Commit Graph

2250 Commits

Author SHA1 Message Date
Marek Marczykowski-Górecki
5512e4eada
qrexec: use exec_qubes_rpc_if_requested() from qubes-utils
This avoids duplicating service call parsing in multiple places.
Further improvements to that code (like avoid using shell) can be
implemented in one place.
2018-02-16 04:25:56 +01:00
Rusty Bird
4247d4f699
Really enable qubes-sync-time.timer
'systemctl enable' (and thus the preset) needs an [Install] section.
2018-02-14 13:52:17 +00:00
Marek Marczykowski-Górecki
68304ef9f5
Merge remote-tracking branch 'qubesos/pr/95'
* qubesos/pr/95:
  Add /etc/qubes path
  Add qubes-firewall.d feature
2018-02-14 13:57:02 +01:00
Christopher Laprise
10aee73bd7
Add /etc/qubes path 2018-02-13 23:39:28 -05:00
Marek Marczykowski-Górecki
76f5253341
Drop fakeroot for list/search actions on Debian
It isn't needed for informative actions and apparently fakeroot cause
problems on Whonix.

Suggested by @awokd
QubesOS/qubes-issues#3553
2018-02-14 03:12:05 +01:00
Marek Marczykowski-Górecki
c567222b6f
dom0-update: add some approximation of 'list', 'search' and 'reinstall'
... on systems lacking yum --downloadonly

Fixes QubesOS/qubes-issues#3553
2018-02-14 03:12:05 +01:00
Marek Marczykowski-Górecki
96aa933024
Wait for user session as X session owner
... instead of requested user. This makes sure that session startup
script will be able to send a signal here to notify about session
startup.

This is especially needed when the first service started in the VM is
called as root (like qubes.InstallUpdatesGUI).

Fixes QubesOS/qubes-issues#3526
2018-02-14 02:19:15 +01:00
Christopher Laprise
a262574f85
Add qubes-firewall.d feature 2018-02-13 17:38:14 -05:00
Marek Marczykowski-Górecki
3ddd687286
Call qubes.PostInstall service to notify dom0 about all apps/features
Update dom0 about all applications installed, not only desktop files for
them. Update also supported features and other things advertised
initially at template installation.

Fixes QubesOS/qubes-issues#3579
2018-02-13 17:05:42 +01:00
Marek Marczykowski-Górecki
f38e204aa7
Drop Fedora < 22 support
yum actions no longer relevant
2018-02-13 17:04:59 +01:00
Marek Marczykowski-Górecki
4a27d9e3fd
version 4.0.21 2018-02-13 04:56:43 +01:00
Marek Marczykowski-Górecki
06f0d865b4
Merge remote-tracking branch 'qubesos/pr/87'
* qubesos/pr/87:
  tests: check if qubes-firewall-user-script is called
  qubes-firewall: call firewall-user-script at service startup
2018-02-13 04:45:28 +01:00
Marek Marczykowski-Górecki
4914eb1437
Merge remote-tracking branch 'qubesos/pr/90'
* qubesos/pr/90:
  Stop Debian templates from forwarding by default.
2018-02-13 04:45:04 +01:00
Marek Marczykowski-Górecki
15301d3922
Merge remote-tracking branch 'qubesos/pr/91'
* qubesos/pr/91:
  bind-dirs.sh: don't fail on empty configuration directory
2018-02-13 04:42:34 +01:00
Marek Marczykowski-Górecki
65be69db5a
Merge remote-tracking branch 'qubesos/pr/92'
* qubesos/pr/92:
  network: reload DNS only on "up" event from NetworkManager
2018-02-13 04:40:53 +01:00
Marek Marczykowski-Górecki
c142e20baa
Do not sync VM time with clockvm if it's set to network time sync
When VM is set to synchronize the time with the network, to not sync its
time with clockvm.
Besides not having sense, in default configuration it will lead to
loopback qrexec connection (sys-net -> sys-net), which will hang.

QubesOS/qubes-issues#3333
2018-02-13 04:23:08 +01:00
Marek Marczykowski-Górecki
e497858768
Fix systemd-timesyncd.service startup
Add After=qubes-sysinit.service to avoid startup condition being
evaluated before initializing qubes-service directory.

Fixes QubesOS/qubes-issues#3333
2018-02-13 02:14:08 +01:00
Marek Marczykowski-Górecki
0b7f1fa905
dom0-updates: refactor for ease adding new actions with old yum
Some more actions could be implemented even without --downloadonly
option. Ease doing so.

QubesOS/qubes-issues#3553
2018-02-11 13:54:34 +01:00
Marek Marczykowski-Górecki
0639a4b932
network: reload DNS only on "up" event from NetworkManager
NetworkManager reports a bunch of events, reloading DNS at each of them
doesn't make sense and is harmful - systemd have ratelimit on service
restart.

Fixes QubesOS/qubes-issues#3135
2018-02-10 22:12:44 +01:00
Rusty Bird
744cab8639
bind-dirs.sh: don't fail on empty configuration directory
nullglob must be active before a glob is used on a potentially empty
directory. Call shopt immediately after the shebang line.

Fixes QubesOS/qubes-issues#3552
2018-02-08 13:21:01 +00:00
unman
d8362aec9e
Stop Debian templates from forwarding by default. 2018-02-06 23:10:28 +00:00
Marek Marczykowski-Górecki
6b48d79d8c
tests: check if qubes-firewall-user-script is called
QubesOS/qubes-issues#3260
2018-02-05 18:17:29 +01:00
Marek Marczykowski-Górecki
6c33652ed4
qubes-firewall: call firewall-user-script at service startup
Call it just after creating base chains in iptables/nftables. This allow
the user to modify how those rules are plugged in, add custom rules at
beginning/end etc.

Fixes QubesOS/qubes-issues#3260
2018-02-05 18:17:11 +01:00
Marek Marczykowski-Górecki
c6cdbf87b0
version 4.0.20 2018-01-29 21:57:11 +01:00
Marek Marczykowski-Górecki
cfbc9533d8
Add intel wifi drivers to suspend-module-blacklist
It is necessary to blacklist them on (almost?) any hardware, so lets do
this by default.

Fixes QubesOS/qubes-issues#3049
2018-01-28 18:28:20 +01:00
Marek Marczykowski-Górecki
94e885275c
version 4.0.19 2018-01-24 01:46:25 +01:00
Marek Marczykowski-Górecki
c5c4572f80
Mount root fs with 'discard' option by default
On LVM thin provisioning this makes manual template's root fs compacting
not needed anymore.

Fixes QubesOS/qubes-issues#2479
2018-01-23 15:10:40 +01:00
Marek Marczykowski-Górecki
0459ba6970
version 4.0.18 2018-01-23 14:17:05 +01:00
Marek Marczykowski-Górecki
ee122eefef
Detach all drivers from PCI devices before suspend
The most common thing to fix S3 sleep is to unload PCI devices drivers
before suspend. Instead of having every user figuring out what drivers
needs to be blacklisted, detach all drivers from actual PCI devices.
Exclude qemu emulated devices.

Fixes QubesOS/qubes-issues#3486
2018-01-22 21:53:03 +01:00
Marek Marczykowski-Górecki
79b38cf106
Place list of loaded modules in /var/run directly
Do not use /var/run/qubes for this, as it may be non-root writeable and
someone may want to isolate root/user.
Also, remove the file after resume.
2018-01-22 19:13:53 +01:00
Marek Marczykowski-Górecki
977f41276b
version 4.0.17 2018-01-18 19:30:32 +01:00
Rusty Bird
b23e2ed70d
Remove stranded block-snapshot script
The real block-snapshot script is in qubes-core-admin.
2018-01-16 06:35:45 +00:00
Rusty Bird
6c2b9fd638
qvm-run-vm: wait for X11 in DispVM case
qvm-run-vm cannot make a separate qubes.WaitForSession call for a
DispVM. Instead, pass the new WaitForSession argument to qubes.VMShell,
which will do the equivalent.
2018-01-14 19:21:01 +00:00
Rusty Bird
72fef1ee4c
qvm-run-vm: appease ShellCheck without comment 2018-01-14 19:20:59 +00:00
Rusty Bird
ce1f0af216
Set 'wait-for-session=1' for 'qubes.VMShell+WaitForSession'
This is intended to be used for DispVMs for which only a single RPC call
can be made before they are destroyed.

Fixes QubesOS/qubes-issues#3012
2018-01-14 19:20:58 +00:00
Marek Marczykowski-Górecki
1b774f9a87
version 4.0.16 2018-01-12 06:18:51 +01:00
Marek Marczykowski-Górecki
7ecb74ae3b
Disable automatic scaling in GNOME/GTK applications
GNOME automatically set scaling factor to 2 when HiDPI is detected.
Unfortunately it does it also on not really HiDPI displays, making the
whole UI unusably large. There is no middle ground - scaling factor must
be integer, so 1.5 is not supported. Lets opt on a conservative side and
fallback to scaling factor 1.

Solution by @alyssais, thanks!
Fixes QubesOS/qubes-issues#3108
2018-01-12 06:00:18 +01:00
Marek Marczykowski-Górecki
4cd16a2734
Enable gnome settings daemon xsettings plugin
When one use scaling set by gnome tools (gsettings or
gnome-tweak-tool), gsd-xsettings must be running to apply the change
also to other applications.
This include auto scaling on HiDPI screens.

This commit fixes non-uniform behaviour on different VM types.

QubesOS/qubes-issues#3108
2018-01-12 05:44:54 +01:00
Marek Marczykowski-Górecki
d4f6eb1f4a
Install KDE actions for KDE5
Fixes QubesOS/qubes-issues#3449
2018-01-09 17:42:21 +01:00
Marek Marczykowski-Górecki
7d82029aec
Fix kdialog --progressbar usage
Returned dbus reference is multi-word string, it was not quoted on
purpose. ShellCheck was wrong about it.

QubesOS/qubes-issues#3449
2018-01-08 03:07:14 +01:00
Marek Marczykowski-Górecki
a8aa41e040
Merge remote-tracking branch 'qubesos/pr/83'
* qubesos/pr/83:
  qrexec: fix infinite loop when multiple services are waiting for GUI
2018-01-05 19:00:27 +01:00
Marek Marczykowski-Górecki
4c47ce139e
qrexec: fix infinite loop when multiple services are waiting for GUI
Reported by @ctrlaltdel
Fixes QubesOS/qubes-issues#3433
2017-12-28 17:31:06 +01:00
Marek Marczykowski-Górecki
c324b16252
firewall: allow also related traffic
This include ICMP error messages for allowed traffic.

Fixes QubesOS/qubes-issues#3406
2017-12-28 05:34:30 +01:00
Marek Marczykowski-Górecki
3a83623647
firewall: don't crash the whole qubes-firewall service on DNS fail
If DNS resolution fails, just block the traffic (for this VM), but don't
crash the whole service.

Fixes QubesOS/qubes-issues#3277
2017-12-28 05:15:00 +01:00
Marek Marczykowski-Górecki
180146a5c2
version 4.0.15 2017-12-23 02:53:43 +01:00
Marek Marczykowski-Górecki
ec83df64e3
qubes.GetImageRGBA: fix handling '-' path without explicit type
There was a bug that interpreted '-' as file type. But convert don't
know how to handle '-' file type, so refused to proceed.

Fixes QubesOS/qubes-issues#3085
2017-12-22 16:48:37 +01:00
Marek Marczykowski-Górecki
e8656e1b41
Merge remote-tracking branch 'qubesos/pr/79'
* qubesos/pr/79:
  make apt-get apt-transport-tor broken in Qubes non-networked TemplateVMs
2017-12-22 01:19:59 +01:00
Marek Marczykowski-Górecki
57d43430e1
qrexec: setup process environment when not using fork server
If fork server is used, proper environment is inherited from the
session. But in other case (like non-default user), it needs to be
created by qrexec-agent itself. PAM provide some variables, but not the
most basic: HOME, SHELL, USER, LOGNAME. Also process should be started
in user home directory (if available).

Fixes QubesOS/qubes-issues#3416
2017-12-22 01:14:19 +01:00
MB
3339df739d
Fall back to direct execution when dbus is not installed or running
I have been using this with a dbus-less Gentoo template since the original
change, and have tested recently on whonix-gw with dbus enabled and running.

(cherry picked from commit bf69335074b45157734b881cc14d54ea43e7902a)
2017-12-20 20:56:29 +01:00
Patrick Schleizer
7fd008b1a8
make apt-get apt-transport-tor broken in Qubes non-networked TemplateVMs
fixes https://github.com/QubesOS/qubes-issues/issues/3403
2017-12-16 19:17:38 +01:00