qubes.py 31 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908
  1. #!/usr/bin/python2
  2. # -*- coding: utf-8 -*-
  3. #
  4. # The Qubes OS Project, http://www.qubes-os.org
  5. #
  6. # Copyright (C) 2010 Joanna Rutkowska <joanna@invisiblethingslab.com>
  7. #
  8. # This program is free software; you can redistribute it and/or
  9. # modify it under the terms of the GNU General Public License
  10. # as published by the Free Software Foundation; either version 2
  11. # of the License, or (at your option) any later version.
  12. #
  13. # This program is distributed in the hope that it will be useful,
  14. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  15. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  16. # GNU General Public License for more details.
  17. #
  18. # You should have received a copy of the GNU General Public License
  19. # along with this program; if not, write to the Free Software
  20. # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  21. #
  22. #
  23. from __future__ import absolute_import
  24. import sys
  25. import os
  26. import os.path
  27. import lxml.etree
  28. import xml.parsers.expat
  29. import time
  30. import warnings
  31. import tempfile
  32. import grp
  33. import atexit
  34. if os.name == 'posix':
  35. import fcntl
  36. elif os.name == 'nt':
  37. import win32con
  38. import win32file
  39. import pywintypes
  40. else:
  41. raise RuntimeError, "Qubes works only on POSIX or WinNT systems"
  42. # Do not use XenAPI or create/read any VM files
  43. # This is for testing only!
  44. dry_run = False
  45. #dry_run = True
  46. if not dry_run:
  47. import libvirt
  48. try:
  49. import xen.lowlevel.xs
  50. except ImportError:
  51. pass
  52. qubes_base_dir = "/var/lib/qubes"
  53. system_path = {
  54. 'qubes_guid_path': '/usr/bin/qubes-guid',
  55. 'qrexec_daemon_path': '/usr/lib/qubes/qrexec-daemon',
  56. 'qrexec_client_path': '/usr/lib/qubes/qrexec-client',
  57. 'qubesdb_daemon_path': '/usr/sbin/qubesdb-daemon',
  58. 'qubes_base_dir': qubes_base_dir,
  59. # Relative to qubes_base_dir
  60. 'qubes_appvms_dir': 'appvms',
  61. 'qubes_templates_dir': 'vm-templates',
  62. 'qubes_servicevms_dir': 'servicevms',
  63. 'qubes_store_filename': 'qubes.xml',
  64. 'qubes_kernels_base_dir': 'vm-kernels',
  65. # qubes_icon_dir is obsolete
  66. # use QIcon.fromTheme() where applicable
  67. 'qubes_icon_dir': '/usr/share/icons/hicolor/128x128/devices',
  68. 'qrexec_policy_dir': '/etc/qubes-rpc/policy',
  69. 'config_template_pv': '/usr/share/qubes/vm-template.xml',
  70. 'qubes_pciback_cmd': '/usr/lib/qubes/unbind-pci-device.sh',
  71. 'prepare_volatile_img_cmd': '/usr/lib/qubes/prepare-volatile-img.sh',
  72. }
  73. vm_files = {
  74. 'root_img': 'root.img',
  75. 'rootcow_img': 'root-cow.img',
  76. 'volatile_img': 'volatile.img',
  77. 'clean_volatile_img': 'clean-volatile.img.tar',
  78. 'private_img': 'private.img',
  79. 'kernels_subdir': 'kernels',
  80. 'firewall_conf': 'firewall.xml',
  81. 'whitelisted_appmenus': 'whitelisted-appmenus.list',
  82. 'updates_stat_file': 'updates.stat',
  83. }
  84. defaults = {
  85. 'libvirt_uri': 'xen:///',
  86. 'memory': 400,
  87. 'kernelopts': "nopat",
  88. 'kernelopts_pcidevs': "nopat iommu=soft swiotlb=4096",
  89. 'dom0_update_check_interval': 6*3600,
  90. 'private_img_size': 2*1024*1024*1024,
  91. 'root_img_size': 10*1024*1024*1024,
  92. 'storage_class': None,
  93. # how long (in sec) to wait for VMs to shutdown,
  94. # before killing them (when used qvm-run with --wait option),
  95. 'shutdown_counter_max': 60,
  96. 'vm_default_netmask': "255.255.255.0",
  97. # Set later
  98. 'appvm_label': None,
  99. 'template_label': None,
  100. 'servicevm_label': None,
  101. }
  102. qubes_max_qid = 254
  103. qubes_max_netid = 254
  104. class QubesException (Exception):
  105. pass
  106. class QubesVMMConnection(object):
  107. def __init__(self):
  108. self._libvirt_conn = None
  109. self._xs = None
  110. self._xc = None
  111. self._offline_mode = False
  112. @property
  113. def offline_mode(self):
  114. return self._offline_mode
  115. @offline_mode.setter
  116. def offline_mode(self, value):
  117. if not value and self._libvirt_conn is not None:
  118. raise QubesException("Cannot change offline mode while already connected")
  119. self._offline_mode = value
  120. def _libvirt_error_handler(self, ctx, error):
  121. pass
  122. def init_vmm_connection(self):
  123. if self._libvirt_conn is not None:
  124. # Already initialized
  125. return
  126. if self._offline_mode:
  127. # Do not initialize in offline mode
  128. return
  129. if 'xen.lowlevel.xs' in sys.modules:
  130. self._xs = xen.lowlevel.xs.xs()
  131. libvirt.virEventRegisterDefaultImpl()
  132. self._libvirt_conn = libvirt.open(defaults['libvirt_uri'])
  133. if self._libvirt_conn == None:
  134. raise QubesException("Failed connect to libvirt driver")
  135. libvirt.registerErrorHandler(self._libvirt_error_handler, None)
  136. atexit.register(self._libvirt_conn.close)
  137. def _common_getter(self, name):
  138. if self._offline_mode:
  139. # Do not initialize in offline mode
  140. raise QubesException("VMM operations disabled in offline mode")
  141. if self._libvirt_conn is None:
  142. self.init_vmm_connection()
  143. return getattr(self, name)
  144. @property
  145. def libvirt_conn(self):
  146. return self._common_getter('_libvirt_conn')
  147. @property
  148. def xs(self):
  149. if 'xen.lowlevel.xs' in sys.modules:
  150. return self._common_getter('_xs')
  151. else:
  152. return None
  153. ##### VMM global variable definition #####
  154. if not dry_run:
  155. vmm = QubesVMMConnection()
  156. ##########################################
  157. class QubesHost(object):
  158. def __init__(self):
  159. (model, memory, cpus, mhz, nodes, socket, cores, threads) = vmm.libvirt_conn.getInfo()
  160. self._total_mem = long(memory)*1024
  161. self._no_cpus = cpus
  162. # print "QubesHost: total_mem = {0}B".format (self.xen_total_mem)
  163. # print "QubesHost: free_mem = {0}".format (self.get_free_xen_memory())
  164. # print "QubesHost: total_cpus = {0}".format (self.xen_no_cpus)
  165. @property
  166. def memory_total(self):
  167. return self._total_mem
  168. @property
  169. def no_cpus(self):
  170. return self._no_cpus
  171. # TODO
  172. def get_free_xen_memory(self):
  173. ret = self.physinfo['free_memory']
  174. return long(ret)
  175. # TODO
  176. def measure_cpu_usage(self, previous=None, previous_time = None,
  177. wait_time=1):
  178. """measure cpu usage for all domains at once"""
  179. if previous is None:
  180. previous_time = time.time()
  181. previous = {}
  182. info = vmm.xc.domain_getinfo(0, qubes_max_qid)
  183. for vm in info:
  184. previous[vm['domid']] = {}
  185. previous[vm['domid']]['cpu_time'] = (
  186. vm['cpu_time'] / vm['online_vcpus'])
  187. previous[vm['domid']]['cpu_usage'] = 0
  188. time.sleep(wait_time)
  189. current_time = time.time()
  190. current = {}
  191. info = vmm.xc.domain_getinfo(0, qubes_max_qid)
  192. for vm in info:
  193. current[vm['domid']] = {}
  194. current[vm['domid']]['cpu_time'] = (
  195. vm['cpu_time'] / max(vm['online_vcpus'], 1))
  196. if vm['domid'] in previous.keys():
  197. current[vm['domid']]['cpu_usage'] = (
  198. float(current[vm['domid']]['cpu_time'] -
  199. previous[vm['domid']]['cpu_time']) /
  200. long(1000**3) / (current_time-previous_time) * 100)
  201. if current[vm['domid']]['cpu_usage'] < 0:
  202. # VM has been rebooted
  203. current[vm['domid']]['cpu_usage'] = 0
  204. else:
  205. current[vm['domid']]['cpu_usage'] = 0
  206. return (current_time, current)
  207. class QubesVmLabel(object):
  208. def __init__(self, index, color, name, dispvm=False):
  209. self.index = index
  210. self.color = color
  211. self.name = name
  212. self.dispvm = dispvm
  213. self.icon = '{}-{}'.format(('dispvm' if dispvm else 'appvm'), name)
  214. def __repr__(self):
  215. return '{}({!r}, {!r}, {!r}, dispvm={!r})'.format(
  216. self.__class__.__name__,
  217. self.index,
  218. self.color,
  219. self.name,
  220. self.dispvm)
  221. # self.icon_path is obsolete
  222. # use QIcon.fromTheme(label.icon) where applicable
  223. @property
  224. def icon_path(self):
  225. return os.path.join(system_path['qubes_icon_dir'], self.icon) + ".png"
  226. def register_qubes_vm_class(vm_class):
  227. QubesVmClasses[vm_class.__name__] = vm_class
  228. # register class as local for this module - to make it easy to import from
  229. # other modules
  230. setattr(sys.modules[__name__], vm_class.__name__, vm_class)
  231. class QubesVmCollection(dict):
  232. """
  233. A collection of Qubes VMs indexed by Qubes id (qid)
  234. """
  235. def __init__(self, store_filename=None):
  236. super(QubesVmCollection, self).__init__()
  237. self.default_netvm_qid = None
  238. self.default_fw_netvm_qid = None
  239. self.default_template_qid = None
  240. self.default_kernel = None
  241. self.updatevm_qid = None
  242. self.qubes_store_filename = store_filename
  243. if not store_filename:
  244. self.qubes_store_filename = system_path["qubes_store_filename"]
  245. self.clockvm_qid = None
  246. self.qubes_store_file = None
  247. def __repr__(self):
  248. return '<{} {!r}>'.format(self.__class__.__name__, list(sorted(self.keys())))
  249. def values(self):
  250. for qid in self.keys():
  251. yield self[qid]
  252. def items(self):
  253. for qid in self.keys():
  254. yield (qid, self[qid])
  255. def __iter__(self):
  256. for qid in sorted(super(QubesVmCollection, self).keys()):
  257. yield qid
  258. keys = __iter__
  259. def __setitem__(self, key, value):
  260. if key not in self:
  261. return super(QubesVmCollection, self).__setitem__(key, value)
  262. else:
  263. assert False, "Attempt to add VM with qid that already exists in the collection!"
  264. def add_new_vm(self, vm_type, **kwargs):
  265. if vm_type not in QubesVmClasses.keys():
  266. raise ValueError("Unknown VM type: %s" % vm_type)
  267. qid = self.get_new_unused_qid()
  268. vm_cls = QubesVmClasses[vm_type]
  269. if 'template' in kwargs:
  270. if not vm_cls.is_template_compatible(kwargs['template']):
  271. raise QubesException("Template not compatible with selected "
  272. "VM type")
  273. vm = vm_cls(qid=qid, collection=self, **kwargs)
  274. if not self.verify_new_vm(vm):
  275. raise QubesException("Wrong VM description!")
  276. self[vm.qid] = vm
  277. # make first created NetVM the default one
  278. if self.default_fw_netvm_qid is None and vm.is_netvm():
  279. self.set_default_fw_netvm(vm)
  280. if self.default_netvm_qid is None and vm.is_proxyvm():
  281. self.set_default_netvm(vm)
  282. # make first created TemplateVM the default one
  283. if self.default_template_qid is None and vm.is_template():
  284. self.set_default_template(vm)
  285. # make first created ProxyVM the UpdateVM
  286. if self.updatevm_qid is None and vm.is_proxyvm():
  287. self.set_updatevm_vm(vm)
  288. # by default ClockVM is the first NetVM
  289. if self.clockvm_qid is None and vm.is_netvm():
  290. self.set_clockvm_vm(vm)
  291. return vm
  292. def add_new_appvm(self, name, template,
  293. dir_path = None, conf_file = None,
  294. private_img = None,
  295. label = None):
  296. warnings.warn("Call to deprecated function, use add_new_vm instead",
  297. DeprecationWarning, stacklevel=2)
  298. return self.add_new_vm("QubesAppVm", name=name, template=template,
  299. dir_path=dir_path, conf_file=conf_file,
  300. private_img=private_img,
  301. netvm = self.get_default_netvm(),
  302. kernel = self.get_default_kernel(),
  303. uses_default_kernel = True,
  304. label=label)
  305. def add_new_hvm(self, name, label = None):
  306. warnings.warn("Call to deprecated function, use add_new_vm instead",
  307. DeprecationWarning, stacklevel=2)
  308. return self.add_new_vm("QubesHVm", name=name, label=label)
  309. def add_new_disposablevm(self, name, template, dispid,
  310. label = None, netvm = None):
  311. warnings.warn("Call to deprecated function, use add_new_vm instead",
  312. DeprecationWarning, stacklevel=2)
  313. return self.add_new_vm("QubesDisposableVm", name=name, template=template,
  314. netvm = netvm,
  315. label=label, dispid=dispid)
  316. def add_new_templatevm(self, name,
  317. dir_path = None, conf_file = None,
  318. root_img = None, private_img = None,
  319. installed_by_rpm = True):
  320. warnings.warn("Call to deprecated function, use add_new_vm instead",
  321. DeprecationWarning, stacklevel=2)
  322. return self.add_new_vm("QubesTemplateVm", name=name,
  323. dir_path=dir_path, conf_file=conf_file,
  324. root_img=root_img, private_img=private_img,
  325. installed_by_rpm=installed_by_rpm,
  326. netvm = self.get_default_netvm(),
  327. kernel = self.get_default_kernel(),
  328. uses_default_kernel = True)
  329. def add_new_netvm(self, name, template,
  330. dir_path = None, conf_file = None,
  331. private_img = None, installed_by_rpm = False,
  332. label = None):
  333. warnings.warn("Call to deprecated function, use add_new_vm instead",
  334. DeprecationWarning, stacklevel=2)
  335. return self.add_new_vm("QubesNetVm", name=name, template=template,
  336. label=label,
  337. private_img=private_img, installed_by_rpm=installed_by_rpm,
  338. uses_default_kernel = True,
  339. dir_path=dir_path, conf_file=conf_file)
  340. def add_new_proxyvm(self, name, template,
  341. dir_path = None, conf_file = None,
  342. private_img = None, installed_by_rpm = False,
  343. label = None):
  344. warnings.warn("Call to deprecated function, use add_new_vm instead",
  345. DeprecationWarning, stacklevel=2)
  346. return self.add_new_vm("QubesProxyVm", name=name, template=template,
  347. label=label,
  348. private_img=private_img, installed_by_rpm=installed_by_rpm,
  349. dir_path=dir_path, conf_file=conf_file,
  350. uses_default_kernel = True,
  351. netvm = self.get_default_fw_netvm())
  352. def set_default_template(self, vm):
  353. if vm is None:
  354. self.default_template_qid = None
  355. else:
  356. assert vm.is_template(), "VM {0} is not a TemplateVM!".format(vm.name)
  357. self.default_template_qid = vm.qid
  358. def get_default_template(self):
  359. if self.default_template_qid is None:
  360. return None
  361. else:
  362. return self[self.default_template_qid]
  363. def set_default_netvm(self, vm):
  364. if vm is None:
  365. self.default_netvm_qid = None
  366. else:
  367. assert vm.is_netvm(), "VM {0} does not provide network!".format(vm.name)
  368. self.default_netvm_qid = vm.qid
  369. def get_default_netvm(self):
  370. if self.default_netvm_qid is None:
  371. return None
  372. else:
  373. return self[self.default_netvm_qid]
  374. def set_default_kernel(self, kernel):
  375. assert os.path.exists(
  376. os.path.join(system_path["qubes_kernels_base_dir"], kernel)), \
  377. "Kerel {0} not installed!".format(kernel)
  378. self.default_kernel = kernel
  379. def get_default_kernel(self):
  380. return self.default_kernel
  381. def set_default_fw_netvm(self, vm):
  382. if vm is None:
  383. self.default_fw_netvm_qid = None
  384. else:
  385. assert vm.is_netvm(), "VM {0} does not provide network!".format(vm.name)
  386. self.default_fw_netvm_qid = vm.qid
  387. def get_default_fw_netvm(self):
  388. if self.default_fw_netvm_qid is None:
  389. return None
  390. else:
  391. return self[self.default_fw_netvm_qid]
  392. def set_updatevm_vm(self, vm):
  393. if vm is None:
  394. self.updatevm_qid = None
  395. else:
  396. self.updatevm_qid = vm.qid
  397. def get_updatevm_vm(self):
  398. if self.updatevm_qid is None:
  399. return None
  400. else:
  401. return self[self.updatevm_qid]
  402. def set_clockvm_vm(self, vm):
  403. if vm is None:
  404. self.clockvm_qid = None
  405. else:
  406. self.clockvm_qid = vm.qid
  407. def get_clockvm_vm(self):
  408. if self.clockvm_qid is None:
  409. return None
  410. else:
  411. return self[self.clockvm_qid]
  412. def get_vm_by_name(self, name):
  413. for vm in self.values():
  414. if (vm.name == name):
  415. return vm
  416. return None
  417. def get_qid_by_name(self, name):
  418. vm = self.get_vm_by_name(name)
  419. return vm.qid if vm is not None else None
  420. def get_vms_based_on(self, template_qid):
  421. vms = set([vm for vm in self.values()
  422. if (vm.template and vm.template.qid == template_qid)])
  423. return vms
  424. def get_vms_connected_to(self, netvm_qid):
  425. new_vms = [ netvm_qid ]
  426. dependend_vms_qid = []
  427. # Dependency resolving only makes sense on NetVM (or derivative)
  428. if not self[netvm_qid].is_netvm():
  429. return set([])
  430. while len(new_vms) > 0:
  431. cur_vm = new_vms.pop()
  432. for vm in self[cur_vm].connected_vms.values():
  433. if vm.qid not in dependend_vms_qid:
  434. dependend_vms_qid.append(vm.qid)
  435. if vm.is_netvm():
  436. new_vms.append(vm.qid)
  437. vms = [vm for vm in self.values() if vm.qid in dependend_vms_qid]
  438. return vms
  439. def verify_new_vm(self, new_vm):
  440. # Verify that qid is unique
  441. for vm in self.values():
  442. if vm.qid == new_vm.qid:
  443. print >> sys.stderr, "ERROR: The qid={0} is already used by VM '{1}'!".\
  444. format(vm.qid, vm.name)
  445. return False
  446. # Verify that name is unique
  447. for vm in self.values():
  448. if vm.name == new_vm.name:
  449. print >> sys.stderr, \
  450. "ERROR: The name={0} is already used by other VM with qid='{1}'!".\
  451. format(vm.name, vm.qid)
  452. return False
  453. return True
  454. def get_new_unused_qid(self):
  455. used_ids = set([vm.qid for vm in self.values()])
  456. for id in range (1, qubes_max_qid):
  457. if id not in used_ids:
  458. return id
  459. raise LookupError ("Cannot find unused qid!")
  460. def get_new_unused_netid(self):
  461. used_ids = set([vm.netid for vm in self.values() if vm.is_netvm()])
  462. for id in range (1, qubes_max_netid):
  463. if id not in used_ids:
  464. return id
  465. raise LookupError ("Cannot find unused netid!")
  466. def check_if_storage_exists(self):
  467. try:
  468. f = open (self.qubes_store_filename, 'r')
  469. except IOError:
  470. return False
  471. f.close()
  472. return True
  473. def create_empty_storage(self):
  474. self.qubes_store_file = open (self.qubes_store_filename, 'w')
  475. self.clear()
  476. self.save()
  477. def lock_db_for_reading(self):
  478. # save() would rename the file over qubes.xml, _then_ release lock,
  479. # so we need to ensure that the file for which we've got the lock is
  480. # still the right file
  481. while True:
  482. self.qubes_store_file = open (self.qubes_store_filename, 'r')
  483. if os.name == 'posix':
  484. fcntl.lockf (self.qubes_store_file, fcntl.LOCK_SH)
  485. elif os.name == 'nt':
  486. overlapped = pywintypes.OVERLAPPED()
  487. win32file.LockFileEx(win32file._get_osfhandle(self.qubes_store_file.fileno()),
  488. 0, 0, -0x10000, overlapped)
  489. if os.fstat(self.qubes_store_file.fileno()) == os.stat(
  490. self.qubes_store_filename):
  491. break
  492. self.qubes_store_file.close()
  493. def lock_db_for_writing(self):
  494. # save() would rename the file over qubes.xml, _then_ release lock,
  495. # so we need to ensure that the file for which we've got the lock is
  496. # still the right file
  497. while True:
  498. self.qubes_store_file = open (self.qubes_store_filename, 'r+')
  499. if os.name == 'posix':
  500. fcntl.lockf (self.qubes_store_file, fcntl.LOCK_EX)
  501. elif os.name == 'nt':
  502. overlapped = pywintypes.OVERLAPPED()
  503. win32file.LockFileEx(win32file._get_osfhandle(self.qubes_store_file.fileno()),
  504. win32con.LOCKFILE_EXCLUSIVE_LOCK, 0, -0x10000, overlapped)
  505. if os.fstat(self.qubes_store_file.fileno()) == os.stat(
  506. self.qubes_store_filename):
  507. break
  508. self.qubes_store_file.close()
  509. def unlock_db(self):
  510. # intentionally do not call explicit unlock to not unlock the file
  511. # before all buffers are flushed
  512. self.qubes_store_file.close()
  513. def save(self):
  514. root = lxml.etree.Element(
  515. "QubesVmCollection",
  516. default_template=str(self.default_template_qid) \
  517. if self.default_template_qid is not None else "None",
  518. default_netvm=str(self.default_netvm_qid) \
  519. if self.default_netvm_qid is not None else "None",
  520. default_fw_netvm=str(self.default_fw_netvm_qid) \
  521. if self.default_fw_netvm_qid is not None else "None",
  522. updatevm=str(self.updatevm_qid) \
  523. if self.updatevm_qid is not None else "None",
  524. clockvm=str(self.clockvm_qid) \
  525. if self.clockvm_qid is not None else "None",
  526. default_kernel=str(self.default_kernel) \
  527. if self.default_kernel is not None else "None",
  528. )
  529. for vm in self.values():
  530. element = vm.create_xml_element()
  531. if element is not None:
  532. root.append(element)
  533. tree = lxml.etree.ElementTree(root)
  534. try:
  535. new_store_file = tempfile.NamedTemporaryFile(prefix=self.qubes_store_filename, delete=False)
  536. # XXX: do not get lock on the new file, as in all use cases
  537. # unlock_db() is the next operation after save()
  538. tree.write(new_store_file, encoding="UTF-8", pretty_print=True)
  539. new_store_file.flush()
  540. os.chmod(new_store_file.name, 0660)
  541. os.chown(new_store_file.name, -1, grp.getgrnam('qubes').gr_gid)
  542. os.rename(new_store_file.name, self.qubes_store_filename)
  543. self.qubes_store_file.close()
  544. self.qubes_store_file = new_store_file
  545. except EnvironmentError as err:
  546. print("{0}: export error: {1}".format(
  547. os.path.basename(sys.argv[0]), err))
  548. return False
  549. return True
  550. def set_netvm_dependency(self, element):
  551. kwargs = {}
  552. attr_list = ("qid", "uses_default_netvm", "netvm_qid")
  553. for attribute in attr_list:
  554. kwargs[attribute] = element.get(attribute)
  555. vm = self[int(kwargs["qid"])]
  556. if "uses_default_netvm" not in kwargs:
  557. vm.uses_default_netvm = True
  558. else:
  559. vm.uses_default_netvm = (
  560. True if kwargs["uses_default_netvm"] == "True" else False)
  561. if vm.uses_default_netvm is True:
  562. if vm.is_proxyvm():
  563. netvm = self.get_default_fw_netvm()
  564. else:
  565. netvm = self.get_default_netvm()
  566. kwargs.pop("netvm_qid")
  567. else:
  568. if kwargs["netvm_qid"] == "none" or kwargs["netvm_qid"] is None:
  569. netvm = None
  570. kwargs.pop("netvm_qid")
  571. else:
  572. netvm_qid = int(kwargs.pop("netvm_qid"))
  573. if netvm_qid not in self:
  574. netvm = None
  575. else:
  576. netvm = self[netvm_qid]
  577. # directly set internal attr to not call setters...
  578. vm._netvm = netvm
  579. if netvm:
  580. netvm.connected_vms[vm.qid] = vm
  581. def load_globals(self, element):
  582. default_template = element.get("default_template")
  583. self.default_template_qid = int(default_template) \
  584. if default_template.lower() != "none" else None
  585. default_netvm = element.get("default_netvm")
  586. if default_netvm is not None:
  587. self.default_netvm_qid = int(default_netvm) \
  588. if default_netvm != "None" else None
  589. #assert self.default_netvm_qid is not None
  590. default_fw_netvm = element.get("default_fw_netvm")
  591. if default_fw_netvm is not None:
  592. self.default_fw_netvm_qid = int(default_fw_netvm) \
  593. if default_fw_netvm != "None" else None
  594. #assert self.default_netvm_qid is not None
  595. updatevm = element.get("updatevm")
  596. if updatevm is not None:
  597. self.updatevm_qid = int(updatevm) \
  598. if updatevm != "None" else None
  599. #assert self.default_netvm_qid is not None
  600. clockvm = element.get("clockvm")
  601. if clockvm is not None:
  602. self.clockvm_qid = int(clockvm) \
  603. if clockvm != "None" else None
  604. self.default_kernel = element.get("default_kernel")
  605. def load(self):
  606. self.clear()
  607. try:
  608. tree = lxml.etree.parse(self.qubes_store_file)
  609. except (EnvironmentError,
  610. xml.parsers.expat.ExpatError) as err:
  611. print("{0}: import error: {1}".format(
  612. os.path.basename(sys.argv[0]), err))
  613. return False
  614. self.load_globals(tree.getroot())
  615. for (vm_class_name, vm_class) in sorted(QubesVmClasses.items(),
  616. key=lambda _x: _x[1].load_order):
  617. vms_of_class = tree.findall(vm_class_name)
  618. # first non-template based, then template based
  619. sorted_vms_of_class = sorted(vms_of_class, key= \
  620. lambda x: str(x.get('template_qid')).lower() != "none")
  621. for element in sorted_vms_of_class:
  622. try:
  623. vm = vm_class(xml_element=element, collection=self)
  624. self[vm.qid] = vm
  625. except (ValueError, LookupError) as err:
  626. print("{0}: import error ({1}): {2}".format(
  627. os.path.basename(sys.argv[0]), vm_class_name, err))
  628. raise
  629. return False
  630. # After importing all VMs, set netvm references, in the same order
  631. for (vm_class_name, vm_class) in sorted(QubesVmClasses.items(),
  632. key=lambda _x: _x[1].load_order):
  633. for element in tree.findall(vm_class_name):
  634. try:
  635. self.set_netvm_dependency(element)
  636. except (ValueError, LookupError) as err:
  637. print("{0}: import error2 ({}): {}".format(
  638. os.path.basename(sys.argv[0]), vm_class_name, err))
  639. return False
  640. # if there was no clockvm entry in qubes.xml, try to determine default:
  641. # root of default NetVM chain
  642. if tree.getroot().get("clockvm") is None:
  643. if self.default_netvm_qid is not None:
  644. clockvm = self[self.default_netvm_qid]
  645. # Find root of netvm chain
  646. while clockvm.netvm is not None:
  647. clockvm = clockvm.netvm
  648. self.clockvm_qid = clockvm.qid
  649. # Disable ntpd in ClockVM - to not conflict with ntpdate (both are
  650. # using 123/udp port)
  651. if self.clockvm_qid is not None:
  652. self[self.clockvm_qid].services['ntpd'] = False
  653. # Add dom0 if wasn't present in qubes.xml
  654. if not 0 in self.keys():
  655. dom0vm = QubesAdminVm (collection=self)
  656. self[dom0vm.qid] = dom0vm
  657. return True
  658. def pop(self, qid):
  659. if self.default_netvm_qid == qid:
  660. self.default_netvm_qid = None
  661. if self.default_fw_netvm_qid == qid:
  662. self.default_fw_netvm_qid = None
  663. if self.clockvm_qid == qid:
  664. self.clockvm_qid = None
  665. if self.updatevm_qid == qid:
  666. self.updatevm_qid = None
  667. if self.default_template_qid == qid:
  668. self.default_template_qid = None
  669. return super(QubesVmCollection, self).pop(qid)
  670. class QubesDaemonPidfile(object):
  671. def __init__(self, name):
  672. self.name = name
  673. self.path = "/var/run/qubes/" + name + ".pid"
  674. def create_pidfile(self):
  675. f = open (self.path, 'w')
  676. f.write(str(os.getpid()))
  677. f.close()
  678. def pidfile_exists(self):
  679. return os.path.exists(self.path)
  680. def read_pid(self):
  681. f = open (self.path)
  682. pid = f.read ().strip()
  683. f.close()
  684. return int(pid)
  685. def pidfile_is_stale(self):
  686. if not self.pidfile_exists():
  687. return False
  688. # check if the pid file is valid...
  689. proc_path = "/proc/" + str(self.read_pid()) + "/cmdline"
  690. if not os.path.exists (proc_path):
  691. print >> sys.stderr, \
  692. "Path {0} doesn't exist, assuming stale pidfile.".\
  693. format(proc_path)
  694. return True
  695. return False # It's a good pidfile
  696. def remove_pidfile(self):
  697. os.remove (self.path)
  698. def __enter__ (self):
  699. # assumes the pidfile doesn't exist -- you should ensure it before opening the context
  700. self.create_pidfile()
  701. def __exit__ (self, exc_type, exc_val, exc_tb):
  702. self.remove_pidfile()
  703. return False
  704. ### Initialization code
  705. # Globally defined lables
  706. QubesVmLabels = {
  707. "red": QubesVmLabel(1, "0xcc0000", "red" ),
  708. "orange": QubesVmLabel(2, "0xf57900", "orange" ),
  709. "yellow": QubesVmLabel(3, "0xedd400", "yellow" ),
  710. "green": QubesVmLabel(4, "0x73d216", "green" ),
  711. "gray": QubesVmLabel(5, "0x555753", "gray" ),
  712. "blue": QubesVmLabel(6, "0x3465a4", "blue" ),
  713. "purple": QubesVmLabel(7, "0x75507b", "purple" ),
  714. "black": QubesVmLabel(8, "0x000000", "black" ),
  715. }
  716. QubesDispVmLabels = {
  717. "red": QubesVmLabel(1, "0xcc0000", "red", dispvm=True),
  718. "orange": QubesVmLabel(2, "0xf57900", "orange", dispvm=True),
  719. "yellow": QubesVmLabel(3, "0xedd400", "yellow", dispvm=True),
  720. "green": QubesVmLabel(4, "0x73d216", "green", dispvm=True),
  721. "gray": QubesVmLabel(5, "0x555753", "gray", dispvm=True),
  722. "blue": QubesVmLabel(6, "0x3465a4", "blue", dispvm=True),
  723. "purple": QubesVmLabel(7, "0x75507b", "purple", dispvm=True),
  724. "black": QubesVmLabel(8, "0x000000", "black", dispvm=True),
  725. }
  726. defaults["appvm_label"] = QubesVmLabels["red"]
  727. defaults["template_label"] = QubesVmLabels["black"]
  728. defaults["servicevm_label"] = QubesVmLabels["red"]
  729. QubesVmClasses = {}
  730. modules_dir = os.path.join(os.path.dirname(__file__), 'modules')
  731. for module_file in sorted(os.listdir(modules_dir)):
  732. if not module_file.endswith(".py") or module_file == "__init__.py":
  733. continue
  734. __import__('qubes.modules.%s' % module_file[:-3])
  735. try:
  736. import qubes.settings
  737. qubes.settings.apply(system_path, vm_files, defaults)
  738. except ImportError:
  739. pass
  740. for path_key in system_path.keys():
  741. if not os.path.isabs(system_path[path_key]):
  742. system_path[path_key] = os.path.join(
  743. system_path['qubes_base_dir'], system_path[path_key])
  744. # vim:sw=4:et: