NetVM, AppVM, ProxyVM from single template - VM side
Modify VM packages to: - do not conflicts - starts services if its VM type need it Added core-proxyvm (firewall) and core-commonvm (common parts) packages.
This commit is contained in:
Marek Marczykowski
parent
f5e526f2c3
commit
c87b15ba2a
6
Makefile
6
Makefile
@ -5,20 +5,26 @@ help:
|
||||
@echo "make update-repo-testing -- same, but to -testing repo"
|
||||
|
||||
rpms:
|
||||
rpmbuild --define "_rpmdir $(RPMS_DIR)" -bb rpm_spec/core-commonvm.spec
|
||||
rpmbuild --define "_rpmdir $(RPMS_DIR)" -bb rpm_spec/core-appvm.spec
|
||||
rpmbuild --define "_rpmdir $(RPMS_DIR)" -bb rpm_spec/core-netvm.spec
|
||||
rpmbuild --define "_rpmdir $(RPMS_DIR)" -bb rpm_spec/core-proxyvm.spec
|
||||
rpmbuild --define "_rpmdir $(RPMS_DIR)" -bb rpm_spec/core-dom0.spec
|
||||
rpm --addsign $(RPMS_DIR)/x86_64/*.rpm
|
||||
|
||||
update-repo:
|
||||
ln -f $(RPMS_DIR)/x86_64/qubes-core-dom0-*.rpm ../yum/r1/dom0/rpm/
|
||||
ln -f $(RPMS_DIR)/x86_64/qubes-core-appvm-*.rpm ../yum/r1/appvm/rpm/
|
||||
ln -f $(RPMS_DIR)/x86_64/qubes-core-commonvm-*.rpm ../yum/r1/netvm/rpm/
|
||||
ln -f $(RPMS_DIR)/x86_64/qubes-core-netvm-*.rpm ../yum/r1/netvm/rpm/
|
||||
ln -f $(RPMS_DIR)/x86_64/qubes-core-proxyvm-*.rpm ../yum/r1/netvm/rpm/
|
||||
|
||||
update-repo-testing:
|
||||
ln -f $(RPMS_DIR)/x86_64/qubes-core-dom0-*.rpm ../yum/r1-testing/dom0/rpm/
|
||||
ln -f $(RPMS_DIR)/x86_64/qubes-core-appvm-*.rpm ../yum/r1-testing/appvm/rpm/
|
||||
ln -f $(RPMS_DIR)/x86_64/qubes-core-commonvm-*.rpm ../yum/r1-testing/netvm/rpm/
|
||||
ln -f $(RPMS_DIR)/x86_64/qubes-core-netvm-*.rpm ../yum/r1-testing/netvm/rpm/
|
||||
ln -f $(RPMS_DIR)/x86_64/qubes-core-proxyvm-*.rpm ../yum/r1-testing/netvm/rpm/
|
||||
|
||||
|
||||
|
||||
|
||||
@ -6,18 +6,6 @@
|
||||
# Source function library.
|
||||
. /etc/rc.d/init.d/functions
|
||||
|
||||
possibly_run_save_script()
|
||||
{
|
||||
ENCODED_SCRIPT=$(xenstore-read qubes_save_script)
|
||||
if [ -z "$ENCODED_SCRIPT" ] ; then return ; fi
|
||||
echo $ENCODED_SCRIPT|perl -e 'use MIME::Base64 qw(decode_base64); local($/) = undef;print decode_base64(<STDIN>)' >/tmp/qubes_save_script
|
||||
chmod 755 /tmp/qubes_save_script
|
||||
Xorg -config /etc/X11/xorg-preload-apps.conf :0 &
|
||||
sleep 2
|
||||
DISPLAY=:0 su - user -c /tmp/qubes_save_script
|
||||
killall Xorg
|
||||
}
|
||||
|
||||
start()
|
||||
{
|
||||
echo -n $"Executing Qubes Core scripts:"
|
||||
@ -26,21 +14,6 @@ start()
|
||||
echo "ERROR: /usr/bin/xenstore-read not found!"
|
||||
exit 1
|
||||
fi
|
||||
if xenstore-read qubes_save_request 2>/dev/null ; then
|
||||
ln -sf /home_volatile /home
|
||||
possibly_run_save_script
|
||||
touch /etc/this_is_dvm
|
||||
dmesg -c >/dev/null
|
||||
free | grep Mem: |
|
||||
(read a b c d ; xenstore-write device/qubes_used_mem $c)
|
||||
# we're still running in DispVM template
|
||||
echo "Waiting for save/restore..."
|
||||
# ... wait until qubes_restore.c (in Dom0) recreates VM-specific keys
|
||||
while ! xenstore-read qubes_restore_complete 2>/dev/null ; do
|
||||
usleep 10
|
||||
done
|
||||
echo Back to life.
|
||||
fi
|
||||
|
||||
name=$(/usr/bin/xenstore-read name)
|
||||
if ! [ -f /etc/this_is_dvm ] ; then
|
||||
@ -81,10 +54,6 @@ start()
|
||||
fi
|
||||
fi
|
||||
|
||||
MEM_CHANGE_THRESHOLD_KB=30000
|
||||
MEMINFO_DELAY_USEC=100000
|
||||
/usr/lib/qubes/meminfo-writer $MEM_CHANGE_THRESHOLD_KB $MEMINFO_DELAY_USEC &
|
||||
|
||||
[ -x /rw/config/rc.local ] && /rw/config/rc.local
|
||||
success
|
||||
echo ""
|
||||
@ -1,67 +0,0 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# chkconfig: 345 90 90
|
||||
# description: Executes Qubes core scripts at VM boot
|
||||
#
|
||||
# Source function library.
|
||||
. /etc/rc.d/init.d/functions
|
||||
|
||||
start()
|
||||
{
|
||||
echo -n $"Executing Qubes Core scripts FirewallVM:"
|
||||
|
||||
if ! [ -x /usr/bin/xenstore-read ] ; then
|
||||
echo "ERROR: /usr/bin/xenstore-read not found!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
name=$(/usr/bin/xenstore-read name)
|
||||
hostname $name
|
||||
|
||||
# Setup gateway for all the VMs this netVM is serviceing...
|
||||
modprobe netbk
|
||||
gateway=$(/usr/bin/xenstore-read qubes_netvm_gateway)
|
||||
netmask=$(/usr/bin/xenstore-read qubes_netvm_netmask)
|
||||
network=$(/usr/bin/xenstore-read qubes_netvm_network)
|
||||
secondary_dns=$(/usr/bin/xenstore-read qubes_netvm_secondary_dns)
|
||||
echo "NS1=$gateway" > /var/run/qubes/qubes_ns
|
||||
echo "NS2=$secondary_dns" >> /var/run/qubes/qubes_ns
|
||||
/usr/lib/qubes/qubes_setup_dnat_to_ns
|
||||
echo "1" > /proc/sys/net/ipv4/ip_forward
|
||||
|
||||
# Now setup "AppVM" part of FirewallVM
|
||||
ip=$(/usr/bin/xenstore-read qubes_ip)
|
||||
netmask=$(/usr/bin/xenstore-read qubes_netmask)
|
||||
gateway=$(/usr/bin/xenstore-read qubes_gateway)
|
||||
secondary_dns=$(/usr/bin/xenstore-read qubes_secondary_dns)
|
||||
if [ x$ip != x ]; then
|
||||
/sbin/ifconfig eth0 $ip netmask 255.255.255.255 up
|
||||
/sbin/route add default dev eth0
|
||||
echo "nameserver $gateway" > /etc/resolv.conf
|
||||
echo "nameserver $secondary_dns" >> /etc/resolv.conf
|
||||
fi
|
||||
|
||||
success
|
||||
echo ""
|
||||
return 0
|
||||
}
|
||||
|
||||
stop()
|
||||
{
|
||||
return 0
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
start)
|
||||
start
|
||||
;;
|
||||
stop)
|
||||
stop
|
||||
;;
|
||||
*)
|
||||
echo $"Usage: $0 {start|stop}"
|
||||
exit 3
|
||||
;;
|
||||
esac
|
||||
|
||||
exit $RETVAL
|
||||
@ -1,42 +0,0 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# chkconfig: 345 91 91
|
||||
# description: Starts Qubes Firewall monitor
|
||||
#
|
||||
# Source function library.
|
||||
. /etc/rc.d/init.d/functions
|
||||
|
||||
PIDFILE=/var/run/qubes/qubes_firewall.pid
|
||||
|
||||
start()
|
||||
{
|
||||
echo -n $"Starting Qubes Firewall monitor:"
|
||||
/sbin/ethtool -K eth0 sg off
|
||||
/usr/bin/qubes_firewall &
|
||||
success
|
||||
echo ""
|
||||
return 0
|
||||
}
|
||||
|
||||
stop()
|
||||
{
|
||||
echo -n "Stopping Qubes Firewall monitor:"
|
||||
kill $(cat $PIDFILE) 2>/dev/null && success || failure
|
||||
echo ""
|
||||
return 0
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
start)
|
||||
start
|
||||
;;
|
||||
stop)
|
||||
stop
|
||||
;;
|
||||
*)
|
||||
echo $"Usage: $0 {start|stop}"
|
||||
exit 3
|
||||
;;
|
||||
esac
|
||||
|
||||
exit $RETVAL
|
||||
@ -1,54 +0,0 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# chkconfig: 345 90 90
|
||||
# description: Executes Qubes core scripts at VM boot
|
||||
#
|
||||
# Source function library.
|
||||
. /etc/rc.d/init.d/functions
|
||||
|
||||
start()
|
||||
{
|
||||
echo -n $"Executing Qubes Core scripts NetVM:"
|
||||
|
||||
if ! [ -x /usr/bin/xenstore-read ] ; then
|
||||
echo "ERROR: /usr/bin/xenstore-read not found!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
name=$(/usr/bin/xenstore-read name)
|
||||
hostname $name
|
||||
|
||||
# Setup gateway for all the VMs this netVM is serviceing...
|
||||
modprobe netbk
|
||||
gateway=$(/usr/bin/xenstore-read qubes_netvm_gateway)
|
||||
netmask=$(/usr/bin/xenstore-read qubes_netvm_netmask)
|
||||
network=$(/usr/bin/xenstore-read qubes_netvm_network)
|
||||
secondary_dns=$(/usr/bin/xenstore-read qubes_netvm_secondary_dns)
|
||||
echo "NS1=$gateway" > /var/run/qubes/qubes_ns
|
||||
echo "NS2=$secondary_dns" >> /var/run/qubes/qubes_ns
|
||||
/usr/lib/qubes/qubes_setup_dnat_to_ns
|
||||
echo "1" > /proc/sys/net/ipv4/ip_forward
|
||||
success
|
||||
echo ""
|
||||
return 0
|
||||
}
|
||||
|
||||
stop()
|
||||
{
|
||||
return 0
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
start)
|
||||
start
|
||||
;;
|
||||
stop)
|
||||
stop
|
||||
;;
|
||||
*)
|
||||
echo $"Usage: $0 {start|stop}"
|
||||
exit 3
|
||||
;;
|
||||
esac
|
||||
|
||||
exit $RETVAL
|
||||
58
netvm/qubes_core_netvm
Executable file
58
netvm/qubes_core_netvm
Executable file
@ -0,0 +1,58 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# chkconfig: 345 90 90
|
||||
# description: Executes Qubes core scripts at NetVM boot
|
||||
#
|
||||
# Source function library.
|
||||
. /etc/rc.d/init.d/functions
|
||||
|
||||
start()
|
||||
{
|
||||
if ! [ -x /usr/bin/xenstore-read ] ; then
|
||||
echo "ERROR: /usr/bin/xenstore-read not found!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
type=$(/usr/bin/xenstore-read qubes_vm_type)
|
||||
if [ "$type" == "NetVM" ]; then
|
||||
/sbin/service NetworkManager start
|
||||
fi
|
||||
|
||||
echo -n $"Executing Qubes Core scripts NetVM:"
|
||||
|
||||
# Setup gateway for all the VMs this netVM is serviceing...
|
||||
network=$(/usr/bin/xenstore-read qubes_netvm_network 2>/dev/null)
|
||||
if [ "x$network" != "x" ]; then
|
||||
gateway=$(/usr/bin/xenstore-read qubes_netvm_gateway)
|
||||
netmask=$(/usr/bin/xenstore-read qubes_netvm_netmask)
|
||||
secondary_dns=$(/usr/bin/xenstore-read qubes_netvm_secondary_dns)
|
||||
modprobe netbk
|
||||
echo "NS1=$gateway" > /var/run/qubes/qubes_ns
|
||||
echo "NS2=$secondary_dns" >> /var/run/qubes/qubes_ns
|
||||
/usr/lib/qubes/qubes_setup_dnat_to_ns
|
||||
echo "1" > /proc/sys/net/ipv4/ip_forward
|
||||
fi
|
||||
success
|
||||
echo ""
|
||||
return 0
|
||||
}
|
||||
|
||||
stop()
|
||||
{
|
||||
return 0
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
start)
|
||||
start
|
||||
;;
|
||||
stop)
|
||||
stop
|
||||
;;
|
||||
*)
|
||||
echo $"Usage: $0 {start|stop}"
|
||||
exit 3
|
||||
;;
|
||||
esac
|
||||
|
||||
exit $RETVAL
|
||||
48
proxyvm/init.d/qubes_firewall
Executable file
48
proxyvm/init.d/qubes_firewall
Executable file
@ -0,0 +1,48 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# chkconfig: 345 91 91
|
||||
# description: Starts Qubes Firewall monitor
|
||||
#
|
||||
# Source function library.
|
||||
. /etc/rc.d/init.d/functions
|
||||
|
||||
PIDFILE=/var/run/qubes/qubes_firewall.pid
|
||||
|
||||
start()
|
||||
{
|
||||
type=$(/usr/bin/xenstore-read qubes_vm_type)
|
||||
if [ "$type" == "ProxyVM" ]; then
|
||||
echo -n $"Starting Qubes Firewall monitor:"
|
||||
/sbin/ethtool -K eth0 sg off
|
||||
/usr/sbin/qubes_firewall &
|
||||
success
|
||||
echo ""
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
stop()
|
||||
{
|
||||
type=$(/usr/bin/xenstore-read qubes_vm_type)
|
||||
if [ "$type" == "ProxyVM" ]; then
|
||||
echo -n "Stopping Qubes Firewall monitor:"
|
||||
kill $(cat $PIDFILE) 2>/dev/null && success || failure
|
||||
echo ""
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
start)
|
||||
start
|
||||
;;
|
||||
stop)
|
||||
stop
|
||||
;;
|
||||
*)
|
||||
echo $"Usage: $0 {start|stop}"
|
||||
exit 3
|
||||
;;
|
||||
esac
|
||||
|
||||
exit $RETVAL
|
||||
@ -34,6 +34,7 @@ URL: http://www.qubes-os.org
|
||||
Requires: /usr/bin/xenstore-read
|
||||
Requires: fedora-release = 13
|
||||
Requires: /usr/bin/mimeopen
|
||||
Requires: qubes-core-commonvm
|
||||
BuildRequires: gcc
|
||||
BuildRequires: xen-devel
|
||||
Provides: qubes-core-vm
|
||||
@ -55,9 +56,6 @@ fi
|
||||
adduser --create-home user
|
||||
|
||||
mkdir -p $RPM_BUILD_ROOT/var/lib/qubes
|
||||
if [ -e $RPM_BUILD_ROOT/etc/fstab ] ; then
|
||||
mv $RPM_BUILD_ROOT/etc/fstab $RPM_BUILD_ROOT/var/lib/qubes/fstab.orig
|
||||
fi
|
||||
|
||||
%build
|
||||
make clean all
|
||||
@ -65,10 +63,8 @@ make -C ../common
|
||||
|
||||
%install
|
||||
|
||||
mkdir -p $RPM_BUILD_ROOT/etc
|
||||
cp fstab $RPM_BUILD_ROOT/etc/fstab
|
||||
mkdir -p $RPM_BUILD_ROOT/etc/init.d
|
||||
cp qubes_core $RPM_BUILD_ROOT/etc/init.d/
|
||||
cp qubes_core_appvm $RPM_BUILD_ROOT/etc/init.d/
|
||||
mkdir -p $RPM_BUILD_ROOT/var/lib/qubes
|
||||
mkdir -p $RPM_BUILD_ROOT/usr/bin
|
||||
cp qubes_timestamp qvm-copy-to-vm qvm-open-in-dvm $RPM_BUILD_ROOT/usr/bin
|
||||
@ -80,17 +76,9 @@ mkdir -p $RPM_BUILD_ROOT/%{kde_service_dir}
|
||||
cp qvm-copy.desktop qvm-dvm.desktop $RPM_BUILD_ROOT/%{kde_service_dir}
|
||||
mkdir -p $RPM_BUILD_ROOT/etc/udev/rules.d
|
||||
cp qubes.rules $RPM_BUILD_ROOT/etc/udev/rules.d
|
||||
mkdir -p $RPM_BUILD_ROOT/etc/sysconfig
|
||||
cp iptables $RPM_BUILD_ROOT/etc/sysconfig/
|
||||
mkdir -p $RPM_BUILD_ROOT/mnt/incoming
|
||||
mkdir -p $RPM_BUILD_ROOT/mnt/outgoing
|
||||
mkdir -p $RPM_BUILD_ROOT/mnt/removable
|
||||
mkdir -p $RPM_BUILD_ROOT/etc/yum.repos.d
|
||||
cp ../appvm/qubes.repo $RPM_BUILD_ROOT/etc/yum.repos.d
|
||||
mkdir -p $RPM_BUILD_ROOT/sbin
|
||||
cp ../common/qubes_serial_login $RPM_BUILD_ROOT/sbin
|
||||
mkdir -p $RPM_BUILD_ROOT/etc
|
||||
cp ../common/serial.conf $RPM_BUILD_ROOT/var/lib/qubes/
|
||||
|
||||
mkdir -p $RPM_BUILD_ROOT/etc/X11
|
||||
cp xorg-preload-apps.conf $RPM_BUILD_ROOT/etc/X11
|
||||
@ -98,9 +86,6 @@ cp xorg-preload-apps.conf $RPM_BUILD_ROOT/etc/X11
|
||||
mkdir -p $RPM_BUILD_ROOT/home_volatile/user
|
||||
chown 500:500 $RPM_BUILD_ROOT/home_volatile/user
|
||||
|
||||
%triggerin -- initscripts
|
||||
cp /var/lib/qubes/serial.conf /etc/init/serial.conf
|
||||
|
||||
%post
|
||||
|
||||
if [ "$1" != 1 ] ; then
|
||||
@ -108,81 +93,15 @@ if [ "$1" != 1 ] ; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
usermod -L root
|
||||
usermod -L user
|
||||
if ! [ -f /var/lib/qubes/serial.orig ] ; then
|
||||
cp /etc/init/serial.conf /var/lib/qubes/serial.orig
|
||||
fi
|
||||
|
||||
#echo "--> Disabling SELinux..."
|
||||
sed -e s/^SELINUX=.*$/SELINUX=disabled/ </etc/selinux/config >/etc/selinux/config.processed
|
||||
mv /etc/selinux/config.processed /etc/selinux/config
|
||||
setenforce 0 2>/dev/null
|
||||
|
||||
#echo "--> Turning off unnecessary services..."
|
||||
# FIXME: perhaps there is more elegant way to do this?
|
||||
for f in /etc/init.d/*
|
||||
do
|
||||
srv=`basename $f`
|
||||
[ $srv = 'functions' ] && continue
|
||||
[ $srv = 'killall' ] && continue
|
||||
[ $srv = 'halt' ] && continue
|
||||
[ $srv = 'single' ] && continue
|
||||
chkconfig $srv off
|
||||
done
|
||||
|
||||
#echo "--> Enabling essential services..."
|
||||
chkconfig rsyslog on
|
||||
chkconfig haldaemon on
|
||||
chkconfig messagebus on
|
||||
chkconfig cups on
|
||||
chkconfig iptables on
|
||||
chkconfig --add qubes_core || echo "WARNING: Cannot add service qubes_core!"
|
||||
chkconfig qubes_core on || echo "WARNING: Cannot enable service qubes_core!"
|
||||
|
||||
|
||||
# TODO: make this not display the silly message about security context...
|
||||
sed -i s/^id:.:initdefault:/id:3:initdefault:/ /etc/inittab
|
||||
|
||||
# Remove most of the udev scripts to speed up the VM boot time
|
||||
# Just leave the xen* scripts, that are needed if this VM was
|
||||
# ever used as a net backend (e.g. as a VPN domain in the future)
|
||||
#echo "--> Removing unnecessary udev scripts..."
|
||||
mkdir -p /var/lib/qubes/removed-udev-scripts
|
||||
for f in /etc/udev/rules.d/*
|
||||
do
|
||||
if [ $(basename $f) == "xen-backend.rules" ] ; then
|
||||
continue
|
||||
fi
|
||||
|
||||
if [ $(basename $f) == "xend.rules" ] ; then
|
||||
continue
|
||||
fi
|
||||
|
||||
if [ $(basename $f) == "qubes.rules" ] ; then
|
||||
continue
|
||||
fi
|
||||
|
||||
if [ $(basename $f) == "90-hal.rules" ] ; then
|
||||
continue
|
||||
fi
|
||||
|
||||
|
||||
mv $f /var/lib/qubes/removed-udev-scripts/
|
||||
done
|
||||
mkdir -p /rw
|
||||
#rm -f /etc/mtab
|
||||
#echo "--> Removing HWADDR setting from /etc/sysconfig/network-scripts/ifcfg-eth0"
|
||||
#mv /etc/sysconfig/network-scripts/ifcfg-eth0 /etc/sysconfig/network-scripts/ifcfg-eth0.orig
|
||||
#grep -v HWADDR /etc/sysconfig/network-scripts/ifcfg-eth0.orig > /etc/sysconfig/network-scripts/ifcfg-eth0
|
||||
chkconfig --add qubes_core_appvm || echo "WARNING: Cannot add service qubes_core!"
|
||||
chkconfig qubes_core_appvm on || echo "WARNING: Cannot enable service qubes_core!"
|
||||
|
||||
%preun
|
||||
if [ "$1" = 0 ] ; then
|
||||
# no more packages left
|
||||
chkconfig qubes_core off
|
||||
mv /var/lib/qubes/fstab.orig /etc/fstab
|
||||
mv /var/lib/qubes/removed-udev-scripts/* /etc/udev/rules.d/
|
||||
mv /var/lib/qubes/serial.orig /etc/init/serial.conf
|
||||
chkconfig qubes_core_appvm off
|
||||
fi
|
||||
|
||||
%clean
|
||||
@ -190,8 +109,7 @@ rm -rf $RPM_BUILD_ROOT
|
||||
|
||||
%files
|
||||
%defattr(-,root,root,-)
|
||||
/etc/fstab
|
||||
/etc/init.d/qubes_core
|
||||
/etc/init.d/qubes_core_appvm
|
||||
/usr/bin/qvm-copy-to-vm
|
||||
/usr/lib/qubes/qvm-copy-to-vm.kde
|
||||
%attr(4755,root,root) /usr/bin/qvm-open-in-dvm
|
||||
@ -202,13 +120,9 @@ rm -rf $RPM_BUILD_ROOT
|
||||
%attr(4755,root,root) /usr/lib/qubes/qubes_penctl
|
||||
/usr/lib/qubes/qubes_add_pendrive_script
|
||||
/etc/udev/rules.d/qubes.rules
|
||||
/etc/sysconfig/iptables
|
||||
/var/lib/qubes
|
||||
%dir /mnt/incoming
|
||||
%dir /mnt/outgoing
|
||||
%dir /mnt/removable
|
||||
/etc/yum.repos.d/qubes.repo
|
||||
/sbin/qubes_serial_login
|
||||
/usr/bin/qubes_timestamp
|
||||
%dir /home_volatile
|
||||
%attr(700,user,user) /home_volatile/user
|
||||
|
||||
@ -34,6 +34,7 @@ URL: http://www.qubes-os.org
|
||||
Requires: /usr/bin/xenstore-read
|
||||
Requires: fedora-release = 13
|
||||
Requires: NetworkManager >= 0.8.1-1
|
||||
Requires: qubes-core-commonvm
|
||||
Provides: qubes-core-vm
|
||||
|
||||
%define _builddir %(pwd)/netvm
|
||||
@ -43,22 +44,13 @@ The Qubes core files for installation inside a Qubes NetVM.
|
||||
|
||||
%pre
|
||||
|
||||
mkdir -p $RPM_BUILD_ROOT/var/lib/qubes
|
||||
if [ -e $RPM_BUILD_ROOT/etc/fstab ] ; then
|
||||
mv $RPM_BUILD_ROOT/etc/fstab $RPM_BUILD_ROOT/var/lib/qubes/fstab.orig
|
||||
fi
|
||||
|
||||
|
||||
%build
|
||||
|
||||
%install
|
||||
|
||||
mkdir -p $RPM_BUILD_ROOT/etc/sysconfig
|
||||
cp ../common/iptables $RPM_BUILD_ROOT/etc/sysconfig
|
||||
mkdir -p $RPM_BUILD_ROOT/etc
|
||||
cp fstab $RPM_BUILD_ROOT/etc/fstab
|
||||
mkdir -p $RPM_BUILD_ROOT/etc/init.d
|
||||
cp qubes_core $RPM_BUILD_ROOT/etc/init.d/
|
||||
cp qubes_core_netvm $RPM_BUILD_ROOT/etc/init.d/
|
||||
mkdir -p $RPM_BUILD_ROOT/var/lib/qubes
|
||||
mkdir -p $RPM_BUILD_ROOT/usr/lib/qubes
|
||||
cp ../common/qubes_setup_dnat_to_ns $RPM_BUILD_ROOT/usr/lib/qubes
|
||||
@ -68,19 +60,10 @@ ln -s /usr/lib/qubes/qubes_setup_dnat_to_ns $RPM_BUILD_ROOT/etc/dhclient.d/qubes
|
||||
mkdir -p $RPM_BUILD_ROOT/etc/NetworkManager/dispatcher.d/
|
||||
cp ../common/qubes_nmhook $RPM_BUILD_ROOT/etc/NetworkManager/dispatcher.d/
|
||||
cp ../netvm/30-qubes_external_ip $RPM_BUILD_ROOT/etc/NetworkManager/dispatcher.d/
|
||||
mkdir -p $RPM_BUILD_ROOT/etc/yum.repos.d
|
||||
cp ../netvm/qubes.repo $RPM_BUILD_ROOT/etc/yum.repos.d
|
||||
mkdir -p $RPM_BUILD_ROOT/sbin
|
||||
cp ../common/qubes_serial_login $RPM_BUILD_ROOT/sbin
|
||||
mkdir -p $RPM_BUILD_ROOT/etc
|
||||
cp ../common/serial.conf $RPM_BUILD_ROOT/var/lib/qubes/
|
||||
mkdir -p $RPM_BUILD_ROOT/var/run/qubes
|
||||
mkdir -p $RPM_BUILD_ROOT/etc/xen/scripts
|
||||
cp ../common/vif-route-qubes $RPM_BUILD_ROOT/etc/xen/scripts
|
||||
|
||||
%triggerin -- initscripts
|
||||
cp /var/lib/qubes/serial.conf /etc/init/serial.conf
|
||||
|
||||
%post
|
||||
|
||||
/usr/lib/qubes/qubes_fix_nm_conf.sh
|
||||
@ -90,81 +73,14 @@ if [ "$1" != 1 ] ; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
sed 's/^net.ipv4.ip_forward.*/net.ipv4.ip_forward = 1/' -i /etc/sysctl.conf
|
||||
usermod -L root
|
||||
if ! [ -f /var/lib/qubes/serial.orig ] ; then
|
||||
cp /etc/init/serial.conf /var/lib/qubes/serial.orig
|
||||
fi
|
||||
chkconfig --add qubes_core_netvm || echo "WARNING: Cannot add service qubes_core!"
|
||||
chkconfig qubes_core_netvm on || echo "WARNING: Cannot enable service qubes_core!"
|
||||
|
||||
#echo "--> Disabling SELinux..."
|
||||
sed -e s/^SELINUX=.*$/SELINUX=disabled/ </etc/selinux/config >/etc/selinux/config.processed
|
||||
mv /etc/selinux/config.processed /etc/selinux/config
|
||||
setenforce 0 2>/dev/null
|
||||
|
||||
#echo "--> Turning off unnecessary services..."
|
||||
# FIXME: perhaps there is more elegant way to do this?
|
||||
for f in /etc/init.d/*
|
||||
do
|
||||
srv=`basename $f`
|
||||
[ $srv = 'functions' ] && continue
|
||||
[ $srv = 'killall' ] && continue
|
||||
[ $srv = 'halt' ] && continue
|
||||
[ $srv = 'single' ] && continue
|
||||
chkconfig $srv off
|
||||
done
|
||||
|
||||
#echo "--> Enabling essential services..."
|
||||
chkconfig iptables on
|
||||
chkconfig rsyslog on
|
||||
chkconfig haldaemon on
|
||||
chkconfig messagebus on
|
||||
chkconfig NetworkManager on
|
||||
chkconfig --add qubes_core || echo "WARNING: Cannot add service qubes_core!"
|
||||
chkconfig qubes_core on || echo "WARNING: Cannot enable service qubes_core!"
|
||||
|
||||
|
||||
# TODO: make this not display the silly message about security context...
|
||||
sed -i s/^id:.:initdefault:/id:3:initdefault:/ /etc/inittab
|
||||
|
||||
# Remove most of the udev scripts to speed up the VM boot time
|
||||
# Just leave the xen* scripts, that are needed if this VM was
|
||||
# ever used as a net backend (e.g. as a VPN domain in the future)
|
||||
#echo "--> Removing unnecessary udev scripts..."
|
||||
mkdir -p /var/lib/qubes/removed-udev-scripts
|
||||
for f in /etc/udev/rules.d/*
|
||||
do
|
||||
if [ $(basename $f) == "xen-backend.rules" ] ; then
|
||||
continue
|
||||
fi
|
||||
|
||||
if [ $(basename $f) == "xend.rules" ] ; then
|
||||
continue
|
||||
fi
|
||||
|
||||
if [ $(basename $f) == "qubes.rules" ] ; then
|
||||
continue
|
||||
fi
|
||||
|
||||
if [ $(basename $f) == "90-hal.rules" ] ; then
|
||||
continue
|
||||
fi
|
||||
|
||||
|
||||
mv $f /var/lib/qubes/removed-udev-scripts/
|
||||
done
|
||||
|
||||
#rm -f /etc/mtab
|
||||
#echo "--> Removing HWADDR setting from /etc/sysconfig/network-scripts/ifcfg-eth0"
|
||||
#mv /etc/sysconfig/network-scripts/ifcfg-eth0 /etc/sysconfig/network-scripts/ifcfg-eth0.orig
|
||||
#grep -v HWADDR /etc/sysconfig/network-scripts/ifcfg-eth0.orig > /etc/sysconfig/network-scripts/ifcfg-eth0
|
||||
|
||||
%preun
|
||||
if [ "$1" = 0 ] ; then
|
||||
# no more packages left
|
||||
chkconfig qubes_core off
|
||||
mv /var/lib/qubes/fstab.orig /etc/fstab
|
||||
mv /var/lib/qubes/removed-udev-scripts/* /etc/udev/rules.d/
|
||||
mv /var/lib/qubes/serial.orig /etc/init/serial.conf
|
||||
chkconfig qubes_core_netvm off
|
||||
fi
|
||||
|
||||
%clean
|
||||
@ -172,16 +88,11 @@ rm -rf $RPM_BUILD_ROOT
|
||||
|
||||
%files
|
||||
%defattr(-,root,root,-)
|
||||
/etc/fstab
|
||||
/etc/sysconfig/iptables
|
||||
/etc/init.d/qubes_core
|
||||
/var/lib/qubes
|
||||
/etc/init.d/qubes_core_netvm
|
||||
/usr/lib/qubes/qubes_setup_dnat_to_ns
|
||||
/usr/lib/qubes/qubes_fix_nm_conf.sh
|
||||
/etc/dhclient.d/qubes_setup_dnat_to_ns.sh
|
||||
/etc/NetworkManager/dispatcher.d/qubes_nmhook
|
||||
/etc/NetworkManager/dispatcher.d/30-qubes_external_ip
|
||||
/etc/yum.repos.d/qubes.repo
|
||||
/sbin/qubes_serial_login
|
||||
/etc/xen/scripts/vif-route-qubes
|
||||
%dir /var/run/qubes
|
||||
|
||||
Loading…
Reference in New Issue
Block a user