core-agent.spec.in 32 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990
  1. #
  2. # The Qubes OS Project, http://www.qubes-os.org
  3. #
  4. # Copyright (C) 2010 Joanna Rutkowska <joanna@invisiblethingslab.com>
  5. # Copyright (C) 2010 Rafal Wojtczuk <rafal@invisiblethingslab.com>
  6. #
  7. # This program is free software; you can redistribute it and/or
  8. # modify it under the terms of the GNU General Public License
  9. # as published by the Free Software Foundation; either version 2
  10. # of the License, or (at your option) any later version.
  11. #
  12. # This program is distributed in the hope that it will be useful,
  13. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  14. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15. # GNU General Public License for more details.
  16. #
  17. # You should have received a copy of the GNU General Public License
  18. # along with this program; if not, write to the Free Software
  19. # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  20. #
  21. #
  22. %define qubes_services qubes-core qubes-core-netvm qubes-core-early qubes-firewall qubes-iptables qubes-updates-proxy qubes-updates-proxy-forwarder
  23. %define qubes_preset_file 75-qubes-vm.preset
  24. %define scriptletfuns is_static() { \
  25. [ -f "%{_unitdir}/$1" ] && ! grep -q '^[[].nstall]' "%{_unitdir}/$1" \
  26. } \
  27. \
  28. is_masked() { \
  29. if [ ! -L %{_sysconfdir}/systemd/system/"$1" ] \
  30. then \
  31. return 1 \
  32. fi \
  33. target=`readlink %{_sysconfdir}/systemd/system/"$1" 2>/dev/null` || : \
  34. if [ "$target" = "/dev/null" ] \
  35. then \
  36. return 0 \
  37. fi \
  38. return 1 \
  39. } \
  40. \
  41. mask() { \
  42. ln -sf /dev/null %{_sysconfdir}/systemd/system/"$1" \
  43. } \
  44. \
  45. unmask() { \
  46. if ! is_masked "$1" \
  47. then \
  48. return 0 \
  49. fi \
  50. rm -f %{_sysconfdir}/systemd/system/"$1" \
  51. } \
  52. \
  53. preset_units() { \
  54. local represet= \
  55. cat "$1" | while read action unit_name \
  56. do \
  57. if [ "$action" = "#" -a "$unit_name" = "Units below this line will be re-preset on package upgrade" ] \
  58. then \
  59. represet=1 \
  60. continue \
  61. fi \
  62. echo "$action $unit_name" | grep -q '^[[:space:]]*[^#;]' || continue \
  63. [ -n "$action" -a -n "$unit_name" ] || continue \
  64. if [ "$2" = "initial" -o "$represet" = "1" ] \
  65. then \
  66. if [ "$action" = "disable" ] && is_static "$unit_name" \
  67. then \
  68. if ! is_masked "$unit_name" \
  69. then \
  70. # We must effectively mask these units, even if they are static. \
  71. mask "$unit_name" \
  72. fi \
  73. elif [ "$action" = "enable" ] && is_static "$unit_name" \
  74. then \
  75. if is_masked "$unit_name" \
  76. then \
  77. # We masked this static unit before, now we unmask it. \
  78. unmask "$unit_name" \
  79. fi \
  80. systemctl --no-reload preset "$unit_name" >/dev/null 2>&1 || : \
  81. else \
  82. systemctl --no-reload preset "$unit_name" >/dev/null 2>&1 || : \
  83. fi \
  84. fi \
  85. done \
  86. } \
  87. \
  88. restore_units() { \
  89. grep '^[[:space:]]*[^#;]' "$1" | while read action unit_name \
  90. do \
  91. if is_static "$unit_name" && is_masked "$unit_name" \
  92. then \
  93. # If the unit had been masked by us, we must unmask it here. \
  94. # Otherwise systemctl preset will fail badly. \
  95. unmask "$unit_name" \
  96. fi \
  97. systemctl --no-reload preset "$unit_name" >/dev/null 2>&1 || : \
  98. done \
  99. } \
  100. Name: qubes-core-agent
  101. Version: @VERSION@
  102. Release: 1%{dist}
  103. Summary: The Qubes core files for VM
  104. Group: Qubes
  105. Vendor: Invisible Things Lab
  106. License: GPL
  107. URL: http://www.qubes-os.org
  108. Conflicts: firewalld
  109. Requires: xdg-utils
  110. Requires: qubes-utils >= 3.1.3
  111. Requires: qubes-utils-libs >= 4.0.16
  112. Requires: initscripts
  113. Requires: gawk
  114. Requires: sed
  115. Requires: util-linux
  116. Requires: e2fsprogs
  117. Requires: hostname
  118. # for Qubes Manager VM updater
  119. Requires: xterm
  120. # for qubes-desktop-run
  121. Requires: python%{python3_pkgversion}-gobject-base
  122. Requires: python%{python3_pkgversion}-dbus
  123. # for qubes-session-autostart, xdg-icon
  124. Requires: python%{python3_pkgversion}-pyxdg
  125. Requires: python%{python3_pkgversion}-daemon
  126. # for qvm-feature-request
  127. Requires: python%{python3_pkgversion}-qubesdb
  128. Requires: ImageMagick
  129. Requires: librsvg2-tools
  130. Requires: zenity
  131. Requires: dconf
  132. Requires: qubes-core-qrexec-vm
  133. Requires: qubes-libvchan
  134. Requires: qubes-db-vm
  135. Requires: python%{python3_pkgversion}-dnf-plugins-qubes-hooks
  136. Requires: python%{python3_pkgversion}-setuptools
  137. # for qubes.ResizeDisk
  138. Requires: parted
  139. Obsoletes: qubes-core-vm-kernel-placeholder <= 1.0
  140. Obsoletes: qubes-upgrade-vm < 3.2
  141. Provides: qubes-core-vm = %{version}-%{release}
  142. Obsoletes: qubes-core-vm < 4.0.0
  143. Provides: qubes-core-vm-doc = %{version}-%{release}
  144. Obsoletes: qubes-core-vm-doc < 4.0.0
  145. Conflicts: qubes-gui-agent < 4.1.6
  146. BuildRequires: gcc
  147. BuildRequires: pandoc
  148. BuildRequires: xen-devel
  149. BuildRequires: libX11-devel
  150. BuildRequires: qubes-utils-devel >= 3.1.3
  151. BuildRequires: qubes-libvchan-@BACKEND_VMM@-devel
  152. BuildRequires: pam-devel
  153. BuildRequires: python%{python3_pkgversion}-setuptools
  154. BuildRequires: systemd
  155. Source0: %{name}-%{version}.tar.gz
  156. %description
  157. The Qubes core files for installation inside a Qubes VM.
  158. %package -n python2-dnf-plugins-qubes-hooks
  159. Summary: DNF plugin for Qubes specific post-installation actions
  160. BuildRequires: python2-devel
  161. %{?python_provide:%python_provide python2-dnf-plugins-qubes-hooks}
  162. %description -n python2-dnf-plugins-qubes-hooks
  163. DNF plugin for Qubes specific post-installation actions:
  164. * notify dom0 that updates were installed
  165. * refresh applications shortcut list
  166. %package -n python%{python3_pkgversion}-dnf-plugins-qubes-hooks
  167. Summary: DNF plugin for Qubes specific post-installation actions
  168. BuildRequires: python%{python3_pkgversion}-devel
  169. %{?python_provide:%python_provide python%{python3_pkgversion}-dnf-plugins-qubes-hooks}
  170. %description -n python%{python3_pkgversion}-dnf-plugins-qubes-hooks
  171. DNF plugin for Qubes specific post-installation actions:
  172. * notify dom0 that updates were installed
  173. * refresh applications shortcut list
  174. %package nautilus
  175. Summary: Qubes integration for Nautilus
  176. Requires: qubes-core-agent = %{version}
  177. Requires: nautilus-python
  178. Conflicts: qubes-core-vm < 4.0.0
  179. %description nautilus
  180. Nautilus addons for inter-VM file copy/move/open.
  181. %package dom0-updates
  182. Summary: Scripts required to handle dom0 updates
  183. Requires: qubes-core-agent = %{version}
  184. Requires: fakeroot
  185. Conflicts: qubes-core-vm < 4.0.0
  186. Requires: tar
  187. %description dom0-updates
  188. Scripts required to handle dom0 updates.
  189. %package networking
  190. Summary: Networking support for Qubes VM
  191. Requires: ethtool
  192. Requires: iptables
  193. Requires: net-tools
  194. Requires: iproute
  195. Requires: nftables
  196. Requires: socat
  197. Requires: qubes-core-agent = %{version}
  198. Requires: tinyproxy
  199. Conflicts: qubes-core-vm < 4.0.0
  200. %description networking
  201. This package provides:
  202. * basic network functionality (setting IP address, DNS, default gateway)
  203. * proxy service used by TemplateVMs to download updates
  204. * qubes-firewall service (FirewallVM)
  205. Note: if you want to use NetworkManager (you do want it in NetVM), install also
  206. qubes-core-agent-network-manager.
  207. %package network-manager
  208. Summary: NetworkManager integration for Qubes VM
  209. # to show/hide nm-applet
  210. Requires: NetworkManager >= 0.8.1-1
  211. Requires: glib2
  212. Requires: polkit
  213. Requires: qubes-core-agent-networking = %{version}
  214. Conflicts: qubes-core-vm < 4.0.0
  215. %description network-manager
  216. Integration of NetworkManager for Qubes VM:
  217. * make connections config persistent
  218. * adjust DNS redirections when needed
  219. * show/hide NetworkManager applet icon
  220. %package passwordless-root
  221. Summary: Passwordless root access from normal user
  222. Conflicts: qubes-core-vm < 4.0.0
  223. %description passwordless-root
  224. Configure sudo, PolicyKit and similar tool to not ask for any password when
  225. switching from user to root. Since all the user data in a VM is accessible
  226. already from normal user account, there is not much more to guard there. Qubes
  227. VM is a single user system.
  228. %package thunar
  229. Summary: Thunar support for Qubes VM tools
  230. Requires: Thunar
  231. %description thunar
  232. Thunar support for Qubes VM tools
  233. %define kde_service_dir /usr/share/kde4/services
  234. %define kde5_service_dir /usr/share/kservices5/ServiceMenus
  235. %prep
  236. %setup -q
  237. %build
  238. %{?set_build_flags}
  239. for dir in qubes-rpc misc; do
  240. make -C $dir BACKEND_VMM=@BACKEND_VMM@
  241. done
  242. make -C doc manpages
  243. %pre
  244. # Make sure there is a qubes group
  245. groupadd --force --system --gid 98 qubes
  246. id -u 'user' >/dev/null 2>&1 || {
  247. useradd --user-group --create-home --shell /bin/bash user
  248. }
  249. usermod -a --groups qubes user
  250. if [ "$1" != 1 ] ; then
  251. # do this whole %%pre thing only when updating for the first time...
  252. exit 0
  253. fi
  254. mkdir -p /var/lib/qubes
  255. if [ -e /etc/fstab ] ; then
  256. mv /etc/fstab /var/lib/qubes/fstab.orig
  257. fi
  258. usermod -L user
  259. %pre passwordless-root
  260. usermod -L root
  261. %install
  262. make install-vm DESTDIR=$RPM_BUILD_ROOT
  263. make -C app-menu DESTDIR=$RPM_BUILD_ROOT install
  264. make -C boot/redhat DESTDIR=$RPM_BUILD_ROOT install
  265. make -C config-overrides DESTDIR=$RPM_BUILD_ROOT install
  266. make -C filesystem DESTDIR=$RPM_BUILD_ROOT install
  267. make -C misc DESTDIR=$RPM_BUILD_ROOT install
  268. make -C network DESTDIR=$RPM_BUILD_ROOT install
  269. make -C passwordless-root DESTDIR=$RPM_BUILD_ROOT install install-rh
  270. make -C qubes-rpc DESTDIR=$RPM_BUILD_ROOT install
  271. make -C qubes-rpc/kde DESTDIR=$RPM_BUILD_ROOT install
  272. make -C qubes-rpc/nautilus DESTDIR=$RPM_BUILD_ROOT install
  273. make -C qubes-rpc/thunar DESTDIR=$RPM_BUILD_ROOT install
  274. make -C package-managers DESTDIR=$RPM_BUILD_ROOT install install-dnf
  275. %if 0%{?rhel} == 7
  276. make -C package-managers DESTDIR=$RPM_BUILD_ROOT install-yum
  277. %endif
  278. %if 0%{?rhel} >= 7
  279. sed -i \
  280. -e 's:-primary:-centos:' \
  281. -e 's:/fc:/centos:' \
  282. $RPM_BUILD_ROOT/etc/yum.repos.d/qubes-*.repo
  283. %endif
  284. install -D -m 0644 boot/dracut-qubes.conf $RPM_BUILD_ROOT/usr/lib/dracut/dracut.conf.d/30-qubes.conf
  285. install -D -m 0644 boot/grub.qubes $RPM_BUILD_ROOT/etc/default/grub.qubes
  286. %triggerin -- initscripts
  287. if [ -e /etc/init/serial.conf ]; then
  288. cp /usr/share/qubes/serial.conf /etc/init/serial.conf
  289. fi
  290. %triggerin -- grub2-tools
  291. if ! grep -q /etc/default/grub.qubes /etc/default/grub 2>/dev/null; then
  292. # do not keep Qubes-related settings directly in user-controlled config,
  293. # include another file
  294. echo '. /etc/default/grub.qubes' >> /etc/default/grub
  295. fi
  296. %triggerin passwordless-root -- util-linux
  297. qubesfile=/etc/pam.d/su.qubes
  298. origfile=${qubesfile%.qubes}
  299. backupfile=${origfile}.qubes-orig
  300. if [ -r "$origfile" -a ! -r "$backupfile" ]; then
  301. mv -f "$origfile" "$backupfile"
  302. fi
  303. ln -sf "$qubesfile" "$origfile"
  304. %post
  305. # disable some Upstart services
  306. for F in plymouth-shutdown prefdm splash-manager start-ttys tty ; do
  307. if [ -e /etc/init/$F.conf ]; then
  308. mv -f /etc/init/$F.conf /etc/init/$F.conf.disabled
  309. fi
  310. done
  311. chgrp user /var/lib/qubes/dom0-updates
  312. # Remove old firmware updates link
  313. if [ -L /lib/firmware/updates ]; then
  314. rm -f /lib/firmware/updates
  315. fi
  316. # convert /usr/local symlink to a mount point
  317. if [ -L /usr/local ]; then
  318. rm -f /usr/local
  319. mkdir /usr/local
  320. mount /usr/local || :
  321. fi
  322. # workaround for Fedora's systemd package bug
  323. # https://bugzilla.redhat.com/1559286
  324. if [ -d /var/lib/private ]; then
  325. chmod 700 /var/lib/private
  326. fi
  327. if test -f /etc/yum.conf && ! grep -q '/etc/yum\.conf\.d/qubes-proxy\.conf' /etc/yum.conf; then
  328. echo >> /etc/yum.conf
  329. echo '# Yum does not support inclusion of config dir...' >> /etc/yum.conf
  330. echo 'include=file:///etc/yum.conf.d/qubes-proxy.conf' >> /etc/yum.conf
  331. fi
  332. if ! [ -r /etc/dconf/profile/user ]; then
  333. mkdir -p /etc/dconf/profile
  334. echo "user-db:user" >> /etc/dconf/profile/user
  335. echo "system-db:local" >> /etc/dconf/profile/user
  336. fi
  337. dconf update &> /dev/null || :
  338. # And actually setup the proxy usage in package managers
  339. /usr/lib/qubes/update-proxy-configs
  340. # Location of files which contains list of protected files
  341. mkdir -p /etc/qubes/protected-files.d
  342. . /usr/lib/qubes/init/functions
  343. # qubes-core-vm has been broken for some time - it overrides /etc/hosts; restore original content
  344. if ! is_protected_file /etc/hosts ; then
  345. if ! grep -q localhost /etc/hosts; then
  346. cat <<EOF > /etc/hosts
  347. 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 `hostname`
  348. ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
  349. EOF
  350. fi
  351. fi
  352. # ensure that hostname resolves to 127.0.0.1 resp. ::1 and that /etc/hosts is
  353. # in the form expected by qubes-sysinit.sh
  354. if ! is_protected_file /etc/hostname ; then
  355. for ip in '127\.0\.0\.1' '::1'; do
  356. if grep -q "^${ip}\(\s\|$\)" /etc/hosts; then
  357. sed -i "/^${ip}\s/,+0s/\(\s`hostname`\)\+\(\s\|$\)/\2/g" /etc/hosts
  358. sed -i "s/^${ip}\(\s\|$\).*$/\0 `hostname`/" /etc/hosts
  359. else
  360. echo "${ip} `hostname`" >> /etc/hosts
  361. fi
  362. done
  363. fi
  364. if [ "$1" != 1 ] ; then
  365. # do the rest of %%post thing only when updating for the first time...
  366. exit 0
  367. fi
  368. if [ -e /etc/init/serial.conf ] && ! [ -f /var/lib/qubes/serial.orig ] ; then
  369. cp /etc/init/serial.conf /var/lib/qubes/serial.orig
  370. fi
  371. # Remove most of the udev scripts to speed up the VM boot time
  372. # Just leave the xen* scripts, that are needed if this VM was
  373. # ever used as a net backend (e.g. as a VPN domain in the future)
  374. #echo "--> Removing unnecessary udev scripts..."
  375. mkdir -p /var/lib/qubes/removed-udev-scripts
  376. for f in /etc/udev/rules.d/*
  377. do
  378. if [ $(basename $f) == "xen-backend.rules" ] ; then
  379. continue
  380. fi
  381. if echo $f | grep -q qubes; then
  382. continue
  383. fi
  384. mv $f /var/lib/qubes/removed-udev-scripts/
  385. done
  386. mkdir -p /rw
  387. #rm -f /etc/mtab
  388. #echo "--> Removing HWADDR setting from /etc/sysconfig/network-scripts/ifcfg-eth0"
  389. #mv /etc/sysconfig/network-scripts/ifcfg-eth0 /etc/sysconfig/network-scripts/ifcfg-eth0.orig
  390. #grep -v HWADDR /etc/sysconfig/network-scripts/ifcfg-eth0.orig > /etc/sysconfig/network-scripts/ifcfg-eth0
  391. %triggerin -- notification-daemon
  392. # Enable autostart of notification-daemon when installed
  393. if [ ! -e /etc/xdg/autostart/notification-daemon.desktop ]; then
  394. ln -s /usr/share/applications/notification-daemon.desktop /etc/xdg/autostart/
  395. fi
  396. exit 0
  397. %triggerin -- selinux-policy
  398. #echo "--> Disabling SELinux..."
  399. sed -e s/^SELINUX=.*$/SELINUX=disabled/ </etc/selinux/config >/etc/selinux/config.processed
  400. mv /etc/selinux/config.processed /etc/selinux/config
  401. setenforce 0 2>/dev/null
  402. exit 0
  403. %post network-manager
  404. # Create NetworkManager configuration if we do not have it
  405. if ! [ -e /etc/NetworkManager/NetworkManager.conf ]; then
  406. echo '[main]' > /etc/NetworkManager/NetworkManager.conf
  407. echo 'plugins = keyfile' >> /etc/NetworkManager/NetworkManager.conf
  408. echo '[keyfile]' >> /etc/NetworkManager/NetworkManager.conf
  409. fi
  410. # Remove ip_forward setting from sysctl, so NM will not reset it
  411. sed 's/^net.ipv4.ip_forward.*/#\0/' -i /etc/sysctl.conf
  412. /usr/lib/qubes/qubes-fix-nm-conf.sh
  413. %post networking
  414. %systemd_post qubes-firewall.service
  415. %systemd_post qubes-iptables.service
  416. %systemd_post qubes-network.service
  417. %systemd_post qubes-updates-proxy.service
  418. %post thunar
  419. if [ "$1" = 1 ]; then
  420. # There is no system-wide Thunar custom actions. There is only a default
  421. # file and a user file created from the default one. Qubes actions need
  422. # to be placed after all already defined actions and before </actions>
  423. # the end of file.
  424. if [ -f /etc/xdg/Thunar/uca.xml ] ; then
  425. cp -p /etc/xdg/Thunar/uca.xml{,.bak}
  426. sed -i '$e cat /usr/lib/qubes/uca_qubes.xml' /etc/xdg/Thunar/uca.xml
  427. fi
  428. if [ -f /home/user/.config/Thunar/uca.xml ] ; then
  429. cp -p /home/user/.config/Thunar/uca.xml{,.bak}
  430. sed -i '$e cat /usr/lib/qubes/uca_qubes.xml' /home/user/.config/Thunar/uca.xml
  431. fi
  432. fi
  433. %preun
  434. if [ "$1" = 0 ] ; then
  435. # no more packages left
  436. if [ -e /var/lib/qubes/fstab.orig ] ; then
  437. mv /var/lib/qubes/fstab.orig /etc/fstab
  438. fi
  439. mv /var/lib/qubes/removed-udev-scripts/* /etc/udev/rules.d/
  440. if [ -e /var/lib/qubes/serial.orig ] ; then
  441. mv /var/lib/qubes/serial.orig /etc/init/serial.conf
  442. fi
  443. fi
  444. %preun networking
  445. %systemd_preun qubes-firewall.service
  446. %systemd_preun qubes-iptables.service
  447. %systemd_preun qubes-network.service
  448. %systemd_preun qubes-updates-proxy.service
  449. %postun thunar
  450. if [ "$1" = 0 ]; then
  451. if [ -f /etc/xdg/Thunar/uca.xml ] ; then
  452. mv /etc/xdg/Thunar/uca.xml{,.uninstall}
  453. mv /etc/xdg/Thunar/uca.xml{.bak,}
  454. fi
  455. if [ -f /home/user/.config/Thunar/uca.xml ] ; then
  456. mv /home/user/.config/Thunar/uca.xml{,.uninstall}
  457. mv /home/user/.config/Thunar/uca.xml{.bak,}
  458. fi
  459. fi
  460. %postun
  461. if [ $1 -eq 0 ] ; then
  462. /usr/bin/glib-compile-schemas %{_datadir}/glib-2.0/schemas &> /dev/null || :
  463. if [ -L /lib/firmware/updates ]; then
  464. rm /lib/firmware/updates
  465. fi
  466. rm -rf /var/lib/qubes/xdg
  467. fi
  468. %postun passwordless-root
  469. if [ $1 -eq 0 ]; then
  470. usermod -p '*' root
  471. fi
  472. qubesfile=/etc/pam.d/su.qubes
  473. origfile=${qubesfile%.qubes}
  474. backupfile=${origfile}.qubes-orig
  475. if [ -f "$backupfile" ]; then
  476. mv -f "$backupfile" "$origfile"
  477. fi
  478. %posttrans
  479. /usr/bin/glib-compile-schemas %{_datadir}/glib-2.0/schemas &> /dev/null || :
  480. %clean
  481. rm -rf $RPM_BUILD_ROOT
  482. rm -f %{name}-%{version}
  483. %files
  484. %defattr(-,root,root,-)
  485. %dir /var/lib/qubes
  486. %{kde_service_dir}/qvm-copy.desktop
  487. %{kde_service_dir}/qvm-move.desktop
  488. %{kde_service_dir}/qvm-dvm.desktop
  489. %{kde5_service_dir}/qvm-copy.desktop
  490. %{kde5_service_dir}/qvm-move.desktop
  491. %{kde5_service_dir}/qvm-dvm.desktop
  492. /etc/fstab
  493. /etc/pki/rpm-gpg/RPM-GPG-KEY-qubes*
  494. %dir /etc/qubes-rpc
  495. %config(noreplace) /etc/qubes-rpc/qubes.ShowInTerminal
  496. %config(noreplace) /etc/qubes-rpc/qubes.Filecopy
  497. %config(noreplace) /etc/qubes-rpc/qubes.OpenInVM
  498. %config(noreplace) /etc/qubes-rpc/qubes.OpenURL
  499. %config(noreplace) /etc/qubes-rpc/qubes.GetAppmenus
  500. %config(noreplace) /etc/qubes-rpc/qubes.ConnectTCP
  501. %config(noreplace) /etc/qubes-rpc/qubes.VMShell
  502. %config(noreplace) /etc/qubes-rpc/qubes.VMExec
  503. %config(noreplace) /etc/qubes-rpc/qubes.VMExecGUI
  504. %config(noreplace) /etc/qubes-rpc/qubes.VMRootShell
  505. %config(noreplace) /etc/qubes-rpc/qubes.SuspendPre
  506. %config(noreplace) /etc/qubes-rpc/qubes.SuspendPreAll
  507. %config(noreplace) /etc/qubes-rpc/qubes.SuspendPost
  508. %config(noreplace) /etc/qubes-rpc/qubes.SuspendPostAll
  509. %config(noreplace) /etc/qubes-rpc/qubes.WaitForSession
  510. %config(noreplace) /etc/qubes-rpc/qubes.DetachPciDevice
  511. %config(noreplace) /etc/qubes-rpc/qubes.Backup
  512. %config(noreplace) /etc/qubes-rpc/qubes.Restore
  513. %config(noreplace) /etc/qubes-rpc/qubes.RegisterBackupLocation
  514. %config(noreplace) /etc/qubes-rpc/qubes.RestoreById
  515. %config(noreplace) /etc/qubes-rpc/qubes.SelectFile
  516. %config(noreplace) /etc/qubes-rpc/qubes.SelectDirectory
  517. %config(noreplace) /etc/qubes-rpc/qubes.GetImageRGBA
  518. %config(noreplace) /etc/qubes-rpc/qubes.SetDateTime
  519. %config(noreplace) /etc/qubes-rpc/qubes.InstallUpdatesGUI
  520. %config(noreplace) /etc/qubes-rpc/qubes.ResizeDisk
  521. %config(noreplace) /etc/qubes-rpc/qubes.StartApp
  522. %config(noreplace) /etc/qubes-rpc/qubes.PostInstall
  523. %config(noreplace) /etc/qubes-rpc/qubes.GetDate
  524. %config(noreplace) /etc/qubes/rpc-config/qubes.OpenInVM
  525. %config(noreplace) /etc/qubes/rpc-config/qubes.OpenURL
  526. %config(noreplace) /etc/qubes/rpc-config/qubes.SelectFile
  527. %config(noreplace) /etc/qubes/rpc-config/qubes.SelectDirectory
  528. %config(noreplace) /etc/qubes/rpc-config/qubes.ShowInTerminal
  529. %config(noreplace) /etc/qubes/rpc-config/qubes.StartApp
  530. %config(noreplace) /etc/qubes/rpc-config/qubes.InstallUpdatesGUI
  531. %config(noreplace) /etc/qubes/rpc-config/qubes.VMShell+WaitForSession
  532. %config(noreplace) /etc/qubes/rpc-config/qubes.VMExecGUI
  533. %config(noreplace) /etc/default/grub.qubes
  534. %dir /etc/qubes/autostart
  535. /etc/qubes/autostart/README.txt
  536. %config /etc/qubes/autostart/*.desktop.d/30_qubes.conf
  537. %dir /etc/qubes/applications
  538. /etc/qubes/applications/README.txt
  539. %config /etc/qubes/applications/*.desktop.d/30_qubes.conf
  540. %dir /etc/qubes/suspend-pre.d
  541. /etc/qubes/suspend-pre.d/README
  542. %dir /etc/qubes/suspend-post.d
  543. /etc/qubes/suspend-post.d/README
  544. /etc/qubes/suspend-post.d/qvm-sync-clock.sh
  545. %dir /etc/qubes/post-install.d
  546. /etc/qubes/post-install.d/README
  547. /etc/qubes/post-install.d/*.sh
  548. %config(noreplace) /etc/profile.d/qt_x11_no_mitshm.sh
  549. %config(noreplace) /etc/sudoers.d/qt_x11_no_mitshm
  550. %config(noreplace) /etc/sudoers.d/umask
  551. %config(noreplace) /etc/sysctl.d/20_tcp_timestamps.conf
  552. %config(noreplace) /etc/qubes-suspend-module-blacklist
  553. %config(noreplace) /etc/yum.conf.d/qubes-proxy.conf
  554. %config(noreplace) /etc/yum.repos.d/qubes-r4.repo
  555. %if 0%{?rhel} == 7
  556. /etc/yum/pluginconf.d/yum-qubes-hooks.conf
  557. /usr/lib/yum-plugins/yum-qubes-hooks.py*
  558. %endif
  559. %config(noreplace) /etc/dnf/plugins/qubes-hooks.conf
  560. %config(noreplace) /etc/dconf/db/local.d/dpi
  561. /lib/udev/rules.d/50-qubes-mem-hotplug.rules
  562. /usr/lib/systemd/system/user@.service.d/90-session-stop-timeout.conf
  563. /usr/sbin/qubes-serial-login
  564. /usr/bin/qvm-copy-to-vm
  565. /usr/bin/qvm-move-to-vm
  566. /usr/bin/qvm-copy
  567. /usr/bin/qvm-move
  568. /usr/bin/qvm-open-in-dvm
  569. /usr/bin/qvm-open-in-vm
  570. /usr/bin/qvm-run-vm
  571. /usr/bin/qvm-features-request
  572. /usr/bin/qvm-sync-clock
  573. /usr/bin/qubes-desktop-run
  574. /usr/bin/qubes-run-terminal
  575. /usr/bin/qubes-run-gnome-terminal
  576. /usr/bin/qubes-open
  577. /usr/bin/qubes-session-autostart
  578. /usr/bin/qvm-connect-tcp
  579. /usr/bin/qubes-vmexec
  580. %dir /usr/lib/qubes
  581. /usr/lib/qubes/prepare-suspend
  582. /usr/lib/qubes/qfile-agent
  583. %attr(4755,root,root) /usr/lib/qubes/qfile-unpacker
  584. /usr/lib/qubes/qopen-in-vm
  585. /usr/lib/qubes/qrun-in-vm
  586. /usr/lib/qubes/qubes-trigger-sync-appmenus.sh
  587. /usr/lib/qubes/qvm-copy-to-vm.kde
  588. /usr/lib/qubes/qvm-move-to-vm.kde
  589. /usr/lib/qubes/tar2qfile
  590. /usr/lib/qubes/vm-file-editor
  591. /usr/lib/qubes/xdg-icon
  592. /usr/lib/qubes/update-proxy-configs
  593. /usr/lib/qubes/upgrades-installed-check
  594. /usr/lib/qubes/upgrades-status-notify
  595. /usr/lib/qubes/qubes-sync-clock
  596. /usr/lib/qubes/resize-rootfs
  597. /usr/lib/qubes/tinyproxy-wrapper
  598. /usr/lib/dracut/dracut.conf.d/30-qubes.conf
  599. %dir /usr/lib/qubes/init
  600. /usr/lib/qubes/init/bind-dirs.sh
  601. /usr/lib/qubes/init/control-printer-icon.sh
  602. /usr/lib/qubes/init/functions
  603. /usr/lib/qubes/init/misc-post-stop.sh
  604. /usr/lib/qubes/init/misc-post.sh
  605. /usr/lib/qubes/init/mount-dirs.sh
  606. /usr/lib/qubes/init/qubes-early-vm-config.sh
  607. /usr/lib/qubes/init/qubes-random-seed.sh
  608. /usr/lib/qubes/init/qubes-sysinit.sh
  609. /usr/lib/qubes/init/resize-rootfs-if-needed.sh
  610. /usr/lib/qubes/init/setup-rw.sh
  611. /usr/lib/qubes/init/setup-rwdev.sh
  612. %dir /usr/lib/qubes-bind-dirs.d
  613. /usr/lib/qubes-bind-dirs.d/30_cron.conf
  614. /usr/share/applications/qubes-run-terminal.desktop
  615. /usr/share/applications/qubes-open-file-manager.desktop
  616. /usr/share/qubes/serial.conf
  617. /usr/share/qubes/marker-vm
  618. /usr/share/glib-2.0/schemas/20_org.gnome.settings-daemon.plugins.updates.qubes.gschema.override
  619. /usr/share/glib-2.0/schemas/20_org.gnome.nautilus.qubes.gschema.override
  620. /usr/share/glib-2.0/schemas/20_org.mate.NotificationDaemon.qubes.gschema.override
  621. /usr/share/glib-2.0/schemas/20_org.gnome.desktop.wm.preferences.qubes.gschema.override
  622. %{_mandir}/man1/qvm-*.1*
  623. %dir %{python3_sitelib}/qubesagent-*-py*.egg-info
  624. %{python3_sitelib}/qubesagent-*-py*.egg-info/*
  625. %{python3_sitelib}/qubesagent/__pycache__
  626. %dir %{python3_sitelib}/qubesagent
  627. %{python3_sitelib}/qubesagent/__init__.py*
  628. %{python3_sitelib}/qubesagent/firewall.py*
  629. %{python3_sitelib}/qubesagent/test_firewall.py*
  630. %{python3_sitelib}/qubesagent/vmexec.py*
  631. %{python3_sitelib}/qubesagent/test_vmexec.py*
  632. %{python3_sitelib}/qubesagent/xdg.py*
  633. %{python3_sitelib}/qubesagent/test_xdg.py*
  634. /usr/share/qubes/mime-override/globs
  635. /usr/share/qubes/qubes-master-key.asc
  636. %dir /mnt/removable
  637. %dir /rw
  638. %files -n python2-dnf-plugins-qubes-hooks
  639. %{python2_sitelib}/dnf-plugins/*
  640. %files -n python%{python3_pkgversion}-dnf-plugins-qubes-hooks
  641. %{python3_sitelib}/dnf-plugins/*
  642. %files nautilus
  643. /usr/lib/qubes/qvm-copy-to-vm.gnome
  644. /usr/lib/qubes/qvm-move-to-vm.gnome
  645. /usr/share/nautilus-python/extensions/qvm_copy_nautilus.py*
  646. /usr/share/nautilus-python/extensions/qvm_move_nautilus.py*
  647. /usr/share/nautilus-python/extensions/qvm_dvm_nautilus.py*
  648. /usr/lib/qubes/qvm_nautilus_bookmark.sh
  649. %files thunar
  650. /usr/lib/qubes/qvm-actions.sh
  651. /usr/lib/qubes/uca_qubes.xml
  652. /etc/xdg/xfce4/xfconf/xfce-perchannel-xml/thunar.xml
  653. %files dom0-updates
  654. %dir %attr(0775,user,user) /var/lib/qubes/dom0-updates
  655. /usr/lib/qubes/qubes-download-dom0-updates.sh
  656. %files networking
  657. %config(noreplace) /etc/qubes-rpc/qubes.UpdatesProxy
  658. %config(noreplace) /etc/qubes/ip6tables.rules
  659. %config(noreplace) /etc/qubes/ip6tables-enabled.rules
  660. %config(noreplace) /etc/qubes/iptables.rules
  661. %config(noreplace) /etc/tinyproxy/tinyproxy-updates.conf
  662. %config(noreplace) /etc/tinyproxy/updates-blacklist
  663. %config(noreplace) /etc/udev/rules.d/99-qubes-network.rules
  664. /etc/dhclient.d/qubes-setup-dnat-to-ns.sh
  665. /etc/xen/scripts/vif-qubes-nat.sh
  666. /etc/xen/scripts/vif-route-qubes
  667. /lib/systemd/system/qubes-firewall.service
  668. /lib/systemd/system/qubes-iptables.service
  669. /lib/systemd/system/qubes-network.service
  670. /lib/systemd/system/qubes-updates-proxy.service
  671. /usr/lib/qubes/init/network-proxy-setup.sh
  672. /usr/lib/qubes/init/qubes-iptables
  673. /usr/lib/qubes/iptables-updates-proxy
  674. /usr/lib/qubes/qubes-setup-dnat-to-ns
  675. /usr/lib/qubes/setup-ip
  676. /usr/lib/tmpfiles.d/qubes-core-agent-linux.conf
  677. /usr/bin/qubes-firewall
  678. %files network-manager
  679. /etc/NetworkManager/dispatcher.d/30-qubes-external-ip
  680. /etc/NetworkManager/dispatcher.d/qubes-nmhook
  681. /etc/xdg/autostart/00-qubes-show-hide-nm-applet.desktop
  682. /usr/lib/NetworkManager/conf.d/30-qubes.conf
  683. /usr/lib/qubes/network-manager-prepare-conf-dir
  684. /usr/lib/qubes/qubes-fix-nm-conf.sh
  685. /usr/lib/qubes/show-hide-nm-applet.sh
  686. %files passwordless-root
  687. %config(noreplace) /etc/polkit-1/localauthority/50-local.d/qubes-allow-all.pkla
  688. %config(noreplace) /etc/polkit-1/rules.d/00-qubes-allow-all.rules
  689. %config(noreplace) /etc/sudoers.d/qubes
  690. %config(noreplace) /etc/pam.d/su.qubes
  691. %package sysvinit
  692. Summary: Qubes unit files for SysV init style or upstart
  693. License: GPL v2 only
  694. Group: Qubes
  695. Requires: upstart
  696. Requires: qubes-core-agent = %{version}
  697. Requires: qubes-core-qrexec-vm
  698. Requires: qubes-core-agent-networking = %{version}
  699. Provides: qubes-core-agent-init-scripts
  700. Conflicts: qubes-core-agent-systemd
  701. Provides: qubes-core-vm-sysvinit = %{version}-%{release}
  702. Obsoletes: qubes-core-vm-sysvinit < 4.0.0
  703. %description sysvinit
  704. The Qubes core startup configuration for SysV init (or upstart).
  705. %files sysvinit
  706. /etc/init.d/qubes-sysinit
  707. /etc/init.d/qubes-core-early
  708. /etc/init.d/qubes-core
  709. /etc/init.d/qubes-core-netvm
  710. /etc/init.d/qubes-firewall
  711. /etc/init.d/qubes-iptables
  712. /etc/init.d/qubes-updates-proxy
  713. /etc/init.d/qubes-updates-proxy-forwarder
  714. /etc/sysconfig/modules/qubes-core.modules
  715. %post sysvinit
  716. #echo "--> Turning off unnecessary services..."
  717. # FIXME: perhaps there is more elegant way to do this?
  718. for f in /etc/init.d/*
  719. do
  720. srv=`basename $f`
  721. [ $srv = 'functions' ] && continue
  722. [ $srv = 'killall' ] && continue
  723. [ $srv = 'halt' ] && continue
  724. [ $srv = 'single' ] && continue
  725. [ $srv = 'reboot' ] && continue
  726. [ $srv = 'qubes-gui' ] && continue
  727. chkconfig $srv off
  728. done
  729. #echo "--> Enabling essential services..."
  730. chkconfig rsyslog on
  731. chkconfig haldaemon on
  732. chkconfig messagebus on
  733. for svc in %qubes_services ; do
  734. if [ "$1" = 1 ] ; then
  735. chkconfig --add $svc || echo "WARNING: Cannot add service $svc!"
  736. else
  737. chkconfig $svc resetpriorities || echo "WARNING: Cannot reset priorities of service $svc!"
  738. fi
  739. done
  740. # TODO: make this not display the silly message about security context...
  741. sed -i s/^id:.:initdefault:/id:3:initdefault:/ /etc/inittab
  742. %preun sysvinit
  743. if [ "$1" = 0 ] ; then
  744. # no more packages left
  745. for svc in %qubes_services ; do
  746. chkconfig --del $svc
  747. done
  748. fi
  749. %package systemd
  750. Summary: Qubes unit files for SystemD init style
  751. License: GPL v2 only
  752. Group: Qubes
  753. Requires: systemd
  754. Requires(post): systemd-units
  755. Requires(preun): systemd-units
  756. Requires(postun): systemd-units
  757. Requires: qubes-core-agent = %{version}
  758. Provides: qubes-core-agent-init-scripts
  759. Conflicts: qubes-core-agent-sysvinit
  760. Provides: qubes-core-vm-systemd = %{version}-%{release}
  761. Obsoletes: qubes-core-vm-systemd < 4.0.0
  762. Conflicts: qubes-gui-agent < 4.1.0
  763. %description systemd
  764. The Qubes core startup configuration for SystemD init.
  765. %files systemd
  766. %defattr(-,root,root,-)
  767. /etc/systemd/system/xendriverdomain.service
  768. /lib/systemd/system/qubes-misc-post.service
  769. /lib/systemd/system/qubes-mount-dirs.service
  770. /lib/systemd/system/qubes-rootfs-resize.service
  771. /lib/systemd/system/qubes-sysinit.service
  772. /lib/systemd/system/qubes-early-vm-config.service
  773. /lib/systemd/system/qubes-update-check.service
  774. /lib/systemd/system/qubes-update-check.timer
  775. /lib/systemd/system/qubes-sync-time.service
  776. /lib/systemd/system/qubes-sync-time.timer
  777. /lib/systemd/system/qubes-updates-proxy-forwarder@.service
  778. /lib/systemd/system/qubes-updates-proxy-forwarder.socket
  779. /lib/systemd/system-preset/%qubes_preset_file
  780. /lib/modules-load.d/qubes-core.conf
  781. /lib/systemd/system/boot.automount.d/30_qubes.conf
  782. /lib/systemd/system/chronyd.service.d/30_qubes.conf
  783. /lib/systemd/system/crond.service.d/30_qubes.conf
  784. /lib/systemd/system/cups.service.d/30_qubes.conf
  785. /lib/systemd/system/cups.socket.d/30_qubes.conf
  786. /lib/systemd/system/cups.path.d/30_qubes.conf
  787. /lib/systemd/system/cups-browsed.service.d/30_qubes.conf
  788. /lib/systemd/system/org.cups.cupsd.service.d/30_qubes.conf
  789. /lib/systemd/system/org.cups.cupsd.socket.d/30_qubes.conf
  790. /lib/systemd/system/org.cups.cupsd.path.d/30_qubes.conf
  791. /lib/systemd/system/getty@tty.service.d/30_qubes.conf
  792. /lib/systemd/system/ModemManager.service.d/30_qubes.conf
  793. /lib/systemd/system/NetworkManager.service.d/30_qubes.conf
  794. /lib/systemd/system/NetworkManager-wait-online.service.d/30_qubes.conf
  795. /lib/systemd/system/serial-getty@.service.d/30_qubes.conf
  796. /lib/systemd/system/systemd-random-seed.service.d/30_qubes.conf
  797. /lib/systemd/system/systemd-timesyncd.service.d/30_qubes.conf
  798. /lib/systemd/system/tinyproxy.service.d/30_not_needed_in_qubes_by_default.conf
  799. /lib/systemd/system/tor.service.d/30_qubes.conf
  800. /lib/systemd/system/tor@default.service.d/30_qubes.conf
  801. /lib/systemd/system/tmp.mount.d/30_qubes.conf
  802. /usr/lib/systemd/user/pulseaudio.service.d/30_qubes.conf
  803. /usr/lib/systemd/user/pulseaudio.socket.d/30_qubes.conf
  804. %post systemd
  805. changed=
  806. %scriptletfuns
  807. if [ $1 -eq 1 ]
  808. then
  809. preset_units %{_presetdir}/%qubes_preset_file initial
  810. changed=true
  811. else
  812. preset_units %{_presetdir}/%qubes_preset_file upgrade
  813. changed=true
  814. # Upgrade path - now qubes-iptables is used instead
  815. for svc in iptables ip6tables
  816. do
  817. if [ -f "$svc".service ]
  818. then
  819. systemctl --no-reload preset "$svc".service
  820. changed=true
  821. fi
  822. done
  823. fi
  824. if [ $1 -eq 1 ]
  825. then
  826. # First install.
  827. # Set default "runlevel".
  828. # FIXME: this ought to be done via kernel command line.
  829. # The fewer deviations of the template from the seed
  830. # image, the better.
  831. rm -f %{_sysconfdir}/systemd/system/default.target
  832. ln -s %{_unitdir}/multi-user.target %{_sysconfdir}/systemd/system/default.target
  833. changed=true
  834. fi
  835. # remove old symlinks
  836. if [ -L %{_sysconfdir}/systemd/system/sysinit.target.wants/qubes-random-seed.service ]
  837. then
  838. rm -f %{_sysconfdir}/systemd/system/sysinit.target.wants/qubes-random-seed.service
  839. changed=true
  840. fi
  841. if [ -L %{_sysconfdir}/systemd/system/multi-user.target.wants/qubes-mount-home.service ]
  842. then
  843. rm -f %{_sysconfdir}/systemd/system/multi-user.target.wants/qubes-mount-home.service
  844. changed=true
  845. fi
  846. if [ "x$changed" != "x" ]
  847. then
  848. systemctl daemon-reload
  849. fi
  850. %preun systemd
  851. if [ $1 -eq 0 ] ; then
  852. # Run this only during uninstall.
  853. # Save the preset file to later use it to re-preset services there
  854. # once the Qubes OS preset file is removed.
  855. mkdir -p %{_rundir}/qubes-uninstall
  856. cp -f %{_presetdir}/%qubes_preset_file %{_rundir}/qubes-uninstall/
  857. fi
  858. %postun systemd
  859. changed=
  860. %scriptletfuns
  861. if [ -d %{_rundir}/qubes-uninstall ]
  862. then
  863. # We have a saved preset file (or more).
  864. # Re-preset the units mentioned there.
  865. restore_units %{_rundir}/qubes-uninstall/%qubes_preset_file
  866. rm -rf %{_rundir}/qubes-uninstall
  867. changed=true
  868. fi
  869. if [ "x$changed" != "x" ]
  870. then
  871. systemctl daemon-reload
  872. fi
  873. %changelog
  874. @CHANGELOG@