Commit Graph

1829 Commits

Author SHA1 Message Date
Marek Marczykowski-Górecki
07be216a0d
tests: add run-tests script, plug it into travis
Also, replace subproces.call with a mockup, as notify-send is not
available on travis.
2017-05-20 13:20:08 +02:00
Marek Marczykowski-Górecki
5dfcf06ef4
firewall: switch to python 3 2017-05-20 13:20:08 +02:00
Marek Marczykowski-Górecki
87efe51be0
tests: make firewall tests working regardless of python version
Don't depend on set ordering...
2017-05-20 12:56:23 +02:00
Marek Marczykowski-Górecki
dc8047c3bb
dom0-updates: restructure the script to not update metadata twice
When `qubes-dom0-update --refresh` was called, the script checked
metadata twice - once to check updates availability, then to actually
download them. This two stage approach is needed only on Debian, when
--downloadonly option is not supported. Rearrange code accordingly.

Also, drop --doit option (ignore it), as the same (but more readable)
can be achieved with --check-only.
2017-05-20 03:49:13 +02:00
Marek Marczykowski-Górecki
22e261f909
Add qubes.StartApp service
A simple service to start application described in .desktop file.
This way, dom0 can completely ignore VM-originated Exec= entry.
2017-05-20 03:48:02 +02:00
Marek Marczykowski-Górecki
41cd218660
travis: drop debootstrap workaround
Move to qubes-builder

Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
2017-01-10 12:12:44 +01:00
Marek Marczykowski-Górecki
24b726a3bf
network: use /32 netmask on internal IPs in NAT providing namespace
Use /32 inside network namespace too. Otherwise inter-VM traffic is
broken - as all VMs seems to be in a single /24 subnet, but in fact are
not.

QubesOS/qubes-issues#1143
2016-11-01 00:22:19 +01:00
Marek Marczykowski-Górecki
c8213ea55a
network: properly handle DNS addresses in vif-qubes-nat.sh
Core3 no longer reuse netvm own IP for primary DNS. At the same time,
disable dropping traffic to netvm itself because it breaks DNS (as one
of blocked things). This allows VM to learn real netvm IP, but:
 - this mechanism is not intended to avoid detection from already
 compromised VM, only about unintentional leaks
 - this can be prevented using vif-qubes-nat.sh on the netvm itself (so
 it will also have hidden its own IP)

QubesOS/qubes-issues#1143
2016-11-01 00:22:08 +01:00
Marek Marczykowski-Górecki
c75b6519c5
network: keep the same MAC on vif interfaces
Even when it's veth pair into network namespace doing NAT.

QubesOS/qubes-issues#1143
2016-11-01 00:13:47 +01:00
Marek Marczykowski-Górecki
1c42a06238
network: integrate vif-route-qubes-nat into vif-route-qubes
Since 'script' xenstore entry no longer allows passing arguments
(actually this always was a side effect, not intended behaviour), we
need to pass additional parameters some other way. Natural choice for
Qubes-specific script is to use QubesDB.
And since those parameters are passed some other way, it is no longer
necessary to keep it as separate script.

Fixes QubesOS/qubes-issues#1143
2016-10-31 00:40:32 +01:00
Marek Marczykowski-Górecki
938af2c7fd
network: change vif-route-qubes-nat parameters
Keep "main" IP (the one in xenstore) as the one seen by the netvm, and
pass the "fake" one (the one seen by the VM) as script parameter.

Fixes QubesOS/qubes-issues#1143
2016-10-29 22:28:57 +02:00
Marek Marczykowski-Górecki
be86c7da1f
network: reformat vif-route-qubes-nat
Use 4-space indentation, remove trailing spaces. No functional change.
2016-10-29 14:45:36 +02:00
Marek Marczykowski-Górecki
3131bb6135
Merge remote-tracking branch 'origin/pr/24' into core3-devel
* origin/pr/24:
  network: add vif-route-qubes-nat for IP address anonymization
2016-10-29 14:42:50 +02:00
Marek Marczykowski-Górecki
2c8fe644f3
network: remove qubes-netwatcher
This tool/service is obsolete for a long time (it does nothing on R3.0
and later).
2016-09-12 05:58:26 +02:00
Marek Marczykowski-Górecki
ee0a292b21
network: rewrite qubes-firewall daemon
This rewrite is mainly to adopt new interface for Qubes 4.x.
Main changes:
 - change language from bash to python, introduce qubesagent python package
 - support both nftables (preferred) and iptables
 - new interface (https://qubes-os.org/doc/vm-interface/)
 - IPv6 support
 - unit tests included
 - nftables version support running along with other firewall loaded

Fixes QubesOS/qubes-issues#1815
QubesOS/qubes-issues#718
2016-09-12 05:22:53 +02:00
Marek Marczykowski-Górecki
b50cba3f2c
Add qubes.ResizeDisk service to adjust filesystem size
Do this using qubes rpc service, instead of calling resize2fs directly
by dom0.
2016-08-17 21:47:22 +02:00
Marek Marczykowski-Górecki
779414d216
Merge remote-tracking branch 'woju/master' into core3-devel
* woju/master:
  misc: add qvm-features-request
2016-08-17 21:28:37 +02:00
Marek Marczykowski-Górecki
c3d630f288
Disable meminfo-writer if there is any PCI device attached
This code used to be in dom0, but it's easier to maintain it in VM.

QubesOS/qubes-issues#2101
2016-08-17 21:27:28 +02:00
Marek Marczykowski-Górecki
76e12cae2d
Rename qubes.xdg python module to qubesxdg
Do not interfere with 'qubes' module.

QubesOS/qubes-issues#1813
2016-08-17 21:27:28 +02:00
Marek Marczykowski-Górecki
1a601ddbe9
version 3.2.10 2016-08-08 05:23:02 +02:00
Marek Marczykowski-Górecki
60c30e6cdb
Merge remote-tracking branch 'origin/pr/82'
* origin/pr/82:
  comment legacy function
2016-08-06 18:42:16 +02:00
Marek Marczykowski-Górecki
1fd69636f8
systemd: fix syntax error in preset file
Services needs to be named with full unit name.

Fixes QubesOS/qubes-issues#2188
2016-08-06 18:36:30 +02:00
Marek Marczykowski-Górecki
d99a563542
network: reload NM connection after setting it up
Apparently NM monitor only its main configuration for changes, but not
connection files. Force reloading it.
2016-08-02 02:08:36 +02:00
HW42
7c15b9b0ea
systemd: remove obsolete symlinks with rm instead of systemctl
The systemctl in Debian unstable fails when trying to disable a removed
service. The manpage do not mention a switch to change this behaviour.
But it says:

  Note that this operation creates only the suggested symlinks for
  the units. While this command is the recommended way to manipulate
  the unit configuration directory, the administrator is free to make
  additional changes manually by placing or removing symlinks in the
  directory.

So a simple rm should be fine.
2016-07-28 21:54:50 +02:00
HW42
5ab7e80306
systemd: fix qubes-mount-home path in cleanup script 2016-07-28 21:54:38 +02:00
Patrick Schleizer
15274f8bb8 comment legacy function 2016-07-27 15:07:32 +02:00
Marek Marczykowski-Górecki
fd8a116744
version 3.2.9 2016-07-27 06:08:56 +02:00
Marek Marczykowski-Górecki
441a78df49
Merge remote-tracking branch 'origin/pr/81' 2016-07-27 05:20:13 +02:00
Marek Marczykowski-Górecki
bad589bc00
Merge remote-tracking branch 'origin/pr/80' 2016-07-27 05:20:12 +02:00
Marek Marczykowski-Górecki
60d16ea587
systemd: improve ordering of systemd units
- qubes-misc-post.service is no longer responsible for mounting /rw
- both qubes-sysinit.service and qubes-mount-dirs.service are part of
  basic.target, so no need to mention them explicitly (as long as
  DefaultDependencies=yes)

QubesOS/qubes-issues#2198
2016-07-27 05:19:47 +02:00
Marek Marczykowski-Górecki
ed434ad63f
systemd: include tor-disabling drop-ins in the package
QubesOS/qubes-issues#1625
2016-07-27 05:19:47 +02:00
Marek Marczykowski-Górecki
48a35d40d1
systemd: load xen-privcmd module
It is needed for vchan communication. It was loaded implicitly by mount
/proc/xen, but since we're moving away from this legacy interface, load
it explicitly.

QubesOS/qubes-issues#2194
2016-07-27 05:19:46 +02:00
Marek Marczykowski-Górecki
e0e89f153f
systemd: order qubes-mount-dirs.service before local-fs.target
The service is really responsible for mounting /rw and /home, so should
be ordered before local-fs.target - this will allow other services
to use standard ordering targets.

This probably makes Before=qubes-gui-agent.service not needed anymore,
but do not remove it yet without extensive testing to not risk
regression.

Fixes QubesOS/qubes-issues#2194
2016-07-27 05:19:46 +02:00
Marek Marczykowski-Górecki
90be5be630
systemd: cleanup removed services
Fixes QubesOS/qubes-issues#2192
2016-07-27 05:19:46 +02:00
Patrick Schleizer
67dd174cec empty legacy function
leaving that to Whonix

https://github.com/Whonix/qubes-whonix/blob/master/usr/lib/qubes-bind-dirs.d/41_qubes-whonix-legacy.conf

https://github.com/QubesOS/qubes-issues/issues/2191
2016-07-24 00:09:11 +00:00
Patrick Schleizer
a003093953
add /usr/lib/qubes/bind-dirs.sh compatibility symlink
https://github.com/QubesOS/qubes-issues/issues/2191
2016-07-23 21:44:00 +00:00
Marek Marczykowski-Górecki
979e2d2bf8
version 3.2.8 2016-07-17 04:27:04 +02:00
Marek Marczykowski-Górecki
f4d53fb7e6
Include Qubes Master Key in the VM template
It is useful to verify other qubes-related keys.

Fixes QubesOS/qubes-issues#1614
2016-07-17 04:26:01 +02:00
Marek Marczykowski-Górecki
65f0b26600
systemd: plug random seed loading into systemd-random-seed
Reuse its dependencies to make sure it is loaded early enough.

Reported by @adrelanos
Fixes QubesOS/qubes-issues#1761
2016-07-17 04:26:01 +02:00
Marek Marczykowski-Górecki
9b362a6d7d
systemd: don't mark updates check service failed
Even if update check fails for some reason (network problem, apt-get lock
being held etc), don't mark the service as failed. The update check
mechanism is designed this way to not worry about such single failures
- other VM(s) may still check and report updates availability.

Fixes QubesOS/qubes-issues#1889
2016-07-16 15:30:40 +02:00
Marek Marczykowski-Górecki
10cadc58a0
Revert "systemd: preset xendriverdomain on update"
This doesn't help when xen update is installed after this one. So, deal
with it in xen %post itself.
This reverts commit f2257e1e3b.

QubesOS/qubes-issues#2141
2016-07-16 01:37:12 +02:00
Marek Marczykowski-Górecki
40d5f85b36
dom0-updates: fix cleaning downloaded packages 2016-07-15 11:27:35 +02:00
Marek Marczykowski-Górecki
8781a5c588
version 3.2.7 2016-07-13 22:43:06 +02:00
Marek Marczykowski-Górecki
6cf30bff29
Merge remote-tracking branch 'origin/pr/66'
* origin/pr/66:
  fixed qubes-core-agent upgrading double package manager lock

  Fixes QubesOS/qubes-issues#1889
2016-07-13 22:38:25 +02:00
Marek Marczykowski-Górecki
0eb1f7c679
Merge remote-tracking branch 'origin/pr/77'
* origin/pr/77:
  archlinux: fix update-proxy-configs to use pacman.d drop-ins
  archlinux: ensure repositories are the last pacman.d files included
  archlinux: Setup default package repository
  archlinux: switch to usage of pacman.d drop-ins
2016-07-13 22:25:26 +02:00
Marek Marczykowski-Górecki
4996dd7609
rpm: fix misleading systemd warnings during upgrade
systemctl preset output lengthy warning when trying to operate on
non-existing unit. This preset action is meant to disable unit, so it's
even better it doesn't exists.
2016-07-13 22:13:17 +02:00
Marek Marczykowski-Górecki
f2257e1e3b
systemd: preset xendriverdomain on update
Make sure it is enabled, regardless of update installation order.
2016-07-13 21:48:42 +02:00
Marek Marczykowski-Górecki
e7b1711e21
version 3.2.6 2016-07-13 04:38:18 +02:00
Olivier MEDOC
7cea09711a archlinux: fix update-proxy-configs to use pacman.d drop-ins 2016-07-12 11:38:14 +02:00
Olivier MEDOC
a346de7e46 archlinux: ensure repositories are the last pacman.d files included 2016-07-12 11:25:03 +02:00