NetVM, AppVM, ProxyVM from single template - VM side (missing files...)
This commit is contained in:
Marek Marczykowski
parent
c87b15ba2a
commit
4c0849890c
82
appvm/qubes_core_appvm
Executable file
82
appvm/qubes_core_appvm
Executable file
@ -0,0 +1,82 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# chkconfig: 345 85 85
|
||||
# description: Executes Qubes core scripts at AppVM boot
|
||||
#
|
||||
# Source function library.
|
||||
. /etc/rc.d/init.d/functions
|
||||
|
||||
possibly_run_save_script()
|
||||
{
|
||||
ENCODED_SCRIPT=$(xenstore-read qubes_save_script)
|
||||
if [ -z "$ENCODED_SCRIPT" ] ; then return ; fi
|
||||
echo $ENCODED_SCRIPT|perl -e 'use MIME::Base64 qw(decode_base64); local($/) = undef;print decode_base64(<STDIN>)' >/tmp/qubes_save_script
|
||||
chmod 755 /tmp/qubes_save_script
|
||||
Xorg -config /etc/X11/xorg-preload-apps.conf :0 &
|
||||
sleep 2
|
||||
DISPLAY=:0 su - user -c /tmp/qubes_save_script
|
||||
killall Xorg
|
||||
}
|
||||
|
||||
start()
|
||||
{
|
||||
if ! [ -x /usr/bin/xenstore-read ] ; then
|
||||
echo "ERROR: /usr/bin/xenstore-read not found!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
type=$(/usr/bin/xenstore-read qubes_vm_type)
|
||||
if [ "$type" != "AppVM" -a "$type" != "DisposableVM" ]; then
|
||||
# This script runs only on AppVMs
|
||||
return 0
|
||||
fi
|
||||
|
||||
# Start AppVM specific services
|
||||
/sbin/service cups start
|
||||
|
||||
echo -n $"Executing Qubes Core scripts for AppVM:"
|
||||
|
||||
if xenstore-read qubes_save_request 2>/dev/null ; then
|
||||
ln -sf /home_volatile /home
|
||||
possibly_run_save_script
|
||||
touch /etc/this_is_dvm
|
||||
dmesg -c >/dev/null
|
||||
free | grep Mem: |
|
||||
(read a b c d ; xenstore-write device/qubes_used_mem $c)
|
||||
# we're still running in DispVM template
|
||||
echo "Waiting for save/restore..."
|
||||
# ... wait until qubes_restore.c (in Dom0) recreates VM-specific keys
|
||||
while ! xenstore-read qubes_restore_complete 2>/dev/null ; do
|
||||
usleep 10
|
||||
done
|
||||
echo Back to life.
|
||||
fi
|
||||
|
||||
MEM_CHANGE_THRESHOLD_KB=30000
|
||||
MEMINFO_DELAY_USEC=100000
|
||||
/usr/lib/qubes/meminfo-writer $MEM_CHANGE_THRESHOLD_KB $MEMINFO_DELAY_USEC &
|
||||
|
||||
success
|
||||
echo ""
|
||||
return 0
|
||||
}
|
||||
|
||||
stop()
|
||||
{
|
||||
return 0
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
start)
|
||||
start
|
||||
;;
|
||||
stop)
|
||||
stop
|
||||
;;
|
||||
*)
|
||||
echo $"Usage: $0 {start|stop}"
|
||||
exit 3
|
||||
;;
|
||||
esac
|
||||
|
||||
exit $RETVAL
|
||||
166
rpm_spec/core-commonvm.spec
Normal file
166
rpm_spec/core-commonvm.spec
Normal file
@ -0,0 +1,166 @@
|
||||
#
|
||||
# The Qubes OS Project, http://www.qubes-os.org
|
||||
#
|
||||
# Copyright (C) 2010 Joanna Rutkowska <joanna@invisiblethingslab.com>
|
||||
# Copyright (C) 2010 Rafal Wojtczuk <rafal@invisiblethingslab.com>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License
|
||||
# as published by the Free Software Foundation; either version 2
|
||||
# of the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
||||
#
|
||||
#
|
||||
|
||||
%{!?version: %define version %(cat version_vm)}
|
||||
|
||||
Name: qubes-core-commonvm
|
||||
Version: %{version}
|
||||
Release: 1
|
||||
Summary: The Qubes core files for any VM
|
||||
|
||||
Group: Qubes
|
||||
Vendor: Invisible Things Lab
|
||||
License: GPL
|
||||
URL: http://www.qubes-os.org
|
||||
Requires: /usr/bin/xenstore-read
|
||||
Requires: fedora-release = 13
|
||||
|
||||
%define _builddir %(pwd)/common
|
||||
|
||||
%description
|
||||
The Qubes core files for installation inside a Qubes VM.
|
||||
|
||||
%pre
|
||||
|
||||
if [ "$1" != 1 ] ; then
|
||||
# do this whole %pre thing only when updating for the first time...
|
||||
exit 0
|
||||
fi
|
||||
|
||||
mkdir -p $RPM_BUILD_ROOT/var/lib/qubes
|
||||
if [ -e $RPM_BUILD_ROOT/etc/fstab ] ; then
|
||||
mv $RPM_BUILD_ROOT/etc/fstab $RPM_BUILD_ROOT/var/lib/qubes/fstab.orig
|
||||
fi
|
||||
|
||||
%install
|
||||
|
||||
mkdir -p $RPM_BUILD_ROOT/etc
|
||||
cp fstab $RPM_BUILD_ROOT/etc/fstab
|
||||
mkdir -p $RPM_BUILD_ROOT/etc/init.d
|
||||
cp qubes_core $RPM_BUILD_ROOT/etc/init.d/
|
||||
mkdir -p $RPM_BUILD_ROOT/var/lib/qubes
|
||||
mkdir -p $RPM_BUILD_ROOT/etc/sysconfig
|
||||
cp iptables $RPM_BUILD_ROOT/etc/sysconfig/
|
||||
mkdir -p $RPM_BUILD_ROOT/etc/yum.repos.d
|
||||
cp ../appvm/qubes.repo $RPM_BUILD_ROOT/etc/yum.repos.d
|
||||
mkdir -p $RPM_BUILD_ROOT/sbin
|
||||
cp ../common/qubes_serial_login $RPM_BUILD_ROOT/sbin
|
||||
mkdir -p $RPM_BUILD_ROOT/etc
|
||||
cp ../common/serial.conf $RPM_BUILD_ROOT/var/lib/qubes/
|
||||
|
||||
%triggerin -- initscripts
|
||||
cp /var/lib/qubes/serial.conf /etc/init/serial.conf
|
||||
|
||||
%post
|
||||
|
||||
if [ "$1" != 1 ] ; then
|
||||
# do this whole %post thing only when updating for the first time...
|
||||
exit 0
|
||||
fi
|
||||
|
||||
usermod -L root
|
||||
if ! [ -f /var/lib/qubes/serial.orig ] ; then
|
||||
cp /etc/init/serial.conf /var/lib/qubes/serial.orig
|
||||
fi
|
||||
|
||||
#echo "--> Disabling SELinux..."
|
||||
sed -e s/^SELINUX=.*$/SELINUX=disabled/ </etc/selinux/config >/etc/selinux/config.processed
|
||||
mv /etc/selinux/config.processed /etc/selinux/config
|
||||
setenforce 0 2>/dev/null
|
||||
|
||||
#echo "--> Turning off unnecessary services..."
|
||||
# FIXME: perhaps there is more elegant way to do this?
|
||||
for f in /etc/init.d/*
|
||||
do
|
||||
srv=`basename $f`
|
||||
[ $srv = 'functions' ] && continue
|
||||
[ $srv = 'killall' ] && continue
|
||||
[ $srv = 'halt' ] && continue
|
||||
[ $srv = 'single' ] && continue
|
||||
[ $srv = 'qubes_gui' ] && continue
|
||||
chkconfig $srv off
|
||||
done
|
||||
|
||||
#echo "--> Enabling essential services..."
|
||||
chkconfig rsyslog on
|
||||
chkconfig haldaemon on
|
||||
chkconfig messagebus on
|
||||
chkconfig iptables on
|
||||
chkconfig --add qubes_core || echo "WARNING: Cannot add service qubes_core!"
|
||||
chkconfig qubes_core on || echo "WARNING: Cannot enable service qubes_core!"
|
||||
|
||||
|
||||
# TODO: make this not display the silly message about security context...
|
||||
sed -i s/^id:.:initdefault:/id:3:initdefault:/ /etc/inittab
|
||||
|
||||
# Remove most of the udev scripts to speed up the VM boot time
|
||||
# Just leave the xen* scripts, that are needed if this VM was
|
||||
# ever used as a net backend (e.g. as a VPN domain in the future)
|
||||
#echo "--> Removing unnecessary udev scripts..."
|
||||
mkdir -p /var/lib/qubes/removed-udev-scripts
|
||||
for f in /etc/udev/rules.d/*
|
||||
do
|
||||
if [ $(basename $f) == "xen-backend.rules" ] ; then
|
||||
continue
|
||||
fi
|
||||
|
||||
if [ $(basename $f) == "xend.rules" ] ; then
|
||||
continue
|
||||
fi
|
||||
|
||||
if [ $(basename $f) == "qubes.rules" ] ; then
|
||||
continue
|
||||
fi
|
||||
|
||||
if [ $(basename $f) == "90-hal.rules" ] ; then
|
||||
continue
|
||||
fi
|
||||
|
||||
|
||||
mv $f /var/lib/qubes/removed-udev-scripts/
|
||||
done
|
||||
mkdir -p /rw
|
||||
#rm -f /etc/mtab
|
||||
#echo "--> Removing HWADDR setting from /etc/sysconfig/network-scripts/ifcfg-eth0"
|
||||
#mv /etc/sysconfig/network-scripts/ifcfg-eth0 /etc/sysconfig/network-scripts/ifcfg-eth0.orig
|
||||
#grep -v HWADDR /etc/sysconfig/network-scripts/ifcfg-eth0.orig > /etc/sysconfig/network-scripts/ifcfg-eth0
|
||||
|
||||
%preun
|
||||
if [ "$1" = 0 ] ; then
|
||||
# no more packages left
|
||||
chkconfig qubes_core off
|
||||
mv /var/lib/qubes/fstab.orig /etc/fstab
|
||||
mv /var/lib/qubes/removed-udev-scripts/* /etc/udev/rules.d/
|
||||
mv /var/lib/qubes/serial.orig /etc/init/serial.conf
|
||||
fi
|
||||
|
||||
%clean
|
||||
rm -rf $RPM_BUILD_ROOT
|
||||
|
||||
%files
|
||||
%defattr(-,root,root,-)
|
||||
/etc/fstab
|
||||
/etc/init.d/qubes_core
|
||||
/etc/sysconfig/iptables
|
||||
/var/lib/qubes
|
||||
/etc/yum.repos.d/qubes.repo
|
||||
/sbin/qubes_serial_login
|
||||
77
rpm_spec/core-proxyvm.spec
Normal file
77
rpm_spec/core-proxyvm.spec
Normal file
@ -0,0 +1,77 @@
|
||||
#
|
||||
# The Qubes OS Project, http://www.qubes-os.org
|
||||
#
|
||||
# Copyright (C) 2010 Joanna Rutkowska <joanna@invisiblethingslab.com>
|
||||
# Copyright (C) 2010 Rafal Wojtczuk <rafal@invisiblethingslab.com>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License
|
||||
# as published by the Free Software Foundation; either version 2
|
||||
# of the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
||||
#
|
||||
#
|
||||
|
||||
%{!?version: %define version %(cat version_vm)}
|
||||
|
||||
Name: qubes-core-proxyvm
|
||||
Version: %{version}
|
||||
Release: 1
|
||||
Summary: The Qubes core files for NetVM
|
||||
|
||||
Group: Qubes
|
||||
Vendor: Invisible Things Lab
|
||||
License: GPL
|
||||
URL: http://www.qubes-os.org
|
||||
Requires: /usr/bin/xenstore-read
|
||||
Requires: /sbin/ethtool
|
||||
Requires: fedora-release = 13
|
||||
Requires: qubes-core-netvm
|
||||
|
||||
%define _builddir %(pwd)/proxyvm
|
||||
|
||||
%description
|
||||
The Qubes core files for installation inside a Qubes ProxyVM in addition to NetVM scripts.
|
||||
|
||||
%pre
|
||||
|
||||
%build
|
||||
|
||||
%install
|
||||
|
||||
mkdir -p $RPM_BUILD_ROOT/etc/init.d
|
||||
cp init.d/qubes_firewall $RPM_BUILD_ROOT/etc/init.d/
|
||||
mkdir -p $RPM_BUILD_ROOT/usr/sbin
|
||||
cp bin/qubes_firewall $RPM_BUILD_ROOT/usr/sbin/
|
||||
|
||||
%post
|
||||
|
||||
if [ "$1" != 1 ] ; then
|
||||
# do this whole %post thing only when updating for the first time...
|
||||
exit 0
|
||||
fi
|
||||
|
||||
chkconfig --add qubes_firewall || echo "WARNING: Cannot add service qubes_core!"
|
||||
chkconfig qubes_firewall on || echo "WARNING: Cannot enable service qubes_core!"
|
||||
|
||||
%preun
|
||||
if [ "$1" = 0 ] ; then
|
||||
# no more packages left
|
||||
chkconfig qubes_firewall off
|
||||
fi
|
||||
|
||||
%clean
|
||||
rm -rf $RPM_BUILD_ROOT
|
||||
|
||||
%files
|
||||
%defattr(-,root,root,-)
|
||||
/etc/init.d/qubes_firewall
|
||||
/usr/sbin/qubes_firewall
|
||||
Loading…
Reference in New Issue
Block a user