Provide stub files in /rw/config

vm-init.d/qubes-core

@@ -68,7 +68,40 @@ start()
             echo "--> Virgin boot of the VM: Linking /home to /rw/home"
 
             mkdir -p /rw/config
-            touch /rw/config/rc.local
+			cat > /rw/config/rc.local <<EOF
+#!/bin/sh
+
+# This script will be executed at every VM startup, you can place your own
+# custom commands here. This include overriding some configuration in /etc,
+# starting services etc.
+#
+# You need to make this script executable to have it enabled.
+
+# Example for overriding the whole CUPS configuration:
+#  rm -rf /etc/cups
+#  ln -s /rw/config/cups /etc/cups
+#  systemctl --no-block restart cups
+EOF
+
+			touch /rw/config/qubes-firewall-user-script
+			cat > /rw/config/qubes-firewall-user-script <<EOF
+#!/bin/sh
+
+# This script is called in ProxyVM after firewall every update (configuration
+# change, starting some VM etc). This is good place to write own custom
+# firewall rules, in addition to autogenerated one. Remember that in most cases
+# you'll need to insert the rules at the beginning (iptables -I) to have it
+# efective.
+#
+# You need to make this script executable to have it enabled.
+EOF
+
+			touch /rw/config/suspend-module-blacklist
+			cat > /rw/config/suspend-module-blacklist <<EOF
+# You can list here modules you want to be unloaded before going to sleep. This
+# file is used only if the VM has any PCI device assigned. Modules will be
+# automatically loaded after resume.
+EOF
 
             mkdir -p /rw/home
             cp -a /home.orig/user /rw/home

vm-systemd/mount-home.sh

@@ -18,7 +18,40 @@ if ! [ -d /rw/home ] ; then
 
     mkdir -p /rw/config
     touch /rw/config/rc.local
-    touch /rw/config/rc.local-early
+    cat > /rw/config/rc.local <<EOF
+#!/bin/sh
+
+# This script will be executed at every VM startup, you can place your own
+# custom commands here. This include overriding some configuration in /etc,
+# starting services etc.
+#
+# You need to make this script executable to have it enabled.
+
+# Example for overriding the whole CUPS configuration:
+#  rm -rf /etc/cups
+#  ln -s /rw/config/cups /etc/cups
+#  systemctl --no-block restart cups
+EOF
+
+    touch /rw/config/qubes-firewall-user-script
+    cat > /rw/config/qubes-firewall-user-script <<EOF
+#!/bin/sh
+
+# This script is called in ProxyVM after firewall every update (configuration
+# change, starting some VM etc). This is good place to write own custom
+# firewall rules, in addition to autogenerated one. Remember that in most cases
+# you'll need to insert the rules at the beginning (iptables -I) to have it
+# efective.
+#
+# You need to make this script executable to have it enabled.
+EOF
+
+    touch /rw/config/suspend-module-blacklist
+    cat > /rw/config/suspend-module-blacklist <<EOF
+# You can list here modules you want to be unloaded before going to sleep. This
+# file is used only if the VM has any PCI device assigned. Modules will be
+# automatically loaded after resume.
+EOF
 
     mkdir -p /rw/home
     cp -a /home.orig/user /rw/home