core_features.py 3.5 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586
  1. # -*- encoding: utf-8 -*-
  2. #
  3. # The Qubes OS Project, http://www.qubes-os.org
  4. #
  5. # Copyright (C) 2017 Marek Marczykowski-Górecki
  6. # <marmarek@invisiblethingslab.com>
  7. #
  8. # This library is free software; you can redistribute it and/or
  9. # modify it under the terms of the GNU Lesser General Public
  10. # License as published by the Free Software Foundation; either
  11. # version 2.1 of the License, or (at your option) any later version.
  12. #
  13. # This library is distributed in the hope that it will be useful,
  14. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  15. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16. # Lesser General Public License for more details.
  17. #
  18. # You should have received a copy of the GNU Lesser General Public
  19. # License along with this library; if not, see <https://www.gnu.org/licenses/>.
  20. import asyncio
  21. import qubes.ext
  22. class CoreFeatures(qubes.ext.Extension):
  23. # pylint: disable=too-few-public-methods
  24. @qubes.ext.handler('features-request')
  25. @asyncio.coroutine
  26. def qubes_features_request(self, vm, event, untrusted_features):
  27. '''Handle features provided by qubes-core-agent and qubes-gui-agent'''
  28. # pylint: disable=no-self-use,unused-argument
  29. if getattr(vm, 'template', None):
  30. vm.log.warning(
  31. 'Ignoring qubes.NotifyTools for template-based VM')
  32. return
  33. requested_features = {}
  34. for feature in (
  35. 'qrexec', 'gui', 'gui-emulated', 'qubes-firewall', 'vmexec'):
  36. untrusted_value = untrusted_features.get(feature, None)
  37. if untrusted_value in ('1', '0'):
  38. requested_features[feature] = bool(int(untrusted_value))
  39. del untrusted_features
  40. # default user for qvm-run etc
  41. # starting with Qubes 4.x ignored
  42. # qrexec agent presence (0 or 1)
  43. # gui agent presence (0 or 1)
  44. qrexec_before = vm.features.get('qrexec', False)
  45. for feature in ('qrexec', 'gui', 'gui-emulated'):
  46. # do not allow (Template)VM to override setting if already set
  47. # some other way
  48. if feature in requested_features and feature not in vm.features:
  49. vm.features[feature] = requested_features[feature]
  50. # those features can be freely enabled or disabled by template
  51. for feature in ('qubes-firewall', 'vmexec'):
  52. if feature in requested_features:
  53. vm.features[feature] = requested_features[feature]
  54. if not qrexec_before and vm.features.get('qrexec', False):
  55. # if this is the first time qrexec was advertised, now can finish
  56. # template setup
  57. yield from vm.fire_event_async('template-postinstall')
  58. # pylint: disable=no-self-use
  59. def set_servicevm_feature(self, subject):
  60. if getattr(subject, 'provides_network', False):
  61. subject.features['servicevm'] = 1
  62. elif 'servicevm' in subject.features:
  63. del subject.features['servicevm']
  64. @qubes.ext.handler('property-set:provides_network')
  65. def on_property_set(self, subject, event, name, newvalue, oldvalue=None):
  66. # pylint: disable=unused-argument
  67. self.set_servicevm_feature(subject)
  68. @qubes.ext.handler('property-del:provides_network')
  69. def on_property_del(self, subject, event, name):
  70. # pylint: disable=unused-argument
  71. self.set_servicevm_feature(subject)
  72. @qubes.ext.handler('domain-load')
  73. def on_domain_load(self, subject, event):
  74. # pylint: disable=unused-argument
  75. self.set_servicevm_feature(subject)