Commit Graph

197 Commits

Author SHA1 Message Date
Marek Marczykowski-Górecki
c5fae6ac55
qubes-rpc: add 'wait-for-session=1' option for some services
Configure selected services to wait until GUI session is available.

QubesOS/qubes-issues#2974
2017-08-09 00:58:49 +02:00
Marek Marczykowski-Górecki
5ecd51dab7
document /etc/qubes/rpc-config
QubesOS/qubes-issues#2974
2017-08-09 00:58:48 +02:00
Marta Marczykowska-Górecka
f55412cd1e
clock synchronization rewrite
clock synchronization mechanism rewritten to use systemd-timesync instead of NtpDate; at the moment, requires:
- modifying /etc/qubes-rpc/policy/qubes.GetDate to redirect GetDate to designated clockvm
- enabling clocksync service in clockvm ( qvm-features clockvm-name service/clocksync true )

Works as specified in issue listed below, except for:
- each VM synces with clockvm after boot and every 6h
- clockvm synces time with the Internet using systemd-timesync
- dom0 synces itself with clockvm every 1h (using cron)

fixes QubesOS/qubes-issues#1230
2017-07-06 23:37:26 +02:00
Marek Marczykowski-Górecki
68d98179f0
Do not load 'dummy-hcd' kernel module
It isn't really needed. It was used to workaround libusb bug (causing
crash when the system does not have any USB controller), but since we
use HVM now which do have some USB controllers it isn't needed anymore.

Also, it is not available in stock Fedora kernels.
2017-07-05 00:20:57 +02:00
Marek Marczykowski-Górecki
cfbd50a936
debian: install man pages
Man pages were installed only in RPM package...
2017-06-21 11:21:40 +02:00
Marek Marczykowski-Górecki
f4be704ac0
Ship Qubes 4.0 repository definition and keys 2017-06-14 10:45:43 +02:00
Marek Marczykowski-Górecki
2a117548b6
Ship grub configuration
Qubes VM require few config options in grub. Ship appropriate
configuration. Debian have grub.d support, so it can be done cleanly.
On Fedora, /etc/default/grub needs to be modified. Still keep the
options in separate file, but include it manually from
/etc/default/grub.

QubesOS/qubes-issues#2577
2017-06-14 10:45:43 +02:00
Marek Marczykowski-Górecki
ce63d31a2e
Make all scripts in qubes-rpc executable
Don't rely on legacy feature of interpreting non-executable files as
scripts there.
2017-06-09 23:09:58 +02:00
Marek Marczykowski-Górecki
422f03e9ac
Add qubes.VMRootShell service
It is the same as qubes.VMShell - the actual difference is in qrexec
policy, which contains 'user=root' option.

QubesOS/qubes-issues#2572
2017-06-09 23:06:09 +02:00
Marek Marczykowski-Górecki
58d21f095f
Remove old vusb scripts
This is unused for a long time (since we've moved to USBIP).
2017-06-08 22:11:37 +02:00
Marek Marczykowski-Górecki
22002a34f3
Do not report spurious failure of qubes.WaitForSession service
It is expected to be killed by a signal. Exit with returncode 0 anyway.
While at it, adjust it for current service format (executable, with
proper shebang).
2017-06-08 22:11:36 +02:00
Marek Marczykowski-Górecki
7e608a8bb4
Remove DisposableVM savefile related files
In Qubes 4.0 we no longer use two-stage DisposableVM startup.
2017-06-08 22:11:35 +02:00
Marek Marczykowski-Górecki
8694931665
Implement qubes.PostInstall service
This is meant to notify dom0 about features supported by just-installed
template. This service is called by dom0 just after template
installation.

Fixes QubesOS/qubes-issues#1637
Documentation pending: QubesOS/qubes-issues#2829
2017-05-26 05:25:30 +02:00
Marek Marczykowski-Górecki
b49ae50ad5
Implement qrexec-based connection to updates proxy
Configure package manager to use 127.0.0.1:8082 as proxy instead of
"magic" IP intercepted later. The listen on this port and whenever
new connection arrives, spawn qubes.UpdatesProxy service call (to
default target domain - subject to configuration in dom0) and connect
its stdin/out to the local TCP connection. This part use systemd.socket
unit in case of systemd, and ncat --exec otherwise.

On the other end - in target domain - simply pass stdin/out to updates
proxy (tinyproxy) running locally.

It's important to _not_ configure the same VM to both be updates proxy and
use it. In practice such configuration makes little sense - if VM can
access network (which is required to run updates proxy), package manager
can use it directly. Even if this network access is through some
VPN/Tor. If a single VM would be configured as both proxy provider and
proxy user, connection would loop back to itself. Because of this, proxy
connection redirection (to qrexec service) is disabled when the same VM
also run updates proxy.

Fixes QubesOS/qubes-issues#1854
2017-05-26 05:25:29 +02:00
Marek Marczykowski-Górecki
f9d6ff89bc
Rename qvm-run to qvm-run-vm
Avoid conflict with qvm-run from qubes-core-admin-client package.
2017-05-23 02:55:31 +02:00
Marek Marczykowski-Górecki
34fa6e7ced
debian: make haveged.service patch less intrusive...
...but installed on all Debian versions. This is mostly required by
vebose file list in debian/qubes-core-agent.install. But also make it
use new options when upstream will set them.

QubesOS/qubes-issues#2161
2017-05-22 17:30:06 +02:00
Marek Marczykowski-Górecki
33da315e17
Revert "firewall: switch to python 3"
This reverts commit 5dfcf06ef4.

python3-daemon isn't widespread enough yet - for Debian jessie available
only in packports.

In addition to the revert itself, adjust packaging for this change
(mostly for Debian).
2017-05-21 02:01:47 +02:00
Marek Marczykowski-Górecki
36fa978a0e
debian: fix qubes-firewall python packaging, make it more verbose
Add --install-layout=deb option to setup.py, so files will not land in
/usr/local.
Also, explicitly list packaged files - make it easier to split the
package later.
2017-05-21 01:47:59 +02:00
Marek Marczykowski-Górecki
89183e9944
Ask for target VM for file-copy in dom0
This way:
 - VM prompt do know VM list, the list may be filtered based on policy
 - source VM don't learn name of target VM

Fixes QubesOS/qubes-issues#910
2017-05-20 15:53:03 +02:00
Marek Marczykowski-Górecki
2b76373abc
Remove duplicated 'close' button from titlebar of gnome applications
Dom0 enforce decorations which already contain close button.

Thanks @dzklaim for the solution.
Fixes QubesOS/qubes-issues#2813
2017-05-20 14:44:04 +02:00
Marek Marczykowski-Górecki
ce70887a57
Merge branch 'core3-devel' 2017-05-20 14:43:53 +02:00
Marek Marczykowski-Górecki
abf9a5aa43
Apply gschema overrides also to debian, rename according to guidelines
glib-compile-schemas recommend naming override files with nn_ prefix,
where nn is a number. Lets use 20, to allow both higher and lower
priority files.

QubesOS/qubes-issues#1108
2017-05-20 13:47:05 +02:00
Marek Marczykowski-Górecki
5dfcf06ef4
firewall: switch to python 3 2017-05-20 13:20:08 +02:00
Marek Marczykowski-Górecki
22e261f909
Add qubes.StartApp service
A simple service to start application described in .desktop file.
This way, dom0 can completely ignore VM-originated Exec= entry.
2017-05-20 03:48:02 +02:00
Marek Marczykowski-Górecki
d8e568fa13
systemd: place user dropins in /usr/lib instead of /lib
On non-Fedora those are not equivalent. On Debian, user units in /lib
are not supported

Reported by @adrelanos
Fixes QubesOS/qubes-issues#2644
2017-02-21 01:37:24 +01:00
Marek Marczykowski-Górecki
cf97f4f8e7
Merge remote-tracking branch 'qubesos/pr/40'
* qubesos/pr/40:
  Stop unnecessary services in Debian
2017-02-20 23:27:07 +01:00
unman
1ed2954f91
Stop unnecessary services in Debian 2017-02-16 22:41:14 +00:00
Marek Marczykowski-Górecki
dcbd20f08c
Merge remote-tracking branch 'qubesos/pr/39'
* qubesos/pr/39:
  Apply gschema override preventing previews in nautilus in Debian
2017-02-16 16:51:56 +01:00
Marek Marczykowski-Górecki
08edfa630d
Merge remote-tracking branch 'qubesos/pr/35'
* qubesos/pr/35:
  Constrain cron and anacron in Ubuntu also
  Stop anacron from starting in Debian using existing constraint on cron
2017-02-12 23:59:43 +01:00
unman
8d1b74d732
Apply gschema override preventing previews in nautilus in Debian 2017-02-12 03:06:48 +00:00
unman
3180d09ff4
Constrain cron and anacron in Ubuntu also 2017-02-06 00:08:33 +00:00
unman
a361fb454c
Stop anacron from starting in Debian using existing constraint on cron 2017-02-05 23:36:27 +00:00
Olivier MEDOC
8ba584dfb0 Makefile: enforce mode 750 for directories /etc/sudoers.d and /etc/polkit-1/rules.d 2017-01-29 15:01:01 +01:00
Marek Marczykowski-Górecki
7c18322ffa
Merge remote-tracking branch 'qubesos/pr/27'
* qubesos/pr/27:
  v2: (vm) qvm-move-to-vm: don't "rm -rf" vm name argument
2016-12-04 21:56:11 +01:00
Rusty Bird
0d243250f2
v2: (vm) qvm-move-to-vm: don't "rm -rf" vm name argument
Fixes QubesOS/qubes-issues#2472 from commit
3f600d03fa
2016-12-04 16:50:59 +00:00
unman
58febd6d20
Add systemd override for haveged in xenial and stretch. (#2161)
Reenable haveged.service after debian package installation
2016-11-14 02:33:20 +00:00
Marek Marczykowski-Górecki
1c42a06238
network: integrate vif-route-qubes-nat into vif-route-qubes
Since 'script' xenstore entry no longer allows passing arguments
(actually this always was a side effect, not intended behaviour), we
need to pass additional parameters some other way. Natural choice for
Qubes-specific script is to use QubesDB.
And since those parameters are passed some other way, it is no longer
necessary to keep it as separate script.

Fixes QubesOS/qubes-issues#1143
2016-10-31 00:40:32 +01:00
Marek Marczykowski-Górecki
3131bb6135
Merge remote-tracking branch 'origin/pr/24' into core3-devel
* origin/pr/24:
  network: add vif-route-qubes-nat for IP address anonymization
2016-10-29 14:42:50 +02:00
Marek Marczykowski-Górecki
a6658bc329
Merge remote-tracking branch 'qubesos/pr/22'
* qubesos/pr/22:
  Invert logic of SKIP_SIGNING.
2016-10-28 14:10:18 +02:00
Manuel Amador (Rudd-O)
6189801cff Invert logic of SKIP_SIGNING. 2016-10-28 05:22:39 +00:00
Marek Marczykowski-Górecki
014a706113
Merge remote-tracking branch 'qubesos/pr/21'
* qubesos/pr/21:
  Better private.img size management.
  Clean up early initialization and setup of /rw
2016-10-27 01:32:25 +02:00
Manuel Amador (Rudd-O)
59aec8e5eb Clean up early initialization and setup of /rw 2016-10-23 20:19:51 +00:00
Manuel Amador (Rudd-O)
87ebd2e157 Make signing optional for testing, and add program checks. 2016-10-23 19:48:15 +00:00
unman
da82d93780
use bind-dirs to handle crontab persistence 2016-10-16 01:14:02 +01:00
Marek Marczykowski-Górecki
e73d662bf1
Configure NetworkManager to keep /etc/resolv.conf as plain file
Do not use a symlink there, as it will be left after NetworkManager
shutdown - as a broken link then

Fixes QubesOS/qubes-issues#2320
Reported by Achim Patzner <noses@noses.com>
2016-09-15 01:26:35 +02:00
Marek Marczykowski-Górecki
2c8fe644f3
network: remove qubes-netwatcher
This tool/service is obsolete for a long time (it does nothing on R3.0
and later).
2016-09-12 05:58:26 +02:00
Marek Marczykowski-Górecki
ee0a292b21
network: rewrite qubes-firewall daemon
This rewrite is mainly to adopt new interface for Qubes 4.x.
Main changes:
 - change language from bash to python, introduce qubesagent python package
 - support both nftables (preferred) and iptables
 - new interface (https://qubes-os.org/doc/vm-interface/)
 - IPv6 support
 - unit tests included
 - nftables version support running along with other firewall loaded

Fixes QubesOS/qubes-issues#1815
QubesOS/qubes-issues#718
2016-09-12 05:22:53 +02:00
Marek Marczykowski-Górecki
b50cba3f2c
Add qubes.ResizeDisk service to adjust filesystem size
Do this using qubes rpc service, instead of calling resize2fs directly
by dom0.
2016-08-17 21:47:22 +02:00
Marek Marczykowski-Górecki
779414d216
Merge remote-tracking branch 'woju/master' into core3-devel
* woju/master:
  misc: add qvm-features-request
2016-08-17 21:28:37 +02:00
Marek Marczykowski-Górecki
76e12cae2d
Rename qubes.xdg python module to qubesxdg
Do not interfere with 'qubes' module.

QubesOS/qubes-issues#1813
2016-08-17 21:27:28 +02:00