Without this restriction system users can start processes with
root privileges:
$ sudo -u mail systemd-run --pipe -q id
uid=0(root) gid=0(root) groups=0(root)
* origin/pr/184:
Add services for paranoid backup restore mode
qfile-unpacker: add option (-w) to wait for disk space before extracting
tar2qfile: fix argument parser
qfile-unpacker: add option for custom user and target directory
* origin/pr/239:
xendriverdomain: remove placeholder for sbinpath
Fix regex in qubes-fix-nm-conf.sh
Update travis
xendriverdomain: remove Requires and After proc-xen.mount
Drop legacy xen entry in fstab
Looks like desktop entries doesn`t allow environment variables in Exec string.
qubes.StartApp+qubes-open-file-manager-dom0[1782]: gio: file:///home/user/$HOME: Error when getting information for file “/home/user/$HOME”: No such file or directory
switching to '.' resolve it.
Add a pair of services:
1. qubes.RegisterBackupLocation - called by dom0, registers what backup
location (including both file and command options) can be accessed.
Registered location gets an ID returned to the caller. The location (and
its ID) is valid as long as the service call remains open.
2. qubes.RestoreById - called by restoring DispVM to retrieve the backup
content. The service expects location ID as an argument, and then list
of files/directories (separated with spaces) on the first line of stdin.
This is very similar to qubes.Restore service, with exception for the
archive location control.
QubesOS/qubes-issues#5310
The whole distutils module is a legacy thing in python3. Specifically,
most of it is not installed in Debian by default (there is only
distutils.version). Depending on python3-distutils is problematic, as
it's availability varies between Debian versions.
Instead of fighting with special cases in dependencies, replace the
whole thing with non-legacy shutil.which() (available since Python 3.3).
Correctly extract packages from transaction items:
- old (pre DNF 4): iterate over item.installs()
- new (DNF 4+): item.pkg
The old DNF is not supported anymore, so do not care about it.
The https://bugzilla.redhat.com/1650446 is fixed for enough time already
(included in all supported distributions). The workaround for the bug
have two issues:
- may download repository metadata again
- ignores various settings, including proxy, which breaks it in
TemplateVM
This reverts commit 8d7313b928.
This specifically fixes qvm-console-dispvm tool, which uses
qubes.ShowInTerminal to show the actual console. This service uses
xterm, so it needs X session running already.
FixesQubesOS/qubes-issues#5805
* origin/pr/228:
Override PAM config for su in RPM package
Use pam-configs to override Debian PAM config
Lock root password in passwordless-root package
Enable root autologin on serial console
In Red Hat based distributions, there is no pam-configs like
mechanism (authselect seems too heavy and is not configured by
default), so instead, we replace the PAM file.
Enable su for users in the qubes group, same as in the Debian
package.
While stderr isn't connected to the local_program argument (qrun-in-vm)
of qrexec-client-vm, it *is* connected (by qrexec-client-vm itself) to
the command the user passed to *to qvm-run-vm*.
