Commit Graph

2743 Commits

Author SHA1 Message Date
Christopher Laprise
a262574f85
Add qubes-firewall.d feature 2018-02-13 17:38:14 -05:00
Marek Marczykowski-Górecki
3ddd687286
Call qubes.PostInstall service to notify dom0 about all apps/features
Update dom0 about all applications installed, not only desktop files for
them. Update also supported features and other things advertised
initially at template installation.

Fixes QubesOS/qubes-issues#3579
2018-02-13 17:05:42 +01:00
Marek Marczykowski-Górecki
f38e204aa7
Drop Fedora < 22 support
yum actions no longer relevant
2018-02-13 17:04:59 +01:00
Marek Marczykowski-Górecki
4a27d9e3fd
version 4.0.21 2018-02-13 04:56:43 +01:00
Marek Marczykowski-Górecki
06f0d865b4
Merge remote-tracking branch 'qubesos/pr/87'
* qubesos/pr/87:
  tests: check if qubes-firewall-user-script is called
  qubes-firewall: call firewall-user-script at service startup
2018-02-13 04:45:28 +01:00
Marek Marczykowski-Górecki
4914eb1437
Merge remote-tracking branch 'qubesos/pr/90'
* qubesos/pr/90:
  Stop Debian templates from forwarding by default.
2018-02-13 04:45:04 +01:00
Marek Marczykowski-Górecki
15301d3922
Merge remote-tracking branch 'qubesos/pr/91'
* qubesos/pr/91:
  bind-dirs.sh: don't fail on empty configuration directory
2018-02-13 04:42:34 +01:00
Marek Marczykowski-Górecki
65be69db5a
Merge remote-tracking branch 'qubesos/pr/92'
* qubesos/pr/92:
  network: reload DNS only on "up" event from NetworkManager
2018-02-13 04:40:53 +01:00
Marek Marczykowski-Górecki
c142e20baa
Do not sync VM time with clockvm if it's set to network time sync
When VM is set to synchronize the time with the network, to not sync its
time with clockvm.
Besides not having sense, in default configuration it will lead to
loopback qrexec connection (sys-net -> sys-net), which will hang.

QubesOS/qubes-issues#3333
2018-02-13 04:23:08 +01:00
Marek Marczykowski-Górecki
e497858768
Fix systemd-timesyncd.service startup
Add After=qubes-sysinit.service to avoid startup condition being
evaluated before initializing qubes-service directory.

Fixes QubesOS/qubes-issues#3333
2018-02-13 02:14:08 +01:00
Marek Marczykowski-Górecki
0b7f1fa905
dom0-updates: refactor for ease adding new actions with old yum
Some more actions could be implemented even without --downloadonly
option. Ease doing so.

QubesOS/qubes-issues#3553
2018-02-11 13:54:34 +01:00
Marek Marczykowski-Górecki
0639a4b932
network: reload DNS only on "up" event from NetworkManager
NetworkManager reports a bunch of events, reloading DNS at each of them
doesn't make sense and is harmful - systemd have ratelimit on service
restart.

Fixes QubesOS/qubes-issues#3135
2018-02-10 22:12:44 +01:00
Rusty Bird
744cab8639
bind-dirs.sh: don't fail on empty configuration directory
nullglob must be active before a glob is used on a potentially empty
directory. Call shopt immediately after the shebang line.

Fixes QubesOS/qubes-issues#3552
2018-02-08 13:21:01 +00:00
unman
d8362aec9e
Stop Debian templates from forwarding by default. 2018-02-06 23:10:28 +00:00
Marek Marczykowski-Górecki
6b48d79d8c
tests: check if qubes-firewall-user-script is called
QubesOS/qubes-issues#3260
2018-02-05 18:17:29 +01:00
Marek Marczykowski-Górecki
6c33652ed4
qubes-firewall: call firewall-user-script at service startup
Call it just after creating base chains in iptables/nftables. This allow
the user to modify how those rules are plugged in, add custom rules at
beginning/end etc.

Fixes QubesOS/qubes-issues#3260
2018-02-05 18:17:11 +01:00
Marek Marczykowski-Górecki
c6cdbf87b0
version 4.0.20 2018-01-29 21:57:11 +01:00
Marek Marczykowski-Górecki
cfbc9533d8
Add intel wifi drivers to suspend-module-blacklist
It is necessary to blacklist them on (almost?) any hardware, so lets do
this by default.

Fixes QubesOS/qubes-issues#3049
2018-01-28 18:28:20 +01:00
Marek Marczykowski-Górecki
94e885275c
version 4.0.19 2018-01-24 01:46:25 +01:00
Marek Marczykowski-Górecki
c5c4572f80
Mount root fs with 'discard' option by default
On LVM thin provisioning this makes manual template's root fs compacting
not needed anymore.

Fixes QubesOS/qubes-issues#2479
2018-01-23 15:10:40 +01:00
Marek Marczykowski-Górecki
0459ba6970
version 4.0.18 2018-01-23 14:17:05 +01:00
Marek Marczykowski-Górecki
ee122eefef
Detach all drivers from PCI devices before suspend
The most common thing to fix S3 sleep is to unload PCI devices drivers
before suspend. Instead of having every user figuring out what drivers
needs to be blacklisted, detach all drivers from actual PCI devices.
Exclude qemu emulated devices.

Fixes QubesOS/qubes-issues#3486
2018-01-22 21:53:03 +01:00
Marek Marczykowski-Górecki
79b38cf106
Place list of loaded modules in /var/run directly
Do not use /var/run/qubes for this, as it may be non-root writeable and
someone may want to isolate root/user.
Also, remove the file after resume.
2018-01-22 19:13:53 +01:00
Marek Marczykowski-Górecki
977f41276b
version 4.0.17 2018-01-18 19:30:32 +01:00
Rusty Bird
b23e2ed70d
Remove stranded block-snapshot script
The real block-snapshot script is in qubes-core-admin.
2018-01-16 06:35:45 +00:00
Rusty Bird
6c2b9fd638
qvm-run-vm: wait for X11 in DispVM case
qvm-run-vm cannot make a separate qubes.WaitForSession call for a
DispVM. Instead, pass the new WaitForSession argument to qubes.VMShell,
which will do the equivalent.
2018-01-14 19:21:01 +00:00
Rusty Bird
72fef1ee4c
qvm-run-vm: appease ShellCheck without comment 2018-01-14 19:20:59 +00:00
Rusty Bird
ce1f0af216
Set 'wait-for-session=1' for 'qubes.VMShell+WaitForSession'
This is intended to be used for DispVMs for which only a single RPC call
can be made before they are destroyed.

Fixes QubesOS/qubes-issues#3012
2018-01-14 19:20:58 +00:00
Marek Marczykowski-Górecki
1b774f9a87
version 4.0.16 2018-01-12 06:18:51 +01:00
Marek Marczykowski-Górecki
7ecb74ae3b
Disable automatic scaling in GNOME/GTK applications
GNOME automatically set scaling factor to 2 when HiDPI is detected.
Unfortunately it does it also on not really HiDPI displays, making the
whole UI unusably large. There is no middle ground - scaling factor must
be integer, so 1.5 is not supported. Lets opt on a conservative side and
fallback to scaling factor 1.

Solution by @alyssais, thanks!
Fixes QubesOS/qubes-issues#3108
2018-01-12 06:00:18 +01:00
Marek Marczykowski-Górecki
4cd16a2734
Enable gnome settings daemon xsettings plugin
When one use scaling set by gnome tools (gsettings or
gnome-tweak-tool), gsd-xsettings must be running to apply the change
also to other applications.
This include auto scaling on HiDPI screens.

This commit fixes non-uniform behaviour on different VM types.

QubesOS/qubes-issues#3108
2018-01-12 05:44:54 +01:00
Marek Marczykowski-Górecki
d4f6eb1f4a
Install KDE actions for KDE5
Fixes QubesOS/qubes-issues#3449
2018-01-09 17:42:21 +01:00
Marek Marczykowski-Górecki
7d82029aec
Fix kdialog --progressbar usage
Returned dbus reference is multi-word string, it was not quoted on
purpose. ShellCheck was wrong about it.

QubesOS/qubes-issues#3449
2018-01-08 03:07:14 +01:00
Marek Marczykowski-Górecki
a8aa41e040
Merge remote-tracking branch 'qubesos/pr/83'
* qubesos/pr/83:
  qrexec: fix infinite loop when multiple services are waiting for GUI
2018-01-05 19:00:27 +01:00
Marek Marczykowski-Górecki
4c47ce139e
qrexec: fix infinite loop when multiple services are waiting for GUI
Reported by @ctrlaltdel
Fixes QubesOS/qubes-issues#3433
2017-12-28 17:31:06 +01:00
Marek Marczykowski-Górecki
c324b16252
firewall: allow also related traffic
This include ICMP error messages for allowed traffic.

Fixes QubesOS/qubes-issues#3406
2017-12-28 05:34:30 +01:00
Marek Marczykowski-Górecki
3a83623647
firewall: don't crash the whole qubes-firewall service on DNS fail
If DNS resolution fails, just block the traffic (for this VM), but don't
crash the whole service.

Fixes QubesOS/qubes-issues#3277
2017-12-28 05:15:00 +01:00
Marek Marczykowski-Górecki
180146a5c2
version 4.0.15 2017-12-23 02:53:43 +01:00
Marek Marczykowski-Górecki
ec83df64e3
qubes.GetImageRGBA: fix handling '-' path without explicit type
There was a bug that interpreted '-' as file type. But convert don't
know how to handle '-' file type, so refused to proceed.

Fixes QubesOS/qubes-issues#3085
2017-12-22 16:48:37 +01:00
Marek Marczykowski-Górecki
e8656e1b41
Merge remote-tracking branch 'qubesos/pr/79'
* qubesos/pr/79:
  make apt-get apt-transport-tor broken in Qubes non-networked TemplateVMs
2017-12-22 01:19:59 +01:00
Marek Marczykowski-Górecki
57d43430e1
qrexec: setup process environment when not using fork server
If fork server is used, proper environment is inherited from the
session. But in other case (like non-default user), it needs to be
created by qrexec-agent itself. PAM provide some variables, but not the
most basic: HOME, SHELL, USER, LOGNAME. Also process should be started
in user home directory (if available).

Fixes QubesOS/qubes-issues#3416
2017-12-22 01:14:19 +01:00
MB
3339df739d
Fall back to direct execution when dbus is not installed or running
I have been using this with a dbus-less Gentoo template since the original
change, and have tested recently on whonix-gw with dbus enabled and running.

(cherry picked from commit bf69335074b45157734b881cc14d54ea43e7902a)
2017-12-20 20:56:29 +01:00
Patrick Schleizer
7fd008b1a8
make apt-get apt-transport-tor broken in Qubes non-networked TemplateVMs
fixes https://github.com/QubesOS/qubes-issues/issues/3403
2017-12-16 19:17:38 +01:00
Marek Marczykowski-Górecki
29e4ac8f97
version 4.0.14 2017-12-15 09:23:22 +01:00
Marek Marczykowski-Górecki
47e6a84f79
debian: use systemd-preset logic from rpm package
It is more robust, especially handle "# Units below this line will be
re-preset on package upgrade" part of 75-qubes-vm.preset file. This is
needed to fix system configuration without the need to rebuild the whole
template.

QubesOS/qubes-issues#2913
2017-12-15 02:50:05 +01:00
unman
a95aa43864
Disable wpa_supplicant@.service
(cherry picked from commit 51f80d39a1064dd6075ccf6af1d5ba78fba6327c)
2017-12-14 23:22:06 +01:00
Rusty Bird
8d8902f32a
qvm-{copy,move}: fix spurious deprecation message
qvm-{copy,move} run qvm-{copy,move}-to-vm with $default as the VM
argument. Don't print the deprecation message in that case.
2017-12-13 23:48:39 +00:00
Marek Marczykowski-Górecki
84374bbdec
Merge remote-tracking branch 'qubesos/pr/76'
* qubesos/pr/76:
  Fix language issues and usability issue
2017-12-13 19:48:24 +01:00
Marek Marczykowski-Górecki
1651866aa2
Merge remote-tracking branch 'qubesos/pr/72'
* qubesos/pr/72:
  Fix UCA mistake and qvm-actions script
  Fix ShellCheck comments
  Add debian package support
  Disable Thunar thumbnails
  Add support for Thunar Qubes VM tools
2017-12-13 19:47:16 +01:00
TomZ
3abc3b1b75
Fix language issues and usability issue 2017-12-13 10:15:20 +01:00