. #
  11. # This library is distributed in the hope that it will be useful,
  12. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  13. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14. # Lesser General Public License for more details.
  15. #
  16. # You should have received a copy of the GNU Lesser General Public
  17. # License along with this library; if not, see <https://www.gnu.org/licenses/>.
  18. #
  19. '''
  20. Qubes OS Management API
  21. '''
  22. import asyncio
  23. import functools
  24. import itertools
  25. import os
  26. import string
  27. import subprocess
  28. import libvirt
  29. import pkg_resources
  30. import yaml
  31. import qubes.api
  32. import qubes.backup
  33. import qubes.config
  34. import qubes.devices
  35. import qubes.firewall
  36. import qubes.storage
  37. import qubes.utils
  38. import qubes.vm
  39. import qubes.vm.adminvm
  40. import qubes.vm.qubesvm
  41. class QubesMgmtEventsDispatcher(object):
  42. def __init__(self, filters, send_event):
  43. self.filters = filters
  44. self.send_event = send_event
  45. def vm_handler(self, subject, event, **kwargs):
  46. # do not send internal events
  47. if event.startswith('admin-permission:'):
  48. return
  49. if event.startswith('device-get:'):
  50. return
  51. if event.startswith('device-list:'):
  52. return
  53. if event.startswith('device-list-attached:'):
  54. return
  55. if event in ('domain-is-fully-usable',):
  56. return
  57. if not list(qubes.api.apply_filters([(subject, event, kwargs)],
  58. self.filters)):
  59. return
  60. self.send_event(subject, event, **kwargs)
  61. def app_handler(self, subject, event, **kwargs):
  62. if not list(qubes.api.apply_filters([(subject, event, kwargs)],
  63. self.filters)):
  64. return
  65. self.send_event(subject, event, **kwargs)
  66. def on_domain_add(self, subject, event, vm):
  67. # pylint: disable=unused-argument
  68. vm.add_handler('*', self.vm_handler)
  69. def on_domain_delete(self, subject, event, vm):
  70. # pylint: disable=unused-argument
  71. vm.remove_handler('*', self.vm_handler)
  72. class QubesAdminAPI(qubes.api.AbstractQubesAPI):
  73. '''Implementation of Qubes Management API calls
  74. This class contains all the methods available in the main API.
  75. .. seealso::
  76. https://www.qubes-os.org/doc/mgmt1/
  77. '''
  78. SOCKNAME = '/var/run/qubesd.sock'
  79. @qubes.api.method('admin.vmclass.List', no_payload=True,
  80. scope='global', read=True)
  81. @asyncio.coroutine
  82. def vmclass_list(self):
  83. '''List all VM classes'''
  84. assert not self.arg
  85. assert self.dest.name == 'dom0'
  86. entrypoints = self.fire_event_for_filter(
  87. pkg_resources.iter_entry_points(qubes.vm.VM_ENTRY_POINT))
  88. return ''.join('{}\n'.format(ep.name)
  89. for ep in entrypoints)
  90. @qubes.api.method('admin.vm.List', no_payload=True,
  91. scope='global', read=True)
  92. @asyncio.coroutine
  93. def vm_list(self):
  94. '''List all the domains'''
  95. assert not self.arg
  96. if self.dest.name == 'dom0':
  97. domains = self.fire_event_for_filter(self.app.domains)
  98. else:
  99. domains = self.fire_event_for_filter([self.dest])
  100. return ''.join('{} class={} state={}\n'.format(
  101. vm.name,
  102. vm.__class__.__name__,
  103. vm.get_power_state())
  104. for vm in sorted(domains))
  105. @qubes.api.method('admin.vm.property.List', no_payload=True,
  106. scope='local', read=True)
  107. @asyncio.coroutine
  108. def vm_property_list(self):
  109. '''List all properties on a qube'''
  110. return self._property_list(self.dest)
  111. @qubes.api.method('admin.property.List', no_payload=True,
  112. scope='global', read=True)
  113. @asyncio.coroutine
  114. def property_list(self):
  115. '''List all global properties'''
  116. assert self.dest.name == 'dom0'
  117. return self._property_list(self.app)
  118. def _property_list(self, dest):
  119. assert not self.arg
  120. properties = self.fire_event_for_filter(dest.property_list())
  121. return ''.join('{}\n'.format(prop.__name__) for prop in properties)
  122. @qubes.api.method('admin.vm.property.Get', no_payload=True,
  123. scope='local', read=True)
  124. @asyncio.coroutine
  125. def vm_property_get(self):
  126. '''Get a value of one property'''
  127. return self._property_get(self.dest)
  128. @qubes.api.method('admin.property.Get', no_payload=True,
  129. scope='global', read=True)
  130. @asyncio.coroutine
  131. def property_get(self):
  132. '''Get a value of one global property'''
  133. assert self.dest.name == 'dom0'
  134. return self._property_get(self.app)
  135. def _property_get(self, dest):
  136. if self.arg not in dest.property_list():
  137. raise qubes.exc.QubesNoSuchPropertyError(dest, self.arg)
  138. self.fire_event_for_permission()
  139. property_def = dest.property_get_def(self.arg)
  140. # explicit list to be sure that it matches protocol spec
  141. if isinstance(property_def, qubes.vm.VMProperty):
  142. property_type = 'vm'
  143. elif property_def.type is int:
  144. property_type = 'int'
  145. elif property_def.type is bool:
  146. property_type = 'bool'
  147. elif self.arg == 'label':
  148. property_type = 'label'
  149. else:
  150. property_type = 'str'
  151. try:
  152. value = getattr(dest, self.arg)
  153. except AttributeError:
  154. return 'default=True type={} '.format(property_type)
  155. else:
  156. return 'default={} type={} {}'.format(
  157. str(dest.property_is_default(self.arg)),
  158. property_type,
  159. str(value) if value is not None else '')
  160. @qubes.api.method('admin.vm.property.GetDefault', no_payload=True,
  161. scope='local', read=True)
  162. @asyncio.coroutine
  163. def vm_property_get_default(self):
  164. '''Get a value of one property'''
  165. return self._property_get_default(self.dest)
  166. @qubes.api.method('admin.property.GetDefault', no_payload=True,
  167. scope='global', read=True)
  168. @asyncio.coroutine
  169. def property_get_default(self):
  170. '''Get a value of one global property'''
  171. assert self.dest.name == 'dom0'
  172. return self._property_get_default(self.app)
  173. def _property_get_default(self, dest):
  174. if self.arg not in dest.property_list():
  175. raise qubes.exc.QubesNoSuchPropertyError(dest, self.arg)
  176. self.fire_event_for_permission()
  177. property_def = dest.property_get_def(self.arg)
  178. # explicit list to be sure that it matches protocol spec
  179. if isinstance(property_def, qubes.vm.VMProperty):
  180. property_type = 'vm'
  181. elif property_def.type is int:
  182. property_type = 'int'
  183. elif property_def.type is bool:
  184. property_type = 'bool'
  185. elif self.arg == 'label':
  186. property_type = 'label'
  187. else:
  188. property_type = 'str'
  189. try:
  190. value = property_def.get_default(dest)
  191. except AttributeError:
  192. return None
  193. else:
  194. return 'type={} {}'.format(
  195. property_type,
  196. str(value) if value is not None else '')
  197. @qubes.api.method('admin.vm.property.Set',
  198. scope='local', write=True)
  199. @asyncio.coroutine
  200. def vm_property_set(self, untrusted_payload):
  201. '''Set property value'''
  202. return self._property_set(self.dest,
  203. untrusted_payload=untrusted_payload)
  204. @qubes.api.method('admin.property.Set',
  205. scope='global', write=True)
  206. @asyncio.coroutine
  207. def property_set(self, untrusted_payload):
  208. '''Set property value'''
  209. assert self.dest.name == 'dom0'
  210. return self._property_set(self.app,
  211. untrusted_payload=untrusted_payload)
  212. def _property_set(self, dest, untrusted_payload):
  213. if self.arg not in dest.property_list():
  214. raise qubes.exc.QubesNoSuchPropertyError(dest, self.arg)
  215. property_def = dest.property_get_def(self.arg)
  216. newvalue = property_def.sanitize(untrusted_newvalue=untrusted_payload)
  217. self.fire_event_for_permission(newvalue=newvalue)
  218. setattr(dest, self.arg, newvalue)
  219. self.app.save()
  220. @qubes.api.method('admin.vm.property.Help', no_payload=True,
  221. scope='local', read=True)
  222. @asyncio.coroutine
  223. def vm_property_help(self):
  224. '''Get help for one property'''
  225. return self._property_help(self.dest)
  226. @qubes.api.method('admin.property.Help', no_payload=True,
  227. scope='global', read=True)
  228. @asyncio.coroutine
  229. def property_help(self):
  230. '''Get help for one property'''
  231. assert self.dest.name == 'dom0'
  232. return self._property_help(self.app)
  233. def _property_help(self, dest):
  234. if self.arg not in dest.property_list():
  235. raise qubes.exc.QubesNoSuchPropertyError(dest, self.arg)
  236. self.fire_event_for_permission()
  237. try:
  238. doc = dest.property_get_def(self.arg).__doc__
  239. except AttributeError:
  240. return ''
  241. return qubes.utils.format_doc(doc)
  242. @qubes.api.method('admin.vm.property.Reset', no_payload=True,
  243. scope='local', write=True)
  244. @asyncio.coroutine
  245. def vm_property_reset(self):
  246. '''Reset a property to a default value'''
  247. return self._property_reset(self.dest)
  248. @qubes.api.method('admin.property.Reset', no_payload=True,
  249. scope='global', write=True)
  250. @asyncio.coroutine
  251. def property_reset(self):
  252. '''Reset a property to a default value'''
  253. assert self.dest.name == 'dom0'
  254. return self._property_reset(self.app)
  255. def _property_reset(self, dest):
  256. if self.arg not in dest.property_list():
  257. raise qubes.exc.QubesNoSuchPropertyError(dest, self.arg)
  258. self.fire_event_for_permission()
  259. delattr(dest, self.arg)
  260. self.app.save()
  261. @qubes.api.method('admin.vm.volume.List', no_payload=True,
  262. scope='local', read=True)
  263. @asyncio.coroutine
  264. def vm_volume_list(self):
  265. assert not self.arg
  266. volume_names = self.fire_event_for_filter(self.dest.volumes.keys())
  267. return ''.join('{}\n'.format(name) for name in volume_names)
  268. @qubes.api.method('admin.vm.volume.Info', no_payload=True,
  269. scope='local', read=True)
  270. @asyncio.coroutine
  271. def vm_volume_info(self):
  272. assert self.arg in self.dest.volumes.keys()
  273. self.fire_event_for_permission()
  274. volume = self.dest.volumes[self.arg]
  275. # properties defined in API
  276. volume_properties = [
  277. 'pool', 'vid', 'size', 'usage', 'rw', 'source',
  278. 'save_on_stop', 'snap_on_start']
  279. return ''.join('{}={}\n'.format(key, getattr(volume, key)) for key in
  280. volume_properties)
  281. @qubes.api.method('admin.vm.volume.ListSnapshots', no_payload=True,
  282. scope='local', read=True)
  283. @asyncio.coroutine
  284. def vm_volume_listsnapshots(self):
  285. assert self.arg in self.dest.volumes.keys()
  286. volume = self.dest.volumes[self.arg]
  287. revisions = [revision for revision in volume.revisions]
  288. revisions = self.fire_event_for_filter(revisions)
  289. return ''.join('{}\n'.format(revision) for revision in revisions)
  290. @qubes.api.method('admin.vm.volume.Revert',
  291. scope='local', write=True)
  292. @asyncio.coroutine
  293. def vm_volume_revert(self, untrusted_payload):
  294. assert self.arg in self.dest.volumes.keys()
  295. untrusted_revision = untrusted_payload.decode('ascii').strip()
  296. del untrusted_payload
  297. volume = self.dest.volumes[self.arg]
  298. snapshots = volume.revisions
  299. assert untrusted_revision in snapshots
  300. revision = untrusted_revision
  301. self.fire_event_for_permission(volume=volume, revision=revision)
  302. ret = volume.revert(revision)
  303. if asyncio.iscoroutine(ret):
  304. yield from ret
  305. self.app.save()
  306. # write=True because this allow to clone VM - and most likely modify that
  307. # one - still having the same data
  308. @qubes.api.method('admin.vm.volume.CloneFrom', no_payload=True,
  309. scope='local', write=True)
  310. @asyncio.coroutine
  311. def vm_volume_clone_from(self):
  312. assert self.arg in self.dest.volumes.keys()
  313. volume = self.dest.volumes[self.arg]
  314. self.fire_event_for_permission(volume=volume)
  315. token = qubes.utils.random_string(32)
  316. # save token on self.app, as self is not persistent
  317. if not hasattr(self.app, 'api_admin_pending_clone'):
  318. self.app.api_admin_pending_clone = {}
  319. # don't handle collisions any better - if someone is so much out of
  320. # luck, can try again anyway
  321. assert token not in self.app.api_admin_pending_clone
  322. self.app.api_admin_pending_clone[token] = volume
  323. return token
  324. @qubes.api.method('admin.vm.volume.CloneTo',
  325. scope='local', write=True)
  326. @asyncio.coroutine
  327. def vm_volume_clone_to(self, untrusted_payload):
  328. assert self.arg in self.dest.volumes.keys()
  329. untrusted_token = untrusted_payload.decode('ascii').strip()
  330. del untrusted_payload
  331. assert untrusted_token in getattr(self.app,
  332. 'api_admin_pending_clone', {})
  333. token = untrusted_token
  334. del untrusted_token
  335. src_volume = self.app.api_admin_pending_clone[token]
  336. del self.app.api_admin_pending_clone[token]
  337. # make sure the volume still exists, but invalidate token anyway
  338. assert str(src_volume.pool) in self.app.pools
  339. assert src_volume in self.app.pools[str(src_volume.pool)].volumes
  340. dst_volume = self.dest.volumes[self.arg]
  341. self.fire_event_for_permission(src_volume=src_volume,
  342. dst_volume=dst_volume)
  343. op_retval = dst_volume.import_volume(src_volume)
  344. # clone/import functions may be either synchronous or asynchronous
  345. # in the later case, we need to wait for them to finish
  346. if asyncio.iscoroutine(op_retval):
  347. op_retval = yield from op_retval
  348. self.dest.volumes[self.arg] = op_retval
  349. self.app.save()
  350. @qubes.api.method('admin.vm.volume.Resize',
  351. scope='local', write=True)
  352. @asyncio.coroutine
  353. def vm_volume_resize(self, untrusted_payload):
  354. assert self.arg in self.dest.volumes.keys()
  355. untrusted_size = untrusted_payload.decode('ascii').strip()
  356. del untrusted_payload
  357. assert untrusted_size.isdigit() # only digits, forbid '-' too
  358. assert len(untrusted_size) <= 20 # limit to about 2^64
  359. size = int(untrusted_size)
  360. self.fire_event_for_permission(size=size)
  361. yield from self.dest.storage.resize(self.arg, size)
  362. self.app.save()
  363. @qubes.api.method('admin.vm.volume.Import', no_payload=True,
  364. scope='local', write=True)
  365. @asyncio.coroutine
  366. def vm_volume_import(self):
  367. '''Import volume data.
  368. Note that this function only returns a path to where data should be
  369. written, actual importing is done by a script in /etc/qubes-rpc
  370. When the script finish importing, it will trigger
  371. internal.vm.volume.ImportEnd (with either b'ok' or b'fail' as a
  372. payload) and response from that call will be actually send to the
  373. caller.
  374. '''
  375. assert self.arg in self.dest.volumes.keys()
  376. self.fire_event_for_permission()
  377. if not self.dest.is_halted():
  378. raise qubes.exc.QubesVMNotHaltedError(self.dest)
  379. path = self.dest.storage.import_data(self.arg)
  380. assert ' ' not in path
  381. size = self.dest.volumes[self.arg].size
  382. # when we know the action is allowed, inform extensions that it will
  383. # be performed
  384. self.dest.fire_event('domain-volume-import-begin', volume=self.arg)
  385. return '{} {}'.format(size, path)
  386. @qubes.api.method('admin.vm.volume.Set.revisions_to_keep',
  387. scope='local', write=True)
  388. @asyncio.coroutine
  389. def vm_volume_set_revisions_to_keep(self, untrusted_payload):
  390. assert self.arg in self.dest.volumes.keys()
  391. try:
  392. untrusted_value = int(untrusted_payload.decode('ascii'))
  393. except (UnicodeDecodeError, ValueError):
  394. raise qubes.api.ProtocolError('Invalid value')
  395. del untrusted_payload
  396. assert untrusted_value >= 0
  397. newvalue = untrusted_value
  398. del untrusted_value
  399. self.fire_event_for_permission(newvalue=newvalue)
  400. self.dest.volumes[self.arg].revisions_to_keep = newvalue
  401. self.app.save()
  402. @qubes.api.method('admin.vm.tag.List', no_payload=True,
  403. scope='local', read=True)
  404. @asyncio.coroutine
  405. def vm_tag_list(self):
  406. assert not self.arg
  407. tags = self.dest.tags
  408. tags = self.fire_event_for_filter(tags)
  409. return ''.join('{}\n'.format(tag) for tag in sorted(tags))
  410. @qubes.api.method('admin.vm.tag.Get', no_payload=True,
  411. scope='local', read=True)
  412. @asyncio.coroutine
  413. def vm_tag_get(self):
  414. qubes.vm.Tags.validate_tag(self.arg)
  415. self.fire_event_for_permission()
  416. return '1' if self.arg in self.dest.tags else '0'
  417. @qubes.api.method('admin.vm.tag.Set', no_payload=True,
  418. scope='local', write=True)
  419. @asyncio.coroutine
  420. def vm_tag_set(self):
  421. qubes.vm.Tags.validate_tag(self.arg)
  422. self.fire_event_for_permission()
  423. self.dest.tags.add(self.arg)
  424. self.app.save()
  425. @qubes.api.method('admin.vm.tag.Remove', no_payload=True,
  426. scope='local', write=True)
  427. @asyncio.coroutine
  428. def vm_tag_remove(self):
  429. qubes.vm.Tags.validate_tag(self.arg)
  430. self.fire_event_for_permission()
  431. try:
  432. self.dest.tags.remove(self.arg)
  433. except KeyError:
  434. raise qubes.exc.QubesTagNotFoundError(self.dest, self.arg)
  435. self.app.save()
  436. @qubes.api.method('admin.pool.List', no_payload=True,
  437. scope='global', read=True)
  438. @asyncio.coroutine
  439. def pool_list(self):
  440. assert not self.arg
  441. assert self.dest.name == 'dom0'
  442. pools = self.fire_event_for_filter(self.app.pools)
  443. return ''.join('{}\n'.format(pool) for pool in pools)
  444. @qubes.api.method('admin.pool.ListDrivers', no_payload=True,
  445. scope='global', read=True)
  446. @asyncio.coroutine
  447. def pool_listdrivers(self):
  448. assert self.dest.name == 'dom0'
  449. assert not self.arg
  450. drivers = self.fire_event_for_filter(qubes.storage.pool_drivers())
  451. return ''.join('{} {}\n'.format(
  452. driver,
  453. ' '.join(qubes.storage.driver_parameters(driver)))
  454. for driver in drivers)
  455. @qubes.api.method('admin.pool.Info', no_payload=True,
  456. scope='global', read=True)
  457. @asyncio.coroutine
  458. def pool_info(self):
  459. assert self.dest.name == 'dom0'
  460. assert self.arg in self.app.pools.keys()
  461. pool = self.app.pools[self.arg]
  462. self.fire_event_for_permission(pool=pool)
  463. size_info = ''
  464. try:
  465. size_info += 'size={}\n'.format(pool.size)
  466. except NotImplementedError:
  467. pass
  468. try:
  469. size_info += 'usage={}\n'.format(pool.usage)
  470. except NotImplementedError:
  471. pass
  472. return ''.join('{}={}\n'.format(prop, val)
  473. for prop, val in sorted(pool.config.items())) + \
  474. size_info
  475. @qubes.api.method('admin.pool.Add',
  476. scope='global', write=True)
  477. @asyncio.coroutine
  478. def pool_add(self, untrusted_payload):
  479. assert self.dest.name == 'dom0'
  480. drivers = qubes.storage.pool_drivers()
  481. assert self.arg in drivers
  482. untrusted_pool_config = untrusted_payload.decode('ascii').splitlines()
  483. del untrusted_payload
  484. assert all(('=' in line) for line in untrusted_pool_config)
  485. # pairs of (option, value)
  486. untrusted_pool_config = [line.split('=', 1)
  487. for line in untrusted_pool_config]
  488. # reject duplicated options
  489. assert len(set(x[0] for x in untrusted_pool_config)) == \
  490. len([x[0] for x in untrusted_pool_config])
  491. # and convert to dict
  492. untrusted_pool_config = dict(untrusted_pool_config)
  493. assert 'name' in untrusted_pool_config
  494. untrusted_pool_name = untrusted_pool_config.pop('name')
  495. allowed_chars = string.ascii_letters + string.digits + '-_.'
  496. assert all(c in allowed_chars for c in untrusted_pool_name)
  497. pool_name = untrusted_pool_name
  498. assert pool_name not in self.app.pools
  499. driver_parameters = qubes.storage.driver_parameters(self.arg)
  500. assert all(key in driver_parameters for key in untrusted_pool_config)
  501. pool_config = untrusted_pool_config
  502. self.fire_event_for_permission(name=pool_name,
  503. pool_config=pool_config)
  504. self.app.add_pool(name=pool_name, driver=self.arg, **pool_config)
  505. self.app.save()
  506. @qubes.api.method('admin.pool.Remove', no_payload=True,
  507. scope='global', write=True)
  508. @asyncio.coroutine
  509. def pool_remove(self):
  510. assert self.dest.name == 'dom0'
  511. assert self.arg in self.app.pools.keys()
  512. self.fire_event_for_permission()
  513. self.app.remove_pool(self.arg)
  514. self.app.save()
  515. @qubes.api.method('admin.pool.Set.revisions_to_keep',
  516. scope='global', write=True)
  517. @asyncio.coroutine
  518. def pool_set_revisions_to_keep(self, untrusted_payload):
  519. assert self.dest.name == 'dom0'
  520. assert self.arg in self.app.pools.keys()
  521. pool = self.app.pools[self.arg]
  522. try:
  523. untrusted_value = int(untrusted_payload.decode('ascii'))
  524. except (UnicodeDecodeError, ValueError):
  525. raise qubes.api.ProtocolError('Invalid value')
  526. del untrusted_payload
  527. assert untrusted_value >= 0
  528. newvalue = untrusted_value
  529. del untrusted_value
  530. self.fire_event_for_permission(newvalue=newvalue)
  531. pool.revisions_to_keep = newvalue
  532. self.app.save()
  533. @qubes.api.method('admin.label.List', no_payload=True,
  534. scope='global', read=True)
  535. @asyncio.coroutine
  536. def label_list(self):
  537. assert self.dest.name == 'dom0'
  538. assert not self.arg
  539. labels = self.fire_event_for_filter(self.app.labels.values())
  540. return ''.join('{}\n'.format(label.name) for label in labels)
  541. @qubes.api.method('admin.label.Get', no_payload=True,
  542. scope='global', read=True)
  543. @asyncio.coroutine
  544. def label_get(self):
  545. assert self.dest.name == 'dom0'
  546. try:
  547. label = self.app.get_label(self.arg)
  548. except KeyError:
  549. raise qubes.exc.QubesValueError
  550. self.fire_event_for_permission(label=label)
  551. return label.color
  552. @qubes.api.method('admin.label.Index', no_payload=True,
  553. scope='global', read=True)
  554. @asyncio.coroutine
  555. def label_index(self):
  556. assert self.dest.name == 'dom0'
  557. try:
  558. label = self.app.get_label(self.arg)
  559. except KeyError:
  560. raise qubes.exc.QubesValueError
  561. self.fire_event_for_permission(label=label)
  562. return str(label.index)
  563. @qubes.api.method('admin.label.Create',
  564. scope='global', write=True)
  565. @asyncio.coroutine
  566. def label_create(self, untrusted_payload):
  567. assert self.dest.name == 'dom0'
  568. # don't confuse label name with label index
  569. assert not self.arg.isdigit()
  570. allowed_chars = string.ascii_letters + string.digits + '-_.'
  571. assert all(c in allowed_chars for c in self.arg)
  572. try:
  573. self.app.get_label(self.arg)
  574. except KeyError:
  575. # ok, no such label yet
  576. pass
  577. else:
  578. raise qubes.exc.QubesValueError('label already exists')
  579. untrusted_payload = untrusted_payload.decode('ascii').strip()
  580. assert len(untrusted_payload) == 8
  581. assert untrusted_payload.startswith('0x')
  582. # besides prefix, only hex digits are allowed
  583. assert all(x in string.hexdigits for x in untrusted_payload[2:])
  584. # SEE: #2732
  585. color = untrusted_payload
  586. self.fire_event_for_permission(color=color)
  587. # allocate new index, but make sure it's outside of default labels set
  588. new_index = max(
  589. qubes.config.max_default_label, *self.app.labels.keys()) + 1
  590. label = qubes.Label(new_index, color, self.arg)
  591. self.app.labels[new_index] = label
  592. self.app.save()
  593. @qubes.api.method('admin.label.Remove', no_payload=True,
  594. scope='global', write=True)
  595. @asyncio.coroutine
  596. def label_remove(self):
  597. assert self.dest.name == 'dom0'
  598. try:
  599. label = self.app.get_label(self.arg)
  600. except KeyError:
  601. raise qubes.exc.QubesValueError
  602. # don't allow removing default labels
  603. assert label.index > qubes.config.max_default_label
  604. # FIXME: this should be in app.add_label()
  605. for vm in self.app.domains:
  606. if vm.label == label:
  607. raise qubes.exc.QubesException('label still in use')
  608. self.fire_event_for_permission(label=label)
  609. del self.app.labels[label.index]
  610. self.app.save()
  611. @qubes.api.method('admin.vm.Start', no_payload=True,
  612. scope='local', execute=True)
  613. @asyncio.coroutine
  614. def vm_start(self):
  615. assert not self.arg
  616. self.fire_event_for_permission()
  617. try:
  618. yield from self.dest.start()
  619. except libvirt.libvirtError as e:
  620. # change to QubesException, so will be reported to the user
  621. raise qubes.exc.QubesException('Start failed: ' + str(e))
  622. @qubes.api.method('admin.vm.Shutdown', no_payload=True,
  623. scope='local', execute=True)
  624. @asyncio.coroutine
  625. def vm_shutdown(self):
  626. assert not self.arg
  627. self.fire_event_for_permission()
  628. yield from self.dest.shutdown()
  629. @qubes.api.method('admin.vm.Pause', no_payload=True,
  630. scope='local', execute=True)
  631. @asyncio.coroutine
  632. def vm_pause(self):
  633. assert not self.arg
  634. self.fire_event_for_permission()
  635. yield from self.dest.pause()
  636. @qubes.api.method('admin.vm.Unpause', no_payload=True,
  637. scope='local', execute=True)
  638. @asyncio.coroutine
  639. def vm_unpause(self):
  640. assert not self.arg
  641. self.fire_event_for_permission()
  642. yield from self.dest.unpause()
  643. @qubes.api.method('admin.vm.Kill', no_payload=True,
  644. scope='local', execute=True)
  645. @asyncio.coroutine
  646. def vm_kill(self):
  647. assert not self.arg
  648. self.fire_event_for_permission()
  649. yield from self.dest.kill()
  650. @qubes.api.method('admin.Events', no_payload=True,
  651. scope='global', read=True)
  652. @asyncio.coroutine
  653. def events(self):
  654. assert not self.arg
  655. # run until client connection is terminated
  656. self.cancellable = True
  657. wait_for_cancel = asyncio.get_event_loop().create_future()
  658. # cache event filters, to not call an event each time an event arrives
  659. event_filters = self.fire_event_for_permission()
  660. dispatcher = QubesMgmtEventsDispatcher(event_filters, self.send_event)
  661. if self.dest.name == 'dom0':
  662. self.app.add_handler('*', dispatcher.app_handler)
  663. self.app.add_handler('domain-add', dispatcher.on_domain_add)
  664. self.app.add_handler('domain-delete', dispatcher.on_domain_delete)
  665. for vm in self.app.domains:
  666. vm.add_handler('*', dispatcher.vm_handler)
  667. else:
  668. self.dest.add_handler('*', dispatcher.vm_handler)
  669. # send artificial event as a confirmation that connection is established
  670. self.send_event(self.app, 'connection-established')
  671. try:
  672. yield from wait_for_cancel
  673. except asyncio.CancelledError:
  674. # the above waiting was already interrupted, this is all we need
  675. pass
  676. if self.dest.name == 'dom0':
  677. self.app.remove_handler('*', dispatcher.app_handler)
  678. self.app.remove_handler('domain-add', dispatcher.on_domain_add)
  679. self.app.remove_handler('domain-delete',
  680. dispatcher.on_domain_delete)
  681. for vm in self.app.domains:
  682. vm.remove_handler('*', dispatcher.vm_handler)
  683. else:
  684. self.dest.remove_handler('*', dispatcher.vm_handler)
  685. @qubes.api.method('admin.vm.feature.List', no_payload=True,
  686. scope='local', read=True)
  687. @asyncio.coroutine
  688. def vm_feature_list(self):
  689. assert not self.arg
  690. features = self.fire_event_for_filter(self.dest.features.keys())
  691. return ''.join('{}\n'.format(feature) for feature in features)
  692. @qubes.api.method('admin.vm.feature.Get', no_payload=True,
  693. scope='local', read=True)
  694. @asyncio.coroutine
  695. def vm_feature_get(self):
  696. # validation of self.arg done by qrexec-policy is enough
  697. self.fire_event_for_permission()
  698. try:
  699. value = self.dest.features[self.arg]
  700. except KeyError:
  701. raise qubes.exc.QubesFeatureNotFoundError(self.dest, self.arg)
  702. return value
  703. @qubes.api.method('admin.vm.feature.CheckWithTemplate', no_payload=True,
  704. scope='local', read=True)
  705. @asyncio.coroutine
  706. def vm_feature_checkwithtemplate(self):
  707. # validation of self.arg done by qrexec-policy is enough
  708. self.fire_event_for_permission()
  709. try:
  710. value = self.dest.features.check_with_template(self.arg)
  711. except KeyError:
  712. raise qubes.exc.QubesFeatureNotFoundError(self.dest, self.arg)
  713. return value
  714. @qubes.api.method('admin.vm.feature.CheckWithNetvm', no_payload=True,
  715. scope='local', read=True)
  716. @asyncio.coroutine
  717. def vm_feature_checkwithnetvm(self):
  718. # validation of self.arg done by qrexec-policy is enough
  719. self.fire_event_for_permission()
  720. try:
  721. value = self.dest.features.check_with_netvm(self.arg)
  722. except KeyError:
  723. raise qubes.exc.QubesFeatureNotFoundError(self.dest, self.arg)
  724. return value
  725. @qubes.api.method('admin.vm.feature.Remove', no_payload=True,
  726. scope='local', write=True)
  727. @asyncio.coroutine
  728. def vm_feature_remove(self):
  729. # validation of self.arg done by qrexec-policy is enough
  730. self.fire_event_for_permission()
  731. try:
  732. del self.dest.features[self.arg]
  733. except KeyError:
  734. raise qubes.exc.QubesFeatureNotFoundError(self.dest, self.arg)
  735. self.app.save()
  736. @qubes.api.method('admin.vm.feature.Set',
  737. scope='local', write=True)
  738. @asyncio.coroutine
  739. def vm_feature_set(self, untrusted_payload):
  740. # validation of self.arg done by qrexec-policy is enough
  741. value = untrusted_payload.decode('ascii', errors='strict')
  742. del untrusted_payload
  743. self.fire_event_for_permission(value=value)
  744. self.dest.features[self.arg] = value
  745. self.app.save()
  746. @qubes.api.method('admin.vm.Create.{endpoint}', endpoints=(ep.name
  747. for ep in pkg_resources.iter_entry_points(qubes.vm.VM_ENTRY_POINT)),
  748. scope='global', write=True)
  749. @asyncio.coroutine
  750. def vm_create(self, endpoint, untrusted_payload=None):
  751. return self._vm_create(endpoint, allow_pool=False,
  752. untrusted_payload=untrusted_payload)
  753. @qubes.api.method('admin.vm.CreateInPool.{endpoint}', endpoints=(ep.name
  754. for ep in pkg_resources.iter_entry_points(qubes.vm.VM_ENTRY_POINT)),
  755. scope='global', write=True)
  756. @asyncio.coroutine
  757. def vm_create_in_pool(self, endpoint, untrusted_payload=None):
  758. return self._vm_create(endpoint, allow_pool=True,
  759. untrusted_payload=untrusted_payload)
  760. def _vm_create(self, vm_type, allow_pool=False, untrusted_payload=None):
  761. assert self.dest.name == 'dom0'
  762. kwargs = {}
  763. pool = None
  764. pools = {}
  765. # this will raise exception if none is found
  766. vm_class = qubes.utils.get_entry_point_one(qubes.vm.VM_ENTRY_POINT,
  767. vm_type)
  768. # if argument is given, it needs to be a valid template, and only
  769. # when given VM class do need a template
  770. if hasattr(vm_class, 'template'):
  771. if self.arg:
  772. assert self.arg in self.app.domains
  773. kwargs['template'] = self.app.domains[self.arg]
  774. else:
  775. assert not self.arg
  776. for untrusted_param in untrusted_payload.decode('ascii',
  777. errors='strict').split(' '):
  778. untrusted_key, untrusted_value = untrusted_param.split('=', 1)
  779. if untrusted_key in kwargs:
  780. raise qubes.api.ProtocolError('duplicated parameters')
  781. if untrusted_key == 'name':
  782. qubes.vm.validate_name(None, None, untrusted_value)
  783. kwargs['name'] = untrusted_value
  784. elif untrusted_key == 'label':
  785. # don't confuse label name with label index
  786. assert not untrusted_value.isdigit()
  787. allowed_chars = string.ascii_letters + string.digits + '-_.'
  788. assert all(c in allowed_chars for c in untrusted_value)
  789. try:
  790. kwargs['label'] = self.app.get_label(untrusted_value)
  791. except KeyError:
  792. raise qubes.exc.QubesValueError
  793. elif untrusted_key == 'pool' and allow_pool:
  794. if pool is not None:
  795. raise qubes.api.ProtocolError('duplicated pool parameter')
  796. pool = self.app.get_pool(untrusted_value)
  797. elif untrusted_key.startswith('pool:') and allow_pool:
  798. untrusted_volume = untrusted_key.split(':', 1)[1]
  799. # kind of ugly, but actual list of volumes is available only
  800. # after creating a VM
  801. assert untrusted_volume in ['root', 'private', 'volatile',
  802. 'kernel']
  803. volume = untrusted_volume
  804. if volume in pools:
  805. raise qubes.api.ProtocolError(
  806. 'duplicated pool:{} parameter'.format(volume))
  807. pools[volume] = self.app.get_pool(untrusted_value)
  808. else:
  809. raise qubes.api.ProtocolError('Invalid param name')
  810. del untrusted_payload
  811. if 'name' not in kwargs or 'label' not in kwargs:
  812. raise qubes.api.ProtocolError('Missing name or label')
  813. if pool and pools:
  814. raise qubes.api.ProtocolError(
  815. 'Only one of \'pool=\' and \'pool:volume=\' can be used')
  816. if kwargs['name'] in self.app.domains:
  817. raise qubes.exc.QubesValueError(
  818. 'VM {} already exists'.format(kwargs['name']))
  819. self.fire_event_for_permission(pool=pool, pools=pools, **kwargs)
  820. vm = self.app.add_new_vm(vm_class, **kwargs)
  821. # TODO: move this to extension (in race-free fashion)
  822. vm.tags.add('created-by-' + str(self.src))
  823. try:
  824. yield from vm.create_on_disk(pool=pool, pools=pools)
  825. except:
  826. del self.app.domains[vm]
  827. raise
  828. self.app.save()
  829. @qubes.api.method('admin.vm.CreateDisposable', no_payload=True,
  830. scope='global', write=True)
  831. @asyncio.coroutine
  832. def create_disposable(self):
  833. assert not self.arg
  834. if self.dest.name == 'dom0':
  835. dispvm_template = self.src.default_dispvm
  836. else:
  837. dispvm_template = self.dest
  838. self.fire_event_for_permission(dispvm_template=dispvm_template)
  839. dispvm = yield from qubes.vm.dispvm.DispVM.from_appvm(dispvm_template)
  840. # TODO: move this to extension (in race-free fashion, better than here)
  841. dispvm.tags.add('disp-created-by-' + str(self.src))
  842. return dispvm.name
  843. @qubes.api.method('admin.vm.Remove', no_payload=True,
  844. scope='global', write=True)
  845. @asyncio.coroutine
  846. def vm_remove(self):
  847. assert not self.arg
  848. self.fire_event_for_permission()
  849. if not self.dest.is_halted():
  850. raise qubes.exc.QubesVMNotHaltedError(self.dest)
  851. del self.app.domains[self.dest]
  852. try:
  853. yield from self.dest.remove_from_disk()
  854. except: # pylint: disable=bare-except
  855. self.app.log.exception('Error wile removing VM \'%s\' files',
  856. self.dest.name)
  857. self.app.save()
  858. @qubes.api.method('admin.vm.device.{endpoint}.Available', endpoints=(ep.name
  859. for ep in pkg_resources.iter_entry_points('qubes.devices')),
  860. no_payload=True,
  861. scope='local', read=True)
  862. @asyncio.coroutine
  863. def vm_device_available(self, endpoint):
  864. devclass = endpoint
  865. devices = self.dest.devices[devclass].available()
  866. if self.arg:
  867. devices = [dev for dev in devices if dev.ident == self.arg]
  868. # no duplicated devices, but device may not exists, in which case
  869. # the list is empty
  870. assert len(devices) <= 1
  871. devices = self.fire_event_for_filter(devices, devclass=devclass)
  872. dev_info = {}
  873. for dev in devices:
  874. non_default_attrs = set(attr for attr in dir(dev) if
  875. not attr.startswith('_')).difference((
  876. 'backend_domain', 'ident', 'frontend_domain',
  877. 'description', 'options', 'regex'))
  878. properties_txt = ' '.join(
  879. '{}={!s}'.format(prop, value) for prop, value
  880. in itertools.chain(
  881. ((key, getattr(dev, key)) for key in non_default_attrs),
  882. # keep description as the last one, according to API
  883. # specification
  884. (('description', dev.description),)
  885. ))
  886. assert '\n' not in properties_txt
  887. dev_info[dev.ident] = properties_txt
  888. return ''.join('{} {}\n'.format(ident, dev_info[ident])
  889. for ident in sorted(dev_info))
  890. @qubes.api.method('admin.vm.device.{endpoint}.List', endpoints=(ep.name
  891. for ep in pkg_resources.iter_entry_points('qubes.devices')),
  892. no_payload=True,
  893. scope='local', read=True)
  894. @asyncio.coroutine
  895. def vm_device_list(self, endpoint):
  896. devclass = endpoint
  897. device_assignments = self.dest.devices[devclass].assignments()
  898. if self.arg:
  899. select_backend, select_ident = self.arg.split('+', 1)
  900. device_assignments = [dev for dev in device_assignments
  901. if (str(dev.backend_domain), dev.ident)
  902. == (select_backend, select_ident)]
  903. # no duplicated devices, but device may not exists, in which case
  904. # the list is empty
  905. assert len(device_assignments) <= 1
  906. device_assignments = self.fire_event_for_filter(device_assignments,
  907. devclass=devclass)
  908. dev_info = {}
  909. for dev in device_assignments:
  910. properties_txt = ' '.join(
  911. '{}={!s}'.format(opt, value) for opt, value
  912. in itertools.chain(
  913. dev.options.items(),
  914. (('persistent', 'yes' if dev.persistent else 'no'),)
  915. ))
  916. assert '\n' not in properties_txt
  917. ident = '{!s}+{!s}'.format(dev.backend_domain, dev.ident)
  918. dev_info[ident] = properties_txt
  919. return ''.join('{} {}\n'.format(ident, dev_info[ident])
  920. for ident in sorted(dev_info))
  921. # Attach/Detach action can both modify persistent state (with
  922. # persistent=True) and volatile state of running VM (with persistent=False).
  923. # For this reason, write=True + execute=True
  924. @qubes.api.method('admin.vm.device.{endpoint}.Attach', endpoints=(ep.name
  925. for ep in pkg_resources.iter_entry_points('qubes.devices')),
  926. scope='local', write=True, execute=True)
  927. @asyncio.coroutine
  928. def vm_device_attach(self, endpoint, untrusted_payload):
  929. devclass = endpoint
  930. options = {}
  931. persistent = False
  932. for untrusted_option in untrusted_payload.decode('ascii').split():
  933. try:
  934. untrusted_key, untrusted_value = untrusted_option.split('=', 1)
  935. except ValueError:
  936. raise qubes.api.ProtocolError('Invalid options format')
  937. if untrusted_key == 'persistent':
  938. persistent = qubes.property.bool(None, None, untrusted_value)
  939. else:
  940. allowed_chars_key = string.digits + string.ascii_letters + '-_.'
  941. allowed_chars_value = allowed_chars_key + ',+:'
  942. if any(x not in allowed_chars_key for x in untrusted_key):
  943. raise qubes.api.ProtocolError(
  944. 'Invalid chars in option name')
  945. if any(x not in allowed_chars_value for x in untrusted_value):
  946. raise qubes.api.ProtocolError(
  947. 'Invalid chars in option value')
  948. options[untrusted_key] = untrusted_value
  949. # qrexec already verified that no strange characters are in self.arg
  950. backend_domain, ident = self.arg.split('+', 1)
  951. # may raise KeyError, either on domain or ident
  952. dev = self.app.domains[backend_domain].devices[devclass][ident]
  953. self.fire_event_for_permission(device=dev,
  954. devclass=devclass, persistent=persistent,
  955. options=options)
  956. assignment = qubes.devices.DeviceAssignment(
  957. dev.backend_domain, dev.ident,
  958. options=options, persistent=persistent)
  959. yield from self.dest.devices[devclass].attach(assignment)
  960. self.app.save()
  961. # Attach/Detach action can both modify persistent state (with
  962. # persistent=True) and volatile state of running VM (with persistent=False).
  963. # For this reason, write=True + execute=True
  964. @qubes.api.method('admin.vm.device.{endpoint}.Detach', endpoints=(ep.name
  965. for ep in pkg_resources.iter_entry_points('qubes.devices')),
  966. no_payload=True,
  967. scope='local', write=True, execute=True)
  968. @asyncio.coroutine
  969. def vm_device_detach(self, endpoint):
  970. devclass = endpoint
  971. # qrexec already verified that no strange characters are in self.arg
  972. backend_domain, ident = self.arg.split('+', 1)
  973. # may raise KeyError; if device isn't found, it will be UnknownDevice
  974. # instance - but allow it, otherwise it will be impossible to detach
  975. # already removed device
  976. dev = self.app.domains[backend_domain].devices[devclass][ident]
  977. self.fire_event_for_permission(device=dev,
  978. devclass=devclass)
  979. assignment = qubes.devices.DeviceAssignment(
  980. dev.backend_domain, dev.ident)
  981. yield from self.dest.devices[devclass].detach(assignment)
  982. self.app.save()
  983. # Attach/Detach action can both modify persistent state (with
  984. # persistent=True) and volatile state of running VM (with persistent=False).
  985. # For this reason, write=True + execute=True
  986. @qubes.api.method('admin.vm.device.{endpoint}.Set.persistent',
  987. endpoints=(ep.name
  988. for ep in pkg_resources.iter_entry_points('qubes.devices')),
  989. scope='local', write=True, execute=True)
  990. @asyncio.coroutine
  991. def vm_device_set_persistent(self, endpoint, untrusted_payload):
  992. devclass = endpoint
  993. assert untrusted_payload in (b'True', b'False')
  994. persistent = untrusted_payload == b'True'
  995. del untrusted_payload
  996. # qrexec already verified that no strange characters are in self.arg
  997. backend_domain, ident = self.arg.split('+', 1)
  998. # device must be already attached
  999. matching_devices = [dev for dev
  1000. in self.dest.devices[devclass].attached()
  1001. if dev.backend_domain.name == backend_domain and dev.ident == ident]
  1002. assert len(matching_devices) == 1
  1003. dev = matching_devices[0]
  1004. self.fire_event_for_permission(device=dev,
  1005. persistent=persistent)
  1006. self.dest.devices[devclass].update_persistent(dev, persistent)
  1007. self.app.save()
  1008. @qubes.api.method('admin.vm.firewall.Get', no_payload=True,
  1009. scope='local', read=True)
  1010. @asyncio.coroutine
  1011. def vm_firewall_get(self):
  1012. assert not self.arg
  1013. self.fire_event_for_permission()
  1014. return ''.join('{}\n'.format(rule.api_rule)
  1015. for rule in self.dest.firewall.rules
  1016. if rule.api_rule is not None)
  1017. @qubes.api.method('admin.vm.firewall.Set',
  1018. scope='local', write=True)
  1019. @asyncio.coroutine
  1020. def vm_firewall_set(self, untrusted_payload):
  1021. assert not self.arg
  1022. rules = []
  1023. for untrusted_line in untrusted_payload.decode('ascii',
  1024. errors='strict').splitlines():
  1025. rule = qubes.firewall.Rule.from_api_string(
  1026. untrusted_rule=untrusted_line)
  1027. rules.append(rule)
  1028. self.fire_event_for_permission(rules=rules)
  1029. self.dest.firewall.rules = rules
  1030. self.dest.firewall.save()
  1031. @qubes.api.method('admin.vm.firewall.Reload', no_payload=True,
  1032. scope='local', execute=True)
  1033. @asyncio.coroutine
  1034. def vm_firewall_reload(self):
  1035. assert not self.arg
  1036. self.fire_event_for_permission()
  1037. self.dest.fire_event('firewall-changed')
  1038. @asyncio.coroutine
  1039. def _load_backup_profile(self, profile_name, skip_passphrase=False):
  1040. '''Load backup profile and return :py:class:`qubes.backup.Backup`
  1041. instance
  1042. :param profile_name: name of the profile
  1043. :param skip_passphrase: do not load passphrase - only backup summary
  1044. can be retrieved when this option is in use
  1045. '''
  1046. profile_path = os.path.join(
  1047. qubes.config.backup_profile_dir, profile_name + '.conf')
  1048. with open(profile_path) as profile_file:
  1049. profile_data = yaml.safe_load(profile_file)
  1050. try:
  1051. dest_vm = profile_data['destination_vm']
  1052. dest_path = profile_data['destination_path']
  1053. include_vms = profile_data['include']
  1054. exclude_vms = profile_data.get('exclude', [])
  1055. compression = profile_data.get('compression', True)
  1056. except KeyError as err:
  1057. raise qubes.exc.QubesException(
  1058. 'Invalid backup profile - missing {}'.format(err))
  1059. try:
  1060. dest_vm = self.app.domains[dest_vm]
  1061. except KeyError:
  1062. raise qubes.exc.QubesException(
  1063. 'Invalid destination_vm specified in backup profile')
  1064. if isinstance(dest_vm, qubes.vm.adminvm.AdminVM):
  1065. dest_vm = None
  1066. if skip_passphrase:
  1067. passphrase = None
  1068. elif 'passphrase_text' in profile_data:
  1069. passphrase = profile_data['passphrase_text']
  1070. elif 'passphrase_vm' in profile_data:
  1071. passphrase_vm_name = profile_data['passphrase_vm']
  1072. try:
  1073. passphrase_vm = self.app.domains[passphrase_vm_name]
  1074. except KeyError:
  1075. raise qubes.exc.QubesException(
  1076. 'Invalid backup profile - invalid passphrase_vm')
  1077. try:
  1078. passphrase, _ = yield from passphrase_vm.run_service_for_stdio(
  1079. 'qubes.BackupPassphrase+' + self.arg)
  1080. # make it foolproof against "echo passphrase" implementation
  1081. passphrase = passphrase.strip()
  1082. assert b'\n' not in passphrase
  1083. except subprocess.CalledProcessError:
  1084. raise qubes.exc.QubesException(
  1085. 'Failed to retrieve passphrase from \'{}\' VM'.format(
  1086. passphrase_vm_name))
  1087. else:
  1088. raise qubes.exc.QubesException(
  1089. 'Invalid backup profile - you need to '
  1090. 'specify passphrase_text or passphrase_vm')
  1091. # handle include
  1092. vms_to_backup = set(vm for vm in self.app.domains
  1093. if any(qubes.utils.match_vm_name_with_special(vm, name)
  1094. for name in include_vms))
  1095. # handle exclude
  1096. vms_to_backup.difference_update(vm for vm in self.app.domains
  1097. if any(qubes.utils.match_vm_name_with_special(vm, name)
  1098. for name in exclude_vms))
  1099. kwargs = {
  1100. 'target_vm': dest_vm,
  1101. 'target_dir': dest_path,
  1102. 'compressed': bool(compression),
  1103. 'passphrase': passphrase,
  1104. }
  1105. if isinstance(compression, str):
  1106. kwargs['compression_filter'] = compression
  1107. backup = qubes.backup.Backup(self.app, vms_to_backup, **kwargs)
  1108. return backup
  1109. def _backup_progress_callback(self, profile_name, progress):
  1110. self.app.fire_event('backup-progress', backup_profile=profile_name,
  1111. progress=progress)
  1112. @qubes.api.method('admin.backup.Execute', no_payload=True,
  1113. scope='global', read=True, execute=True)
  1114. @asyncio.coroutine
  1115. def backup_execute(self):
  1116. assert self.dest.name == 'dom0'
  1117. assert self.arg
  1118. assert '/' not in self.arg
  1119. self.fire_event_for_permission()
  1120. profile_path = os.path.join(qubes.config.backup_profile_dir,
  1121. self.arg + '.conf')
  1122. if not os.path.exists(profile_path):
  1123. raise qubes.api.PermissionDenied(
  1124. 'Backup profile {} does not exist'.format(self.arg))
  1125. if not hasattr(self.app, 'api_admin_running_backups'):
  1126. self.app.api_admin_running_backups = {}
  1127. backup = yield from self._load_backup_profile(self.arg)
  1128. backup.progress_callback = functools.partial(
  1129. self._backup_progress_callback, self.arg)
  1130. # forbid running the same backup operation twice at the time
  1131. assert self.arg not in self.app.api_admin_running_backups
  1132. backup_task = asyncio.ensure_future(backup.backup_do())
  1133. self.app.api_admin_running_backups[self.arg] = backup_task
  1134. try:
  1135. yield from backup_task
  1136. except asyncio.CancelledError:
  1137. raise qubes.exc.QubesException('Backup cancelled')
  1138. finally:
  1139. del self.app.api_admin_running_backups[self.arg]
  1140. @qubes.api.method('admin.backup.Cancel', no_payload=True,
  1141. scope='global', execute=True)
  1142. @asyncio.coroutine
  1143. def backup_cancel(self):
  1144. assert self.dest.name == 'dom0'
  1145. assert self.arg
  1146. assert '/' not in self.arg
  1147. self.fire_event_for_permission()
  1148. if not hasattr(self.app, 'api_admin_running_backups'):
  1149. self.app.api_admin_running_backups = {}
  1150. if self.arg not in self.app.api_admin_running_backups:
  1151. raise qubes.exc.QubesException('Backup operation not running')
  1152. self.app.api_admin_running_backups[self.arg].cancel()
  1153. @qubes.api.method('admin.backup.Info', no_payload=True,
  1154. scope='local', read=True)
  1155. @asyncio.coroutine
  1156. def backup_info(self):
  1157. assert self.dest.name == 'dom0'
  1158. assert self.arg
  1159. assert '/' not in self.arg
  1160. self.fire_event_for_permission()
  1161. profile_path = os.path.join(qubes.config.backup_profile_dir,
  1162. self.arg + '.conf')
  1163. if not os.path.exists(profile_path):
  1164. raise qubes.api.PermissionDenied(
  1165. 'Backup profile {} does not exist'.format(self.arg))
  1166. backup = yield from self._load_backup_profile(self.arg,
  1167. skip_passphrase=True)
  1168. return backup.get_backup_summary()
  1169. def _send_stats_single(self, info_time, info, only_vm, filters,
  1170. id_to_name_map):
  1171. '''A single iteration of sending VM stats
  1172. :param info_time: time of previous iteration
  1173. :param info: information retrieved in previous iteration
  1174. :param only_vm: send information only about this VM
  1175. :param filters: filters to apply on stats before sending
  1176. :param id_to_name_map: ID->VM name map, may be modified
  1177. :return: tuple(info_time, info) - new information (to be passed to
  1178. the next iteration)
  1179. '''
  1180. (info_time, info) = self.app.host.get_vm_stats(info_time, info,
  1181. only_vm=only_vm)
  1182. for vm_id, vm_info in info.items():
  1183. if vm_id not in id_to_name_map:
  1184. try:
  1185. name = \
  1186. self.app.vmm.libvirt_conn.lookupByID(vm_id).name()
  1187. except libvirt.libvirtError as err:
  1188. if err.get_error_code() == libvirt.VIR_ERR_NO_DOMAIN:
  1189. # stubdomain or so
  1190. name = None
  1191. else:
  1192. raise
  1193. id_to_name_map[vm_id] = name
  1194. else:
  1195. name = id_to_name_map[vm_id]
  1196. # skip VMs with unknown name
  1197. if name is None:
  1198. continue
  1199. if not list(qubes.api.apply_filters([name], filters)):
  1200. continue
  1201. self.send_event(name, 'vm-stats',
  1202. memory_kb=int(vm_info['memory_kb']),
  1203. cpu_time=int(vm_info['cpu_time'] / 1000000),
  1204. cpu_usage=int(vm_info['cpu_usage']))
  1205. return info_time, info
  1206. @qubes.api.method('admin.vm.Stats', no_payload=True,
  1207. scope='global', read=True)
  1208. @asyncio.coroutine
  1209. def vm_stats(self):
  1210. assert not self.arg
  1211. # run until client connection is terminated
  1212. self.cancellable = True
  1213. # cache event filters, to not call an event each time an event arrives
  1214. stats_filters = self.fire_event_for_permission()
  1215. only_vm = None
  1216. if self.dest.name != 'dom0':
  1217. only_vm = self.dest
  1218. self.send_event(self.app, 'connection-established')
  1219. info_time = None
  1220. info = None
  1221. id_to_name_map = {0: 'dom0'}
  1222. try:
  1223. while True:
  1224. info_time, info = self._send_stats_single(info_time, info,
  1225. only_vm, stats_filters, id_to_name_map)
  1226. yield from asyncio.sleep(self.app.stats_interval)
  1227. except asyncio.CancelledError:
  1228. # valid method to terminate this loop
  1229. pass