Commit Graph

2752 Commits

Author SHA1 Message Date
Marek Marczykowski-Górecki
000a93e001
rpm,deb: split qrexec-agent into separate subpackage
While it doesn't make sense to install qubes-core-agent without qrexec,
it may make sense to do the otherway around - install just
qrexec-agent without all the qrexec services and configuration. For
example on some pre-installed system.

QubesOS/qubes-issues#2771
2017-06-08 22:11:37 +02:00
Marek Marczykowski-Górecki
2337d26a3e
debian: update basic metadata of package 2017-06-08 22:11:37 +02:00
Marek Marczykowski-Górecki
58d21f095f
Remove old vusb scripts
This is unused for a long time (since we've moved to USBIP).
2017-06-08 22:11:37 +02:00
Marek Marczykowski-Górecki
32915fe126
deb,rpm: split passwordless root access configs into separate package
Make passwordless root access optional - ease integration qrexec
authorization for sudo.

QubesOS/qubes-issues#2695
2017-06-08 22:11:36 +02:00
Marek Marczykowski-Górecki
22002a34f3
Do not report spurious failure of qubes.WaitForSession service
It is expected to be killed by a signal. Exit with returncode 0 anyway.
While at it, adjust it for current service format (executable, with
proper shebang).
2017-06-08 22:11:36 +02:00
Marek Marczykowski-Górecki
8af88d5e3a
rpm: drop dependency on desktop-notification-daemon
It should really be in template builder script, or better: meta-package.

QubesOS/qubes-issues#2572
2017-06-08 22:11:35 +02:00
Marek Marczykowski-Górecki
db066888e1
Adjust dependencies for clean upgrade
When a file is moved to other package, the new package needs Replaces:
and Breaks: dependecies on old package. Otherwise dpkg will refuse to
change file ownership.

QubesOS/qubes-issues#2771
2017-06-08 22:11:35 +02:00
Marek Marczykowski-Górecki
c8e2c69145
rpm: integrate documentation into main package
QubesOS/qubes-issues#2771
2017-06-08 22:11:35 +02:00
Marek Marczykowski-Górecki
7e608a8bb4
Remove DisposableVM savefile related files
In Qubes 4.0 we no longer use two-stage DisposableVM startup.
2017-06-08 22:11:35 +02:00
Marek Marczykowski-Górecki
3e7a45b4ac
Split network-related files to -networking and -network-manager packages
This will save a lot of dependencies if networking is not needed in VMs
based on given template. Thanks to updates proxy over qrexec, template
itself do not need to have network configured too.

QubesOS/qubes-issues#2771
2017-06-08 22:11:34 +02:00
Marek Marczykowski-Górecki
3940918c61
rpm: make file list more verbose to ease splitting the package
QubesOS/qubes-issues#2771
2017-06-07 10:15:27 +02:00
Marek Marczykowski-Górecki
72b9f389b2
Split dom0-updates handling into subpackage
In Fedora it makes little sense, but in Debian it allows to avoid a lot
of dependencies. So split in both, to keep it simple.

QubesOS/qubes-issues#2771
2017-06-07 10:15:26 +02:00
Marek Marczykowski-Górecki
f9fd7a1673
Rename qubes-nautilus to qubes-core-agent-nautilus
Again, this will make it easier to reason about package origin.

QubesOS/qubes-issues#2771
2017-06-07 10:15:26 +02:00
Marek Marczykowski-Górecki
029d207311
rpm: rename qubes-core-vm to qubes-core-agent
Rename it to match repository name and the same package in Debian.

QubesOS/qubes-issues#2771
2017-06-07 10:15:21 +02:00
Marek Marczykowski-Górecki
4514500ee6
Fix detection of PCI passthrough
Do not enable meminfo-writer (and in consequence qmemman) for the VM if
any real PCI device is present. Do not count qemu-emulated devices.
2017-05-26 05:25:30 +02:00
Marek Marczykowski-Górecki
8694931665
Implement qubes.PostInstall service
This is meant to notify dom0 about features supported by just-installed
template. This service is called by dom0 just after template
installation.

Fixes QubesOS/qubes-issues#1637
Documentation pending: QubesOS/qubes-issues#2829
2017-05-26 05:25:30 +02:00
Marek Marczykowski-Górecki
b49ae50ad5
Implement qrexec-based connection to updates proxy
Configure package manager to use 127.0.0.1:8082 as proxy instead of
"magic" IP intercepted later. The listen on this port and whenever
new connection arrives, spawn qubes.UpdatesProxy service call (to
default target domain - subject to configuration in dom0) and connect
its stdin/out to the local TCP connection. This part use systemd.socket
unit in case of systemd, and ncat --exec otherwise.

On the other end - in target domain - simply pass stdin/out to updates
proxy (tinyproxy) running locally.

It's important to _not_ configure the same VM to both be updates proxy and
use it. In practice such configuration makes little sense - if VM can
access network (which is required to run updates proxy), package manager
can use it directly. Even if this network access is through some
VPN/Tor. If a single VM would be configured as both proxy provider and
proxy user, connection would loop back to itself. Because of this, proxy
connection redirection (to qrexec service) is disabled when the same VM
also run updates proxy.

Fixes QubesOS/qubes-issues#1854
2017-05-26 05:25:29 +02:00
unman
b445ebce50
Enable build for Zesty 2017-05-23 23:59:41 +01:00
Marek Marczykowski-Górecki
f9d6ff89bc
Rename qvm-run to qvm-run-vm
Avoid conflict with qvm-run from qubes-core-admin-client package.
2017-05-23 02:55:31 +02:00
Marek Marczykowski-Górecki
34fa6e7ced
debian: make haveged.service patch less intrusive...
...but installed on all Debian versions. This is mostly required by
vebose file list in debian/qubes-core-agent.install. But also make it
use new options when upstream will set them.

QubesOS/qubes-issues#2161
2017-05-22 17:30:06 +02:00
Marek Marczykowski-Górecki
8e505c5b0e
debian: add missing Build-Depends: python-setuptools 2017-05-22 17:06:02 +02:00
Marek Marczykowski-Górecki
42bc93d8fd
Revert "fedora,debian: update python3-daemon dependency"
This reverts commit 7d8218a1d4.
Follow revert "firewall: switch to python 3"
2017-05-21 02:01:59 +02:00
Marek Marczykowski-Górecki
33da315e17
Revert "firewall: switch to python 3"
This reverts commit 5dfcf06ef4.

python3-daemon isn't widespread enough yet - for Debian jessie available
only in packports.

In addition to the revert itself, adjust packaging for this change
(mostly for Debian).
2017-05-21 02:01:47 +02:00
Marek Marczykowski-Górecki
5047fd9288
debian,fedora: split nautilus integration into separate package
This will allow to avoid a lot of dependencies on minimal template.

QubesOS/qubes-issues#2816
QubesOS/qubes-issues#2771
2017-05-21 01:52:23 +02:00
Marek Marczykowski-Górecki
36fa978a0e
debian: fix qubes-firewall python packaging, make it more verbose
Add --install-layout=deb option to setup.py, so files will not land in
/usr/local.
Also, explicitly list packaged files - make it easier to split the
package later.
2017-05-21 01:47:59 +02:00
Marek Marczykowski-Górecki
6de6a3dff6
travis: update to Qubes 4.0 repositories 2017-05-20 16:04:35 +02:00
Marek Marczykowski-Górecki
89183e9944
Ask for target VM for file-copy in dom0
This way:
 - VM prompt do know VM list, the list may be filtered based on policy
 - source VM don't learn name of target VM

Fixes QubesOS/qubes-issues#910
2017-05-20 15:53:03 +02:00
Marek Marczykowski-Górecki
2b76373abc
Remove duplicated 'close' button from titlebar of gnome applications
Dom0 enforce decorations which already contain close button.

Thanks @dzklaim for the solution.
Fixes QubesOS/qubes-issues#2813
2017-05-20 14:44:04 +02:00
Marek Marczykowski-Górecki
7d8218a1d4
fedora,debian: update python3-daemon dependency
qubes-firewall script now use python3.
2017-05-20 14:44:04 +02:00
Marek Marczykowski-Górecki
ce70887a57
Merge branch 'core3-devel' 2017-05-20 14:43:53 +02:00
Marek Marczykowski-Górecki
abf9a5aa43
Apply gschema overrides also to debian, rename according to guidelines
glib-compile-schemas recommend naming override files with nn_ prefix,
where nn is a number. Lets use 20, to allow both higher and lower
priority files.

QubesOS/qubes-issues#1108
2017-05-20 13:47:05 +02:00
Marek Marczykowski-Górecki
07be216a0d
tests: add run-tests script, plug it into travis
Also, replace subproces.call with a mockup, as notify-send is not
available on travis.
2017-05-20 13:20:08 +02:00
Marek Marczykowski-Górecki
5dfcf06ef4
firewall: switch to python 3 2017-05-20 13:20:08 +02:00
Marek Marczykowski-Górecki
87efe51be0
tests: make firewall tests working regardless of python version
Don't depend on set ordering...
2017-05-20 12:56:23 +02:00
Marek Marczykowski-Górecki
dc8047c3bb
dom0-updates: restructure the script to not update metadata twice
When `qubes-dom0-update --refresh` was called, the script checked
metadata twice - once to check updates availability, then to actually
download them. This two stage approach is needed only on Debian, when
--downloadonly option is not supported. Rearrange code accordingly.

Also, drop --doit option (ignore it), as the same (but more readable)
can be achieved with --check-only.
2017-05-20 03:49:13 +02:00
Marek Marczykowski-Górecki
22e261f909
Add qubes.StartApp service
A simple service to start application described in .desktop file.
This way, dom0 can completely ignore VM-originated Exec= entry.
2017-05-20 03:48:02 +02:00
Marek Marczykowski-Górecki
eef6bbe360
qvm-copy-to-vm: fix handling empty target VM
This means "default" in Qubes 4.0.

QubesOS/qubes-issues#910
2017-05-17 14:22:10 +02:00
Marek Marczykowski-Górecki
d73221ba3b
version 3.2.18 2017-05-16 00:54:18 +02:00
Marek Marczykowski-Górecki
d6f305106c
rpm: don't "append" to not existing /etc/yum.conf
When /etc/yum.conf is not present (yum-deprecated not installed), don't
try to append to it. It would result in invalid configuration file -
without any section header, and break yum when installed later.
2017-05-15 03:09:45 +02:00
Marek Marczykowski-Górecki
9a7dee5b46
dispvm: don't use perl to decode base64-encoded script
This looks like an overkill. And more importantly - required modules are
not installed by default, making it impossible to use in default minimal
template.

Fixes QubesOS/qubes-issues#1610
2017-05-14 23:29:52 +02:00
Marek Marczykowski-Górecki
13c99f1f10
systemd: fix race condition between qubes-db and qubes-early-vm-config
qubes-early-vm-config.service depend on qubes-db daemon running, to
retrieve various configuration parameters. But the startup ordering
declaration was missing

Fixes QubesOS/qubes-issues#2750
2017-05-14 23:13:26 +02:00
Marek Marczykowski-Górecki
ee0255b385
debian,fedora: drop gnome-packagekit from dependencies
We don't use it currently - xterm with console updater is used by
default.
2017-04-24 00:17:34 +02:00
Marek Marczykowski-Górecki
03b0b2e481
version 3.2.17 2017-04-01 21:45:29 +02:00
Marek Marczykowski-Górecki
a6031ca33c
Merge remote-tracking branch 'qubesos/pr/45'
* qubesos/pr/45:
  network: Properly handle comments in NetworkManager.conf (#2584)
2017-04-01 11:58:13 +02:00
Marek Marczykowski-Górecki
aaed44e7d2
Merge remote-tracking branch 'qubesos/pr/44'
* qubesos/pr/44:
  If there is only 1 DNS server make both DNAT rules point to it
2017-04-01 11:56:18 +02:00
Daniel Moerner
93dd8112da
network: Properly handle comments in NetworkManager.conf (#2584)
Qubes-specific options must be added in NetworkManager.conf, even if
those lines are commented out by default. The problem is solved by using
extended regular expressions.
2017-03-28 17:19:12 -04:00
unman
982babb6a2
If there is only 1 DNS server make both DNAT rules point to it 2017-03-19 21:56:34 +00:00
Marek Marczykowski-Górecki
d177e73bba
Merge remote-tracking branch 'qubesos/pr/43'
* qubesos/pr/43:
  Fix more shellcheck warnings
  Fix handling of binds containing spaces
2017-03-17 11:56:22 +01:00
Marek Marczykowski-Górecki
203386af62
Merge remote-tracking branch 'qubesos/pr/42'
* qubesos/pr/42:
  bind-dirs: Create ro if bind target exists
2017-03-17 11:55:23 +01:00
Robin Schneider
e0814b481f
bind-dirs: Create ro if bind target exists
Before, the script skipped none existing ro paths even if the path
existed below /rw. This would require someone who wants to use bind-dirs
only in TemplateBasedVM to ensure that the paths exist before the
bind-dirs script gets called.

This patch changes this behavior so that if the path exists below /rw, it
is ensured that an (empty) file/directory is present in ro (where the
corresponding path from /rw is then bind mounted over).

Requires: Docs update. I can open a PR when this PRs looks good.
Fixes limitation: "Does not work if the file / folder in question does
  not already exist in the root image. I.e. a file that does not exist in
  the root image cannot be bind mounted in the TemplateBasedVM."
Example use case: https://github.com/debops/ansible-persistent_paths
Tested on: Qubes OS 3.2; Debian 8 TemplateBasedVM (and Template)
Related to: https://github.com/QubesOS/qubes-issues/issues/2661
2017-03-16 12:56:54 +01:00