Commit Graph

145 Commits

Author SHA1 Message Date
Marek Marczykowski-Górecki
13c9149b6c
Use improved update-notify script also in Fedora
Among other things this also fixes build failure - those scripts were
installed but not listed in spec file.

Actual check doesn't perform 'apt-get update', so do that when running
"standalone" (not as a hook from 'apt-get').

QubesOS/qubes-issues#1066
2015-11-13 05:28:47 +01:00
qubesuser
f380c346cf Allow to provide customized DispVM home directly in the template VM
This significantly speeds up DispVM creation for large customized
homes, since no data has to be copied, and instead CoW is used.
2015-11-12 15:33:01 +01:00
Marek Marczykowski-Górecki
97e5072315
Revert "preset disable tinyproxy by default"
This reverts commit f32dccb5e3.
Not needed anymore since dropin approach is implemented.
2015-11-11 16:04:52 +01:00
Marek Marczykowski-Górecki
3324307ee2
Merge remote-tracking branch 'origin/pr/46'
* origin/pr/46:
  No longer start /etc/init.d/tinyproxy by default anymore.
2015-11-11 16:04:40 +01:00
Patrick Schleizer
5d6cf722a8
No longer start /etc/init.d/tinyproxy by default anymore.
But allow users to re-enable it through qubes-service framework.
/var/run/qubes-service/tinyproxy

Thanks to @marmarek for helping with this fix!

https://github.com/QubesOS/qubes-issues/issues/1401
2015-11-11 14:57:36 +00:00
Marek Marczykowski-Górecki
2a589f2c20
updates-proxy: use separate directory for PID file
And also use systemd-tmpfiles for that directory creation.

Fixes QubesOS/qubes-issues#1401
2015-11-11 05:57:57 +01:00
Marek Marczykowski-Górecki
90b4398863
Merge remote-tracking branch 'origin/pr/43'
* origin/pr/43:
  preset disable tinyproxy by default
2015-11-11 05:27:52 +01:00
Marek Marczykowski-Górecki
3466f3df35
systemd: make sure that update check is started only after qrexec-agent 2015-11-11 02:36:57 +01:00
Patrick Schleizer
f32dccb5e3 preset disable tinyproxy by default
Fixes https://github.com/QubesOS/qubes-issues/issues/1401
2015-11-10 20:08:26 +00:00
Olivier MEDOC
0c33c73b8e dropins: implement dropins for systemd user starting with pulseaudio systemd service and socket masking
Conflicts:
	Makefile
2015-11-07 19:12:30 +01:00
Olivier MEDOC
4b5332081e add DROPINS for org.cups.cupsd systemd files. 2015-11-06 19:36:52 +01:00
Marek Marczykowski-Górecki
6752be9196
No longer disable auditd
On Fedora 22 console is trashed with a lot of messages without auditd
running.

QubesOS/qubes-issues#1282
2015-11-03 18:15:20 +01:00
Marek Marczykowski-Górecki
c2596a0435
Setup updates proxy in dnf and PackageKit
DNF doesn't support even including another config file, so all the
settings needs to go into `/etc/dnf/dnf.conf`. The same about
PackageKit, which is needed because it doesn't use `dnf.conf`:
http://lists.freedesktop.org/archives/packagekit/2015-September/026389.html

Because that proxy settings goes to so many places now, create a
separate script for that.

QubesOS/qubes-issues#1282
QubesOS/qubes-issues#1197
2015-10-30 15:13:56 +01:00
Patrick Schleizer
f063b4a90f
Renamed qubes-mount-home to qubes-mount-dirs.
Renamed qubes-mount-home service and mount-home.sh script to qubes-mount-dirs service and mount-dirs.sh.
Because mount-home.sh also processed /rw/usrlocal.
preparation to fix the following issues:
- upstream bind-directories functionality to Qubes - https://phabricator.whonix.org/T414
- Bind mount /rw/usrlocal -> /usr/local instead of symlink - https://github.com/QubesOS/qubes-issues/issues/1150
- /bin/sync hangs forever in whonix-ws-dvm - https://github.com/QubesOS/qubes-issues/issues/1328
2015-10-15 20:57:43 +00:00
Patrick Schleizer
2eb0ed2be1
removed trailing spaces 2015-10-15 04:34:55 +02:00
Marek Marczykowski-Górecki
7963fb91c7
systemd: actually enable qubes-random-seed service
QubesOS/qubes-issues#1311
2015-10-10 16:23:46 +02:00
HW42
05292c0ac5
reload qubes-random-seed when restoring DispVM 2015-10-10 00:45:48 +02:00
HW42
0ffa746678
qubes-random-seed: feed kernel rng with randomness from dom0 2015-10-10 00:45:44 +02:00
Marek Marczykowski-Górecki
2bdbf37ef9
Run 'ldconfig' to update /usr/local/lib* cache, if applicable
Fixes QubesOS/qubes-issues#1255
2015-10-05 06:13:49 +02:00
Marek Marczykowski-Górecki
8e497bffc0
Merge branch 'qubes-iptables'
Conflicts:
	debian/control
	rpm_spec/core-vm.spec

QubesOS/qubes-issues#1067
2015-10-05 01:47:01 +02:00
Marek Marczykowski-Górecki
2a39adfe0f
Enlarge /tmp and /dev/shm
Initial size of those tmpfs-mounted directories is calculated as 50% of
RAM at VM startup time. Which happen to be quite small number, like
150M. Having such small /tmp and/or /dev/shm apparently isn't enough for
some applications like Google chrome. So set the size statically at 1GB,
which would be the case for baremetal system with 2GB of RAM.

Fixes QubesOS/qubes-issues#1003
2015-10-04 23:07:10 +02:00
Patrick Schleizer
c13e11d57e fixed 'Debian 8 apt.config.d misconfiguration'
prevent the Acquire::http::Proxy setting ending up multiple times inside /etc/apt/apt.conf.d/01qubes-proxy
(reported by @Scinawa)
https://github.com/QubesOS/qubes-issues/issues/1186
2015-09-12 18:34:49 +00:00
Marek Marczykowski-Górecki
c09d1d9d61
systemd: fix starting cups 2015-09-01 17:19:59 +02:00
Marek Marczykowski-Górecki
4703e3fca7
Remove dynamically generated autostart desktop files
qubesos/qubes-issues#1151
2015-08-27 22:08:04 +02:00
Marek Marczykowski-Górecki
3ccbde9a3c
debian: disable netfilter-persistent.service
This is now handled by qubes-iptables.service

qubesos/qubes-issues#1067
2015-08-09 20:32:35 +02:00
Marek Marczykowski-Górecki
65e9e4c72c
network: use own iptables service instead of repurposing existing one
There were multiple problems with reusing existing one:
 - need to sync with upstream changes (configuration path etc)
 - conflicts resolution on updates
 - lack of iptables --wait, which causes firewall fail to load sometimes

QubesOS/qubes-issues#1067
2015-08-09 20:09:51 +02:00
Marek Marczykowski-Górecki
13c54badcb
Move /usr/share/qubes/xdg to /var/lib/qubes/xdg
No files in /usr should be modified during package runtime, `/var` is
for that. So move this data there.
2015-08-08 02:01:15 +02:00
Jason Mehring
b6c19fc2ef qubes-desktop-file-install: Manages xdg desktop entry files
qubes-desktop-file-install is called by qubes-triggers-desktop-file-install. It's
arguments are based on the Gnome desktop-install-file utility to allow it to be replaced
by same.  Currently the Gnome utility can not be used since it automatically validates
the .desktop entry files with no option to skip validation and will fail on some third
party .desktop files that are not formed properly.

A single trigger script is shared between Fedora, Debian.  This script is used by the
package managers triggers and will copy original .desktop files from `/etc/xdg/autostart`
to `/usr/share/qubes/xdg/autostart` and modify the OnlyShownIn / NotShownIn, etc.  The
original .desktop files are left untouched and left in place.

Qubes modifies the XDG_CONFIG_DIRS to first include the `/usr/share/qubes/xdg`
directory (XDG_CONFIG_DIRS=/usr/share/qubes/xdg:/etc/xdg).

If a package gets removed, it's desktop entry is also removed from the /usr/share/qubes/xdg
directory.

'qubes-desktop-file-install' options:
   --dir DIR                          Install desktop files to the DIR directory (default: <FILE>)
   --force                            Force overwrite of existing desktop files (default: False)
   --remove-show-in                   Remove the "OnlyShowIn" and "NotShowIn" entries from the desktop file (default: False)
   --remove-key KEY                   Remove the KEY key from the desktop files, if present
   --set-key (KEY VALUE)              Set the KEY key to VALUE
   --remove-only-show-in ENVIRONMENT  Remove ENVIRONMENT from the list of desktop environment where the desktop files should be displayed
   --add-only-show-in ENVIRONMENT     Add ENVIRONMENT to the list of desktop environment where the desktop files should be displayed
   --remove-not-show-in ENVIRONMENT   Remove ENVIRONMENT from the list of desktop environment where the desktop files should not be displayed
   --add-not-show-in ENVIRONMENT      Add ENVIRONMENT to the list of desktop environment where the desktop files should not be displayed
2015-08-07 09:15:30 -04:00
Jason Mehring
b3a692b8cc vm-systemd: Add systemd drop-in support which include conditionals to prevent services from starting
Added all the drop-ins and remove older .service overrides
2015-08-04 10:32:41 -04:00
Jason Mehring
579f731e5e Re-aranged qubes-vm.preset to indicate which services are specificly for Fedora only 2015-08-04 10:32:41 -04:00
Jason Mehring
bd47b0cfdc
Use 'which' to locate fuser since fuser path is different in Fedora and Debian 2015-08-02 17:45:31 -04:00
Marek Marczykowski-Górecki
549761a144 Do not override file pointed by /etc/localtime symlink
On Fedora 21 (and probably others) /etc/localtime is no longer file
copy, but a symlink to original timezone file. Using `cp` to change
timezone here would override original file instead of just changing the
timezone.

Details:
https://groups.google.com/d/msgid/qubes-users/4a0de9457e08b93d1a39ac4cdbc6b632%40ruggedinbox.com
2015-06-23 19:59:17 +02:00
Jason Mehring
21d89335fe
debian: Update notification now notifies dom0 when an upgrade is completed 2015-04-25 03:44:28 -04:00
Jason Mehring
4373cda566 Changed location of PROTECTED_FILE_LIST to /etc/qubes/protected-files.d 2015-04-25 02:36:43 +02:00
Jason Mehring
56b0685aaa whonix: Added protected-files file used to prevent scripts from modifying files that need to be protected
A file is created in /var/lib/qubes/protected-files.  Scripts can grep this file before modifying
        known files to be protected and skip any modifications if the file path is within protected-files.

        Usage Example:
            if ! grep -q "^/etc/hostname$" "${PROTECTED_FILE_LIST}" 2>/dev/null; then

        Also cleaned up maintainer scripts removing unneeded systemd status functions and streamlined
        the enable/disable systemd unit files functions
2015-04-25 02:36:43 +02:00
Marek Marczykowski-Górecki
f2cf6933b9 prepare-dvm: fix bashism
$(( )) is POSIX syntax for shell arithmetic operations. Especially dash
(default shell in Debian) doesn't support $[ ].
2015-04-15 18:52:42 +02:00
Marek Marczykowski-Górecki
ff63a0b876 Minor fixes in mount-home.sh
Hide unneeded messages.
2015-04-11 02:51:10 +02:00
Marek Marczykowski-Górecki
65bc22fd1d Fix resizing of /rw partition (private.img)
Offline resize requires to run fsck -f first. Because we support only
growing that image, we can simply use online resize instead.

This finally fixes qubesos/qubes-issues#772
2015-04-11 02:47:16 +02:00
Marek Marczykowski-Górecki
285071bd59 systemd: disable avahi-daemon and dnf-makecache
Especially dnf-makecache is senseless as its state will not survive VM
restart, but it takes a lot of CPU time.
2015-04-10 18:23:14 +02:00
Marek Marczykowski-Górecki
343ce1814c systemd: use presets to enable services, call preset-all
This way the services will be enabled/disabled regardless of its initial
state.
2015-04-07 02:30:59 +02:00
Marek Marczykowski-Górecki
a58d0f95f7 Update comments and xenbus intf in startup scripts regarding vchan requirements 2015-03-25 00:20:11 +01:00
Marek Marczykowski-Górecki
04b5bd1b0a Do not load xen-usbfront automatically
We no longer provide this module (it looks to be a dead project).
Instead in newer kernel USBIP can be used.
2015-03-21 00:54:19 +01:00
Marek Marczykowski-Górecki
b0c90d9d6c Provide stub files in /rw/config 2015-03-19 23:40:25 +01:00
Marek Marczykowski-Górecki
34a38c668e Create filesystem if the private.img is empty 2015-03-18 00:33:30 +01:00
Marek Marczykowski-Górecki
3687c4e622 dispvm: do not restart qubesdb-daemon, use watch instead
qubesdb-daemon will handle reconnection by itself.
2015-03-04 02:10:28 +01:00
Marek Marczykowski-Górecki
57be910135 dispvm: include memory caches in "used memory" notification
Also make the code more readable.
2015-03-04 02:09:18 +01:00
Marek Marczykowski-Górecki
4303b7dc52 dispvm: use qubes.WaitForSession to wait for gui-agent startup 2015-03-04 02:08:22 +01:00
Marek Marczykowski-Górecki
88d7ca7940 Move mounting /rw and /home to separate service
Many services depended on misc-post only because this was where /home
gets mounted. Move that to separate service, started earlier.
2015-03-04 01:52:18 +01:00
Marek Marczykowski-Górecki
06a0d30d50 dispvm: start gui agent early, do not kill Xorg
Now gui agent support reconnecting to guid.
2015-03-02 02:30:06 +01:00
Marek Marczykowski-Górecki
fdca69ae78 fc21: fix DispVM preparation - Xorg has new name 2015-03-01 20:27:27 +01:00