__init__.py 18 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544
  1. #
  2. # The Qubes OS Project, https://www.qubes-os.org/
  3. #
  4. # Copyright (C) 2010-2015 Joanna Rutkowska <joanna@invisiblethingslab.com>
  5. # Copyright (C) 2011-2015 Marek Marczykowski-Górecki
  6. # <marmarek@invisiblethingslab.com>
  7. # Copyright (C) 2014-2015 Wojtek Porczyk <woju@invisiblethingslab.com>
  8. #
  9. # This program is free software; you can redistribute it and/or modify
  10. # it under the terms of the GNU General Public License as published by
  11. # the Free Software Foundation; either version 2 of the License, or
  12. # (at your option) any later version.
  13. #
  14. # This program is distributed in the hope that it will be useful,
  15. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  16. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  17. # GNU General Public License for more details.
  18. #
  19. # You should have received a copy of the GNU General Public License along
  20. # with this program; if not, write to the Free Software Foundation, Inc.,
  21. # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  22. #
  23. '''Qubes Virtual Machines
  24. '''
  25. import asyncio
  26. import re
  27. import string
  28. import lxml.etree
  29. import qubes
  30. import qubes.devices
  31. import qubes.events
  32. import qubes.log
  33. VM_ENTRY_POINT = 'qubes.vm'
  34. def validate_name(holder, prop, value):
  35. ''' Check if value is syntactically correct VM name '''
  36. if not isinstance(value, str):
  37. raise TypeError('VM name must be string, {!r} found'.format(
  38. type(value).__name__))
  39. if len(value) > 31:
  40. if holder is not None and prop is not None:
  41. raise qubes.exc.QubesPropertyValueError(holder, prop, value,
  42. '{} value must be shorter than 32 characters'.format(
  43. prop.__name__))
  44. else:
  45. raise qubes.exc.QubesValueError(
  46. 'VM name must be shorter than 32 characters')
  47. # this regexp does not contain '+'; if it had it, we should specifically
  48. # disallow 'lost+found' #1440
  49. if re.match(r"^[a-zA-Z][a-zA-Z0-9_-]*$", value) is None:
  50. if holder is not None and prop is not None:
  51. raise qubes.exc.QubesPropertyValueError(holder, prop, value,
  52. '{} value contains illegal characters'.format(prop.__name__))
  53. else:
  54. raise qubes.exc.QubesValueError(
  55. 'VM name contains illegal characters')
  56. if value in ('none', 'default'):
  57. raise qubes.exc.QubesValueError(
  58. 'VM name cannot be \'none\' nor \'default\'')
  59. class Features(dict):
  60. '''Manager of the features.
  61. Features can have three distinct values: no value (not present in mapping,
  62. which is closest thing to :py:obj:`None`), empty string (which is
  63. interpreted as :py:obj:`False`) and non-empty string, which is
  64. :py:obj:`True`. Anything assigned to the mapping is coerced to strings,
  65. however if you assign instances of :py:class:`bool`, they are converted as
  66. described above. Be aware that assigning the number `0` (which is considered
  67. false in Python) will result in string `'0'`, which is considered true.
  68. This class inherits from dict, but has most of the methods that manipulate
  69. the item disarmed (they raise NotImplementedError). The ones that are left
  70. fire appropriate events on the qube that owns an instance of this class.
  71. '''
  72. #
  73. # Those are the methods that affect contents. Either disarm them or make
  74. # them report appropriate events. Good approach is to rewrite them carefully
  75. # using official documentation, but use only our (overloaded) methods.
  76. #
  77. def __init__(self, vm, other=None, **kwargs):
  78. super(Features, self).__init__()
  79. self.vm = vm
  80. self.update(other, **kwargs)
  81. def __delitem__(self, key):
  82. super(Features, self).__delitem__(key)
  83. self.vm.fire_event('domain-feature-delete', feature=key)
  84. def __setitem__(self, key, value):
  85. if value is None or isinstance(value, bool):
  86. value = '1' if value else ''
  87. else:
  88. value = str(value)
  89. try:
  90. oldvalue = self[key]
  91. has_oldvalue = True
  92. except KeyError:
  93. has_oldvalue = False
  94. super(Features, self).__setitem__(key, value)
  95. if has_oldvalue:
  96. self.vm.fire_event('domain-feature-set', feature=key, value=value,
  97. oldvalue=oldvalue)
  98. else:
  99. self.vm.fire_event('domain-feature-set', feature=key, value=value)
  100. def clear(self):
  101. for key in tuple(self):
  102. del self[key]
  103. def pop(self, _key, _default=None):
  104. '''Not implemented
  105. :raises: NotImplementedError
  106. '''
  107. raise NotImplementedError()
  108. def popitem(self):
  109. '''Not implemented
  110. :raises: NotImplementedError
  111. '''
  112. raise NotImplementedError()
  113. def setdefault(self, _key, _default=None):
  114. '''Not implemented
  115. :raises: NotImplementedError
  116. '''
  117. raise NotImplementedError()
  118. def update(self, other=None, **kwargs):
  119. if other is not None:
  120. if hasattr(other, 'keys'):
  121. for key in other:
  122. self[key] = other[key]
  123. else:
  124. for key, value in other:
  125. self[key] = value
  126. for key in kwargs:
  127. self[key] = kwargs[key]
  128. #
  129. # end of overriding
  130. #
  131. _NO_DEFAULT = object()
  132. def check_with_template(self, feature, default=_NO_DEFAULT):
  133. ''' Check if the vm's template has the specified feature. '''
  134. if feature in self:
  135. return self[feature]
  136. if hasattr(self.vm, 'template') and self.vm.template is not None:
  137. return self.vm.template.features.check_with_template(feature,
  138. default)
  139. if default is self._NO_DEFAULT:
  140. raise KeyError(feature)
  141. return default
  142. class Tags(set):
  143. '''Manager of the tags.
  144. Tags are simple: tag either can be present on qube or not. Tag is a
  145. simple string consisting of ASCII alphanumeric characters, plus `_` and
  146. `-`.
  147. This class inherits from set, but has most of the methods that manipulate
  148. the item disarmed (they raise NotImplementedError). The ones that are left
  149. fire appropriate events on the qube that owns an instance of this class.
  150. '''
  151. #
  152. # Those are the methods that affect contents. Either disarm them or make
  153. # them report appropriate events. Good approach is to rewrite them carefully
  154. # using official documentation, but use only our (overloaded) methods.
  155. #
  156. def __init__(self, vm, seq=()):
  157. super(Tags, self).__init__()
  158. self.vm = vm
  159. self.update(seq)
  160. def clear(self):
  161. '''Remove all tags'''
  162. for item in tuple(self):
  163. self.remove(item)
  164. def symmetric_difference_update(self, *args, **kwargs):
  165. '''Not implemented
  166. :raises: NotImplementedError
  167. '''
  168. raise NotImplementedError()
  169. def intersection_update(self, *args, **kwargs):
  170. '''Not implemented
  171. :raises: NotImplementedError
  172. '''
  173. raise NotImplementedError()
  174. def pop(self):
  175. '''Not implemented
  176. :raises: NotImplementedError
  177. '''
  178. raise NotImplementedError()
  179. def discard(self, elem):
  180. '''Remove a tag if present'''
  181. if elem in self:
  182. self.remove(elem)
  183. def update(self, *others):
  184. '''Add tags from iterable(s)'''
  185. for other in others:
  186. for elem in other:
  187. self.add(elem)
  188. def add(self, elem):
  189. '''Add a tag'''
  190. allowed_chars = string.ascii_letters + string.digits + '_-'
  191. if any(i not in allowed_chars for i in elem):
  192. raise ValueError('Invalid character in tag')
  193. if elem in self:
  194. return
  195. super(Tags, self).add(elem)
  196. self.vm.fire_event('domain-tag-add', tag=elem)
  197. def remove(self, elem):
  198. '''Remove a tag'''
  199. super(Tags, self).remove(elem)
  200. self.vm.fire_event('domain-tag-delete', tag=elem)
  201. #
  202. # end of overriding
  203. #
  204. @staticmethod
  205. def validate_tag(tag):
  206. safe_set = string.ascii_letters + string.digits + '-_'
  207. assert all((x in safe_set) for x in tag)
  208. class BaseVM(qubes.PropertyHolder):
  209. '''Base class for all VMs
  210. :param app: Qubes application context
  211. :type app: :py:class:`qubes.Qubes`
  212. :param xml: xml node from which to deserialise
  213. :type xml: :py:class:`lxml.etree._Element` or :py:obj:`None`
  214. This class is responsible for serializing and deserialising machines and
  215. provides basic framework. It contains no management logic. For that, see
  216. :py:class:`qubes.vm.qubesvm.QubesVM`.
  217. '''
  218. # pylint: disable=no-member
  219. def __init__(self, app, xml, features=None, devices=None, tags=None,
  220. **kwargs):
  221. # pylint: disable=redefined-outer-name
  222. # self.app must be set before super().__init__, because some property
  223. # setters need working .app attribute
  224. #: mother :py:class:`qubes.Qubes` object
  225. self._qdb_watch_paths = set()
  226. self._qdb_connection_watch = None
  227. self.app = app
  228. super(BaseVM, self).__init__(xml, **kwargs)
  229. #: dictionary of features of this qube
  230. self.features = Features(self, features)
  231. #: :py:class:`DeviceManager` object keeping devices that are attached to
  232. #: this domain
  233. self.devices = devices or qubes.devices.DeviceManager(self)
  234. #: user-specified tags
  235. self.tags = Tags(self, tags or ())
  236. #: logger instance for logging messages related to this VM
  237. self.log = None
  238. #: storage volumes
  239. self.volumes = {}
  240. #: storage manager
  241. self.storage = None
  242. if hasattr(self, 'name'):
  243. self.init_log()
  244. def close(self):
  245. super().close()
  246. if self._qdb_connection_watch is not None:
  247. asyncio.get_event_loop().remove_reader(
  248. self._qdb_connection_watch.watch_fd())
  249. self._qdb_connection_watch.close()
  250. del self._qdb_connection_watch
  251. del self.app
  252. del self.features
  253. del self.storage
  254. # TODO storage may have circ references, but it doesn't leak fds
  255. del self.devices
  256. del self.tags
  257. def load_extras(self):
  258. # features
  259. for node in self.xml.xpath('./features/feature'):
  260. self.features[node.get('name')] = node.text
  261. # devices (pci, usb, ...)
  262. for parent in self.xml.xpath('./devices'):
  263. devclass = parent.get('class')
  264. for node in parent.xpath('./device'):
  265. options = {}
  266. for option in node.xpath('./option'):
  267. options[option.get('name')] = option.text
  268. device_assignment = qubes.devices.DeviceAssignment(
  269. self.app.domains[node.get('backend-domain')],
  270. node.get('id'),
  271. options,
  272. persistent=True
  273. )
  274. self.devices[devclass].load_persistent(device_assignment)
  275. # tags
  276. for node in self.xml.xpath('./tags/tag'):
  277. self.tags.add(node.get('name'))
  278. # SEE:1815 firewall, policy.
  279. def init_log(self):
  280. '''Initialise logger for this domain.'''
  281. self.log = qubes.log.get_vm_logger(self.name)
  282. def __xml__(self):
  283. element = lxml.etree.Element('domain')
  284. element.set('id', 'domain-' + str(self.qid))
  285. element.set('class', self.__class__.__name__)
  286. element.append(self.xml_properties())
  287. features = lxml.etree.Element('features')
  288. for feature in self.features:
  289. node = lxml.etree.Element('feature', name=feature)
  290. node.text = self.features[feature]
  291. features.append(node)
  292. element.append(features)
  293. for devclass in self.devices:
  294. devices = lxml.etree.Element('devices')
  295. devices.set('class', devclass)
  296. for device in self.devices[devclass].assignments(persistent=True):
  297. node = lxml.etree.Element('device')
  298. node.set('backend-domain', device.backend_domain.name)
  299. node.set('id', device.ident)
  300. for key, val in device.options.items():
  301. option_node = lxml.etree.Element('option')
  302. option_node.set('name', key)
  303. option_node.text = val
  304. node.append(option_node)
  305. devices.append(node)
  306. element.append(devices)
  307. tags = lxml.etree.Element('tags')
  308. for tag in self.tags:
  309. node = lxml.etree.Element('tag', name=tag)
  310. tags.append(node)
  311. element.append(tags)
  312. return element
  313. def __repr__(self):
  314. proprepr = []
  315. for prop in self.property_list():
  316. if prop.__name__ in ('name', 'qid'):
  317. continue
  318. try:
  319. proprepr.append('{}={!s}'.format(
  320. prop.__name__, getattr(self, prop.__name__)))
  321. except AttributeError:
  322. continue
  323. return '<{} at {:#x} name={!r} qid={!r} {}>'.format(type(self).__name__,
  324. id(self), self.name, self.qid, ' '.join(proprepr))
  325. #
  326. # xml serialising methods
  327. #
  328. def create_config_file(self):
  329. '''Create libvirt's XML domain config file
  330. '''
  331. domain_config = self.app.env.select_template([
  332. 'libvirt/xen/by-name/{}.xml'.format(self.name),
  333. 'libvirt/xen-user.xml',
  334. 'libvirt/xen-dist.xml',
  335. 'libvirt/xen.xml',
  336. ]).render(vm=self)
  337. return domain_config
  338. def watch_qdb_path(self, path):
  339. '''Add a QubesDB path to be watched.
  340. Each change to the path will cause `domain-qdb-change:path` event to be
  341. fired.
  342. You can call this method for example in response to
  343. `domain-init` and `domain-load` events.
  344. '''
  345. if path not in self._qdb_watch_paths:
  346. self._qdb_watch_paths.add(path)
  347. if self._qdb_connection_watch:
  348. self._qdb_connection_watch.watch(path)
  349. def _qdb_watch_reader(self, loop):
  350. '''Callback when self._qdb_connection_watch.watch_fd() FD is
  351. readable.
  352. Read reported event (watched path change) and fire appropriate event.
  353. '''
  354. import qubesdb # pylint: disable=import-error
  355. try:
  356. path = self._qdb_connection_watch.read_watch()
  357. for watched_path in self._qdb_watch_paths:
  358. if watched_path == path or (
  359. watched_path.endswith('/') and
  360. path.startswith(watched_path)):
  361. self.fire_event('domain-qdb-change:' + watched_path,
  362. path=path)
  363. except qubesdb.DisconnectedError:
  364. loop.remove_reader(self._qdb_connection_watch.watch_fd())
  365. self._qdb_connection_watch.close()
  366. self._qdb_connection_watch = None
  367. def start_qdb_watch(self, name, loop=None):
  368. '''Start watching QubesDB
  369. Calling this method in appropriate time is responsibility of child
  370. class.
  371. '''
  372. import qubesdb # pylint: disable=import-error
  373. self._qdb_connection_watch = qubesdb.QubesDB(name)
  374. if loop is None:
  375. loop = asyncio.get_event_loop()
  376. loop.add_reader(self._qdb_connection_watch.watch_fd(),
  377. self._qdb_watch_reader, loop)
  378. for path in self._qdb_watch_paths:
  379. self._qdb_connection_watch.watch(path)
  380. class VMProperty(qubes.property):
  381. '''Property that is referring to a VM
  382. :param type vmclass: class that returned VM is supposed to be instance of
  383. and all supported by :py:class:`property` with the exception of ``type`` \
  384. and ``setter``
  385. '''
  386. _none_value = ''
  387. def __init__(self, name, vmclass=BaseVM, allow_none=False,
  388. **kwargs):
  389. if 'type' in kwargs:
  390. raise TypeError(
  391. "'type' keyword parameter is unsupported in {}".format(
  392. self.__class__.__name__))
  393. if not issubclass(vmclass, BaseVM):
  394. raise TypeError(
  395. "'vmclass' should specify a subclass of qubes.vm.BaseVM")
  396. super(VMProperty, self).__init__(name,
  397. saver=(lambda self_, prop, value:
  398. self._none_value if value is None else value.name),
  399. **kwargs)
  400. self.vmclass = vmclass
  401. self.allow_none = allow_none
  402. def __set__(self, instance, value):
  403. if value is self.__class__.DEFAULT:
  404. self.__delete__(instance)
  405. return
  406. if value == self._none_value:
  407. value = None
  408. if value is None:
  409. if self.allow_none:
  410. super(VMProperty, self).__set__(instance, value)
  411. return
  412. else:
  413. raise ValueError(
  414. 'Property {!r} does not allow setting to {!r}'.format(
  415. self.__name__, value))
  416. app = instance if isinstance(instance, qubes.Qubes) else instance.app
  417. try:
  418. vm = app.domains[value]
  419. except KeyError:
  420. raise qubes.exc.QubesVMNotFoundError(value)
  421. if not isinstance(vm, self.vmclass):
  422. raise TypeError('wrong VM class: domains[{!r}] is of type {!s} '
  423. 'and not {!s}'.format(value,
  424. vm.__class__.__name__,
  425. self.vmclass.__name__))
  426. super(VMProperty, self).__set__(instance, vm)
  427. def sanitize(self, *, untrusted_newvalue):
  428. try:
  429. untrusted_vmname = untrusted_newvalue.decode('ascii')
  430. except UnicodeDecodeError:
  431. raise qubes.exc.QubesValueError
  432. if untrusted_vmname == '':
  433. # allow empty VM name for setting VMProperty value, because it's
  434. # string representation of None (see self._none_value)
  435. return untrusted_vmname
  436. validate_name(None, self, untrusted_vmname)
  437. return untrusted_vmname
  438. def setter_label(self, prop, value):
  439. ''' Helper for setting the domain label '''
  440. # pylint: disable=unused-argument
  441. if isinstance(value, qubes.Label):
  442. return value
  443. if isinstance(value, str) and value.startswith('label-'):
  444. return self.app.labels[int(value.split('-', 1)[1])]
  445. return self.app.get_label(value)