Qubes/core-agent-linux
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
951b25e8c5
core-agent-linux/vm-systemd/75-qubes-vm.preset

117 lines
3.8 KiB
Plaintext
Raw Normal View History

Switch to preset file for systemd units to disable.
2015-02-08 00:08:26 +01:00
# Units that should not run by default in Qubes VMs.
#
# This file is part of the qubes-core-vm-systemd package. To ensure that the
# default configuration is applied to all units in the list regardless of
# package installation order, including units added to the list by
# qubes-core-vm-systemd upgrades, all units in the list are preset by a
# scriptlet every time qubes-core-vm-systemd is installed or upgraded. That
# means that to permanently enable a unit with an [Install] section, you must
# create your own higher-priority preset file. (It might be possible to be
# smarter and keep a list of units previously preset, but this is not
# implemented.)
#
# For units below with no [Install] section, the scriptlet masks them instead.
# Qubes currently does not provide a way to permanently prevent such units from
# being masked.
#
Clean up specfile unit activation aspect. Up until today, Qubes OS would insist on either masking or disabling or activating units that should get their state properly changed but only on first package install (when the template is built). This commit adds the possibility of having two types of unit presets: * Initial presets: these are only changed state during first package installs. * Upgrade presets: these get their state changed during first package installs as well as during upgrades. All the maintainer has to do is abide by the instructions in the preset file. Nothing else is necessary. Namely, this allows users to enable SSHD on their templates or standalone VMs and still keep it enabled even after the qubes-core-vm-systemd package is upgraded. Matt really wanted that, and so did I, so now we can do it! :-)
2016-10-28 07:47:59 +02:00
# Maintainer information:
#
# * All units listed here are preset during first install of the *-systemd RPM.
# For those units which are disabled here, but don't have an install section
# (static units), we mask them during that install.
# * All units listed here that find themselves below the comment titled
# "# Units below this line will be re-preset on package upgrade"
# are preset both during install and during upgrade. This allows you to add
# new units here and have them become active when the user's machine upgrades
# their *-systemd RPM built by this project.
#
# Hi, Matt! I see you did great with this conversion to systemd presets!
# Thank you! Skyler sends you her regards from Europe!
# - Rudd-O
#
Switch to preset file for systemd units to disable.
2015-02-08 00:08:26 +01:00
# https://groups.google.com/d/topic/qubes-users/dpM_GHfmEOk/discussion
disable avahi.service
disable avahi-daemon.service
systemd: disable avahi-daemon and dnf-makecache Especially dnf-makecache is senseless as its state will not survive VM restart, but it takes a lot of CPU time.
2015-04-10 18:23:14 +02:00
disable avahi-daemon.socket
Clean up specfile unit activation aspect. Up until today, Qubes OS would insist on either masking or disabling or activating units that should get their state properly changed but only on first package install (when the template is built). This commit adds the possibility of having two types of unit presets: * Initial presets: these are only changed state during first package installs. * Upgrade presets: these get their state changed during first package installs as well as during upgrades. All the maintainer has to do is abide by the instructions in the preset file. Nothing else is necessary. Namely, this allows users to enable SSHD on their templates or standalone VMs and still keep it enabled even after the qubes-core-vm-systemd package is upgraded. Matt really wanted that, and so did I, so now we can do it! :-)
2016-10-28 07:47:59 +02:00
# Fedora only services
disable rpcbind.service
disable sendmail.service
disable sm-client.service
disable sshd.service
disable backuppc.service
# Units below this line will be re-preset on package upgrade
disable alsa-store.service
disable alsa-restore.service
Re-aranged qubes-vm.preset to indicate which services are specificly for Fedora only
2015-07-24 11:05:25 +02:00
disable hwclock-save.service
disable mdmonitor.service
disable plymouth-start.service
disable plymouth-read-write.service
disable plymouth-quit.service
disable plymouth-quit-wait.service
disable smartd.service
disable upower.service
disable colord.service
Disable wpa_supplicant@.service (cherry picked from commit 51f80d39a1064dd6075ccf6af1d5ba78fba6327c)
2017-12-14 21:40:04 +01:00
disable wpa_supplicant@.service
Do not start dkms.service It doesn't make sense in Qubes to rebuild modules at every VM startup. Especially when modules dir is either read-only, or on non-persistent root volume (TemplateBasedVM). This is especially uneeded for dom0-provided kernels, which already have u2mfn module built, but DKMS try to rebuild it anyway (and fails, because of missing/broken kernel-devel package). DKMS already have appropriate (rpm/dpkg) hooks for new kernel installation, so actually needed modules should be build in template on kernel update/install anyway. This saves about 2s from VM startup time.
2018-04-04 01:50:40 +02:00
disable dkms.service
Re-aranged qubes-vm.preset to indicate which services are specificly for Fedora only
2015-07-24 11:05:25 +02:00
# Fedora only services
Switch to preset file for systemd units to disable.
2015-02-08 00:08:26 +01:00
disable cpuspeed.service
systemd: disable avahi-daemon and dnf-makecache Especially dnf-makecache is senseless as its state will not survive VM restart, but it takes a lot of CPU time.
2015-04-10 18:23:14 +02:00
disable dnf-makecache.timer
Switch to preset file for systemd units to disable.
2015-02-08 00:08:26 +01:00
disable fedora-autorelabel.service
disable fedora-autorelabel-mark.service
Re-aranged qubes-vm.preset to indicate which services are specificly for Fedora only
2015-07-24 11:05:25 +02:00
disable fedora-storage-init.service
disable fedora-storage-init-late.service
Switch to preset file for systemd units to disable.
2015-02-08 00:08:26 +01:00
disable hwclock-load.service
Re-aranged qubes-vm.preset to indicate which services are specificly for Fedora only
2015-07-24 11:05:25 +02:00
disable ipmi.service
network: use own iptables service instead of repurposing existing one There were multiple problems with reusing existing one: - need to sync with upstream changes (configuration path etc) - conflicts resolution on updates - lack of iptables --wait, which causes firewall fail to load sometimes QubesOS/qubes-issues#1067
2015-08-04 17:15:01 +02:00
disable iptables.service
disable ip6tables.service
Re-aranged qubes-vm.preset to indicate which services are specificly for Fedora only
2015-07-24 11:05:25 +02:00
disable irqbalance.service
disable mcelog.service
disable mdmonitor-takeover.service
Switch to preset file for systemd units to disable.
2015-02-08 00:08:26 +01:00
disable multipathd.service
disable openct.service
Re-aranged qubes-vm.preset to indicate which services are specificly for Fedora only
2015-07-24 11:05:25 +02:00
disable rngd.service
Switch to preset file for systemd units to disable.
2015-02-08 00:08:26 +01:00
disable tcsd.service
systemd: use presets to enable services, call preset-all This way the services will be enabled/disabled regardless of its initial state.
2015-04-07 02:30:59 +02:00
Disable unnecessary services in Debian
2020-02-15 22:12:34 +01:00
# Debian only services
disable apt-daily-upgrade.timer
disable apt-daily.timer
disable cups-browsed.service
disable avahi-daemon.socket
systemd: use presets to enable services, call preset-all This way the services will be enabled/disabled regardless of its initial state.
2015-04-07 02:30:59 +02:00
enable qubes-sysinit.service
Fix VM settings running while / is readonly.
2016-10-28 07:21:33 +02:00
enable qubes-early-vm-config.service
systemd: use presets to enable services, call preset-all This way the services will be enabled/disabled regardless of its initial state.
2015-04-07 02:30:59 +02:00
enable qubes-db.service
enable qubes-gui-agent.service
enable qubes-update-check.timer
enable qubes-misc-post.service
enable qubes-updates-proxy.service
enable qubes-network.service
Move network uplink setup to a separate service Previously, network uplink (eth0) was configured in two places: - udev (asynchronously) - qubes-misc-post.service - at the very end of the boot process This caused multiple issues: 1. Depending on udev event processing (non-deterministic), network uplink could be enabled too early, for example before setting up firewall. 2. Again depending on udev processing, it can be enabled quite late in the boot process, after network.target is up and services assume network already configured. This for example causes qubes-firewall to fail DNS queries. 3. If udev happen try to enable enable networking even earlier, it may happend before qubesdb-daemon is started, in which case network setup fill fail. For this case, there was network re-setup in qubes-misc-post service - much later in the boot. Fix the above by placing network uplink setup in a dedicated qubes-network-uplink@${INTERFACE}.service unit ordered after network-pre.target and pulled in by udev based on vif device existence, to handle also dynamic network attach/detach. Then, create qubes-network-uplink.service unit waiting for appropriate interface-specific unit (if one is expected!) and order it before network.target. QubesOS/qubes-issues#5576
2020-11-12 01:37:12 +01:00
enable qubes-network-uplink.service
systemd: use presets to enable services, call preset-all This way the services will be enabled/disabled regardless of its initial state.
2015-04-07 02:30:59 +02:00
enable qubes-qrexec-agent.service
Renamed qubes-mount-home to qubes-mount-dirs. Renamed qubes-mount-home service and mount-home.sh script to qubes-mount-dirs service and mount-dirs.sh. Because mount-home.sh also processed /rw/usrlocal. preparation to fix the following issues: - upstream bind-directories functionality to Qubes - https://phabricator.whonix.org/T414 - Bind mount /rw/usrlocal -> /usr/local instead of symlink - https://github.com/QubesOS/qubes-issues/issues/1150 - /bin/sync hangs forever in whonix-ws-dvm - https://github.com/QubesOS/qubes-issues/issues/1328
2015-10-14 21:09:49 +02:00
enable qubes-mount-dirs.service
Resize root filesystem at VM startup if needed Check if root device was enlarged while domain was powered off and resize the filesystem in such a case. QubesOS/qubes-issues#3173 QubesOS/qubes-issues#3143
2017-10-18 16:57:39 +02:00
enable qubes-rootfs-resize.service
systemd: use presets to enable services, call preset-all This way the services will be enabled/disabled regardless of its initial state.
2015-04-07 02:30:59 +02:00
enable qubes-firewall.service
enable qubes-meminfo-writer.service
network: use own iptables service instead of repurposing existing one There were multiple problems with reusing existing one: - need to sync with upstream changes (configuration path etc) - conflicts resolution on updates - lack of iptables --wait, which causes firewall fail to load sometimes QubesOS/qubes-issues#1067
2015-08-04 17:15:01 +02:00
enable qubes-iptables.service
Implement qrexec-based connection to updates proxy Configure package manager to use 127.0.0.1:8082 as proxy instead of "magic" IP intercepted later. The listen on this port and whenever new connection arrives, spawn qubes.UpdatesProxy service call (to default target domain - subject to configuration in dom0) and connect its stdin/out to the local TCP connection. This part use systemd.socket unit in case of systemd, and ncat --exec otherwise. On the other end - in target domain - simply pass stdin/out to updates proxy (tinyproxy) running locally. It's important to _not_ configure the same VM to both be updates proxy and use it. In practice such configuration makes little sense - if VM can access network (which is required to run updates proxy), package manager can use it directly. Even if this network access is through some VPN/Tor. If a single VM would be configured as both proxy provider and proxy user, connection would loop back to itself. Because of this, proxy connection redirection (to qrexec service) is disabled when the same VM also run updates proxy. Fixes QubesOS/qubes-issues#1854
2017-05-26 03:07:47 +02:00
enable qubes-updates-proxy-forwarder.socket
systemd: use presets to enable services, call preset-all This way the services will be enabled/disabled regardless of its initial state.
2015-04-07 02:30:59 +02:00
enable haveged.service
enable chronyd.service
Enable xendriverdomain.service in 75-qubes-vm.preset
2016-07-03 07:00:29 +02:00
enable xendriverdomain.service
clock synchronization rewrite clock synchronization mechanism rewritten to use systemd-timesync instead of NtpDate; at the moment, requires: - modifying /etc/qubes-rpc/policy/qubes.GetDate to redirect GetDate to designated clockvm - enabling clocksync service in clockvm ( qvm-features clockvm-name service/clocksync true ) Works as specified in issue listed below, except for: - each VM synces with clockvm after boot and every 6h - clockvm synces time with the Internet using systemd-timesync - dom0 synces itself with clockvm every 1h (using cron) fixes QubesOS/qubes-issues#1230
2017-07-06 23:37:26 +02:00
enable systemd-timesyncd.service
enable qubes-sync-time.service
Resize root filesystem at VM startup if needed Check if root device was enlarged while domain was powered off and resize the filesystem in such a case. QubesOS/qubes-issues#3173 QubesOS/qubes-issues#3143
2017-10-18 16:57:39 +02:00
enable qubes-sync-time.timer
vm-systemd: enable dummy modules and psu client
2020-09-20 15:12:39 +02:00
enable module-load-dummy-psu.service
enable module-load-dummy-backlight.service
preset: handle dom0 and sys-usb qubes-psu-client
2020-10-03 19:34:58 +02:00
enable qubes-psu-client@.service default sys-usb
Add a service to enable swap early - before fsck of the root filesystem fsck may require significant amount of RAM, enable swap earlier to avoid out of memory condition. Implement this as a separate service unit, not a swap unit, because the latter requires udev running (implicit dependency on dev-xvdc1.device) which is not the case before remounting root filesystem read-write. QubesOS/qubes-issues#6174
2020-11-02 04:46:31 +01:00
enable dev-xvdc1-swap.service
Disable useless Xen services in Qubes VM since we use upstream package QubesOS/qubes-issues#3945
2019-04-14 12:59:41 +02:00
# Disable useless Xen services in Qubes VM
disable xenstored.service
disable xenconsoled.service
Drop legacy xen entry in fstab
2020-07-24 16:07:39 +02:00
disable proc-xen.mount
Reference in New Issue Copy Permalink