Commit Graph

2314 Commits

Author SHA1 Message Date
Marek Marczykowski-Górecki
5f81f0486d
qrexec: fix handling remote domain death
Periodically (every 10s) check if connection is still alive, otherwise
killing remote domain (as it's the case of DispVM) will hang client
side.
2018-05-24 17:38:12 +02:00
Marek Marczykowski-Górecki
4a8b10ea8b
Drop leftovers of qubes-netwatcher service
Fixes QubesOS/qubes-issues#1242
2018-05-24 17:38:12 +02:00
Marek Marczykowski-Górecki
6a088a3992
version 4.0.28 2018-05-10 12:21:39 +02:00
Peter Gerber
7d783b3010
Qubes firewall: correct syntax for icmpv6 rejects
I've run into an issue with incorrectly generated rules for IPv6. I
added some debugging code printing the generated rules and the
resulting error (see below). Turns out "reject with" expects icmpv6
rather than icmp6.

--- generated rule ---

flush chain ip6 qubes-firewall qbs-fd09-24ef-4179--a89-15
table ip6 qubes-firewall {
  chain qbs-fd09-24ef-4179--a89-15 {
    ip6 daddr fc00::/8 reject with icmp6 type admin-prohibited
    ip6 daddr fd00::/8 reject with icmp6 type admin-prohibited
    ip6 daddr fe80::/10 reject with icmp6 type admin-prohibited
    accept
    reject with icmp6 type admin-prohibited
  }
}

--- output ---

/dev/stdin:4:36-40: Error: syntax error, unexpected string, expecting icmp or icmpv6 or tcp or icmpx

                                   ^^^^^
/dev/stdin:5:36-40: Error: syntax error, unexpected string, expecting icmp or icmpv6 or tcp or icmpx

                                   ^^^^^
/dev/stdin:6:37-41: Error: syntax error, unexpected string, expecting icmp or icmpv6 or tcp or icmpx

                                    ^^^^^
/dev/stdin:8:17-21: Error: syntax error, unexpected string, expecting icmp or icmpv6 or tcp or icmpx

                ^^^^^
2018-05-07 22:39:22 +00:00
Marek Marczykowski-Górecki
df5722e880
version 4.0.27 2018-05-02 05:05:33 +02:00
Marek Marczykowski-Górecki
a026d04c0d
qubes-firewall: reject packets instead of dropping
qubes-firewall service is meant as mistakes mitigation, not a
high-volume external network filter. Providing feedback (ICMP
admin-prohibited error packet) to the VM reduces timeouts and give
immediate connection failure. This is especially useful when some
website tries to load unwanted (not whitelisted) 3rd party elements -
providing error response avoids long site loading time.

Fixes QubesOS/qubes-issues#3607
2018-05-02 04:49:23 +02:00
Marek Marczykowski-Górecki
ad15312599
Fix make clean
Remove also .coverage file.
2018-05-02 04:48:51 +02:00
Marek Marczykowski-Górecki
4329eab307
Require dconf utility to (re)build /etc/dconf/db/local
Some applications complains if compiled version of dconf database is
missing ("dconf-WARNING **: unable to open file '/etc/dconf/db/local':
Failed to open file '/etc/dconf/db/local': open() failed: No such file
or directory; expect degraded performance").
There is only one entry in that database, but generate its binary
version anyway to avoid that warning message.

The dconf call is already included in package scripts, now only make
sure the utility is really installed.

QubesOS/qubes-issues#1951
2018-05-02 03:02:07 +02:00
Marek Marczykowski-Górecki
23250f84b2
Create /etc/dconf/profile/user dynamically, if not present
The /etc/dconf/profile/user file in some distributions is part of dconf
package, in some not. There are even cases where it changes between
package versions (Fedora 27 don't have it, but Fedora 28 do).
Also, base Debian Stretch don't have it, but Kali Linux based on it do.

To avoid overly complex dependency handling, create the file dynamically
on package installation if it's missing in that particular case. The
file content is canonical:

    user-db:user
    system-db:local

Fixes QubesOS/qubes-issues#3834
2018-05-02 02:57:37 +02:00
Marek Marczykowski-Górecki
d25ecb4e40
Fix packaging: 'user' group, BACKEND_VMM var
- BACKEND_VMM may not be available as env variable (mock build), provide
it explicitly
- 'user' group may not exists at package build time, set it at package
installation
2018-05-01 17:34:52 +02:00
Marek Marczykowski-Górecki
ce50704648
travis: add centos7 2018-05-01 15:20:53 +02:00
Marek Marczykowski-Górecki
c29cc4c270
centos: exclude only dconf user profile, keep dpi config 2018-05-01 15:17:39 +02:00
X4lldux
9fa75314f1
Move/Copy many files in one step via nautilus extension 2018-04-30 02:40:23 +02:00
Marek Marczykowski-Górecki
d698e7878f
version 4.0.26 2018-04-22 00:29:02 +02:00
Marek Marczykowski-Górecki
b778b642b5
Change repository URLs to https
HTTPS updates works more reliably over Tor. But also provide some
additional privacy.

Fixes QubesOS/qubes-issues#3737
2018-04-21 23:13:13 +02:00
Marek Marczykowski-Górecki
481c6602b0
version 4.0.25 2018-04-21 15:10:20 +02:00
Marek Marczykowski-Górecki
c4b2bd67c2
travis: update Fedora versions 2018-04-21 14:15:08 +02:00
Frédéric Pierret
506848a77c
Use %{python3_pkgversion} instead of duplicating python3 targets 2018-04-21 12:00:34 +02:00
Frédéric Pierret
a34b9abde4
Add missing python-setuptools dependency 2018-04-21 11:45:43 +02:00
Marek Marczykowski-Górecki
a850e3aaee
Merge remote-tracking branch 'qubesos/pr/109'
* qubesos/pr/109:
  Fix GCC8 warnings
2018-04-21 01:20:52 +02:00
Marek Marczykowski-Górecki
f6dc28106b
qubes-firewall: signal service readiness only after initial scripts
qubes-firewall.service have Before=qubes-network.service. The latter
enable ip_forwarding. Make sure the ordering cover not only service
fork, but all its startup sequence, including initial rules and user
scripts.

Reported-by: @tasket
2018-04-20 16:38:25 +02:00
Marek Marczykowski-Górecki
c278d56bea
Update gitignore and make clean target
Debian build require clean sources (make clean must return the sources
to the state from before build).
2018-04-20 16:27:26 +02:00
Frédéric Pierret
c43c4df7b9
Fix GCC8 warnings 2018-04-20 08:52:45 +02:00
Marek Marczykowski-Górecki
a415239831
Merge remote-tracking branch 'qubesos/pr/111'
* qubesos/pr/111:
  Use only /etc/skel to provision user's home directory of new VM
2018-04-14 21:40:33 +02:00
Marek Marczykowski-Górecki
82937e129e
Use only /etc/skel to provision user's home directory of new VM
Get rid of non-standard /home.orig handling.

Fixes QubesOS/qubes-issues#3771
2018-04-13 00:35:08 +02:00
Vladimir Lushnikov
cd26354945
Problem: Unable to use pkg.install with Salt in dom0 when using UpdateVM that has only yum due to incorrect options passed by Salt assuming dnf presence
Solution: Filter out invalid yum options when dnf is not found in UpdateVM

Fixes QubesOS/qubes-issues#2223
2018-04-08 07:52:38 +01:00
Marek Marczykowski-Górecki
7fa3c51fd2
Merge remote-tracking branch 'qubesos/pr/108'
* qubesos/pr/108:
  spec.in: fix %if expressions and remove useless conditions
  spec.in: add changelog placeholder
  Remove _builddir
  Create .spec.in and Source0
2018-04-06 02:07:53 +02:00
Marek Marczykowski-Górecki
a33c7e10ba
Merge remote-tracking branch 'qubesos/pr/105'
* qubesos/pr/105:
  Add misc/qubes-run-terminal to launch any available terminal emulator
2018-04-06 02:06:16 +02:00
Marek Marczykowski-Górecki
0ca2db894f
Merge branch 'network-fixes' 2018-04-06 02:04:20 +02:00
Marek Marczykowski-Górecki
836bf90e97
network: make sure static NM configuration is created before NM start
Avoid delays caused by default DHCP configuration, which would be used
if no alternative is available at NetworkManager start time.
2018-04-06 01:52:11 +02:00
Frédéric Pierret
6036f1f65b
spec.in: fix %if expressions and remove useless conditions 2018-04-04 17:27:57 -04:00
Marek Marczykowski-Górecki
76649d875b
Do not start dkms.service
It doesn't make sense in Qubes to rebuild modules at every VM startup.
Especially when modules dir is either read-only, or on non-persistent
root volume (TemplateBasedVM).
This is especially uneeded for dom0-provided kernels, which already have
u2mfn module built, but DKMS try to rebuild it anyway (and fails,
because of missing/broken kernel-devel package).
DKMS already have appropriate (rpm/dpkg) hooks for new kernel
installation, so actually needed modules should be build in template on
kernel update/install anyway.

This saves about 2s from VM startup time.
2018-04-04 01:50:40 +02:00
Frédéric Pierret
59fa7efcc3
spec.in: add changelog placeholder 2018-04-03 21:38:13 +02:00
Marek Marczykowski-Górecki
53c9b45c76
qubes-firewall: handle only traffic originating from VMs
Ignore packets coming from non-vif interfaces early.

Fixes QubesOS/qubes-issues#3644
2018-04-03 02:23:16 +02:00
Marek Marczykowski-Górecki
c281d6454f
network: do not assume IPv6 gateway is a link-local address
If IPv6 gateway address provided by dom0 isn't a link local address, add
a /128 route to it. Also, add this address on backend interfaces (vif*).

This is to allow proper ICMP host unreachable packets forwarding - if
gateway (address on vif* interface) have only fe80: address, it will be
used as a source for ICMP reply. It will be properly delivered to the VM
directly connected there (for example from sys-net to sys-firewall), but
because of being link-local address, it will not be forwarded any
further.
This results timeouts if host doesn't have IPv6 connectivity.
2018-04-02 23:19:31 +02:00
Marek Marczykowski-Górecki
c525d6213c
qubes-session-autostart: do not wait for applications exit
Since fixing QubesOS/qubes-issues#3213, launch function correctly waits
for some applications exit. This is undesirable for
qubes-session-autostart service, which should just start the
applications and exit.
2018-04-02 23:19:03 +02:00
Marek Marczykowski-Górecki
646c9f1aae
Load only test_* files when looking for tests (python) 2018-04-02 23:19:02 +02:00
Marek Marczykowski-Górecki
321cd06591
Fix waiting for application exit in qubesagent.xdg.launch
This is especially important for qubes-desktop-run used inside DispVM.
The DesktopAppInfo.launch() method returns after just launching the
application. In DispVM case it worked by a coincidence - because the
launched application was keeping stdin/out open, which also prevented
DispVM killing. Use DesktopAppInfo.launch_uris_as_manager which at least
allows to learn PIDs of spawned processes, to track them manually.

This still doesn't fix gnome-terminal issue, or any other application
using either DBus activation, or any other client-server model. But at
least fix basic apps like firefox and xterm.

Fixes QubesOS/qubes-issues#3213
2018-04-02 23:19:02 +02:00
Marek Marczykowski-Górecki
15c740d95e
Fix shell calls in Makefile 2018-04-02 23:19:01 +02:00
Marek Marczykowski-Górecki
4a7c668549
Move 'qubesxdg' into qubesagent python package
Since we have proper python package, use it instead of hacky one-file
package. This will ease installation and packaging, including switching
to python3.
2018-04-02 23:19:01 +02:00
Frédéric Pierret
e5cf780dbd
Remove _builddir 2018-04-01 11:37:23 +02:00
Frédéric Pierret
1c24968318
Create .spec.in and Source0 2018-04-01 11:35:33 +02:00
Marek Marczykowski-Górecki
0ef6297bfc
qrexec: fix arguments handling
Don't parse options for local command as qrexec-client-vm's own options.

Fixes QubesOS/qubes-issues#3762
2018-03-30 22:54:38 +02:00
Davíð Steinn Geirsson
d6d8d25345
Add misc/qubes-run-terminal to launch any available terminal emulator 2018-03-28 13:23:35 +00:00
Marek Marczykowski-Górecki
2301da6e6f
Merge remote-tracking branch 'qubesos/pr/102'
* qubesos/pr/102:
  qrexec-fork-server: Always initialize addrlen argument of accept()
2018-03-20 01:17:08 +01:00
Marek Marczykowski-Górecki
df1046362e
Merge remote-tracking branch 'qubesos/pr/103'
* qubesos/pr/103:
  Add missing services in Ubuntu templates.
2018-03-20 01:16:07 +01:00
Marek Marczykowski-Górecki
f8c40aa0f7
Merge branch 'configurable-ring-size'
* configurable-ring-size:
  qrexec: add qrexec-client-vm --buffer-size option
2018-03-20 01:15:29 +01:00
unman
aa95ccc48f
Add missing services in Ubuntu templates. 2018-03-19 17:32:10 +00:00
Simon Gaiser
f4c402e7c7 qrexec-fork-server: Always initialize addrlen argument of accept()
With the old code the addrlen argument were uninitialized on the first
call resulting in errors depending on the compiler behavior.
2018-03-15 20:45:12 +01:00
Marek Marczykowski-Górecki
4a09023451
qrexec: add qrexec-client-vm --buffer-size option
Add an option for custom vchan buffer size, to override default 64k (for
each direction). This is especially useful when the other side of
connection is MirageOS based, because of limited memory and default
grant table size (128 entries).
2018-03-14 01:45:14 +01:00