Currently there is just one anti-spoofing firewall rule ensuring packets
coming through vif+ interfaces have the right source address. Add
another rule ensuring that addresses that belongs to VMs behind those
vif+ interface do not appear on other interfaces (specifically eth0, but
also physical ones).
Normally it wouldn't be an issue because of rp_filter (doing the same
based on route table), default DROP in FORWARD chain and also conntrack
(the need to guess exact port numbers and sequence numbers). But it
appears all three mechanisms are ineffective in some cases:
- rp_filter in many distributions (including Fedora and Debian) was
switched to Loose Mode, which doesn't verify exact interface
- there is a rule in FORWARD table allowing established connections and
conntrack does not keep track of input/output interfaces
- CVE-2019-14899 allows to guess all the data needed to inject packets
Reported-by: Demi M. Obenour <demiobenour@gmail.com>
Previously enabling the interface was the first action in the setup
steps. Linux theoretically do not forward the traffic until proper
IP address and route is added to the interface (depending on rp_filter
setting). But instead of relying on this opaque behavior better setup
anti-spoofing rules earlier. Also, add 'set -o pipefail' for more
reliable error handling.
Note the rules for actual VM traffic (qvm-firewall) are properly
enforced - until those rules are loaded, traffic from appropriate vif
interface is blocked. But this relies on proper source IP address,
anti-spoofing rules need to be setup race-free.
Reported-by: Demi M. Obenour <demiobenour@gmail.com>
Resolves issue where the dom0 rpm database does not get used on
successive calls to qubes-dom0-update for debian updatevms.
Also resolves "cannot remove .rpmdbold.####" occurrences.
qubesos/qubes-issues#6124
* origin/pr/236:
qvm-template: Add qubes.Template{Search,Download} files to the package.
qubes.Template*: Add --refresh option and allow DNF cache to be used.
qubes.Template*: Invoke curl with --silent.
qubes.Template*: Change separator from : to | and include additional metadata.
Fix shell quoting.
Remove repofrompath.
New qrexec calls for interacting with template repos.
Since no currently supported distribution needs it, skip the build by
default. If necessary, can be enabled by adjusting %with_sysvinit macro
in the spec.
Without this restriction system users can start processes with
root privileges:
$ sudo -u mail systemd-run --pipe -q id
uid=0(root) gid=0(root) groups=0(root)
* origin/pr/184:
Add services for paranoid backup restore mode
qfile-unpacker: add option (-w) to wait for disk space before extracting
tar2qfile: fix argument parser
qfile-unpacker: add option for custom user and target directory
* origin/pr/239:
xendriverdomain: remove placeholder for sbinpath
Fix regex in qubes-fix-nm-conf.sh
Update travis
xendriverdomain: remove Requires and After proc-xen.mount
Drop legacy xen entry in fstab
