core-agent-linux/debian/qubes-core-agent.install
Marek Marczykowski-Górecki b49ae50ad5
Implement qrexec-based connection to updates proxy
Configure package manager to use 127.0.0.1:8082 as proxy instead of
"magic" IP intercepted later. The listen on this port and whenever
new connection arrives, spawn qubes.UpdatesProxy service call (to
default target domain - subject to configuration in dom0) and connect
its stdin/out to the local TCP connection. This part use systemd.socket
unit in case of systemd, and ncat --exec otherwise.

On the other end - in target domain - simply pass stdin/out to updates
proxy (tinyproxy) running locally.

It's important to _not_ configure the same VM to both be updates proxy and
use it. In practice such configuration makes little sense - if VM can
access network (which is required to run updates proxy), package manager
can use it directly. Even if this network access is through some
VPN/Tor. If a single VM would be configured as both proxy provider and
proxy user, connection would loop back to itself. Because of this, proxy
connection redirection (to qrexec service) is disabled when the same VM
also run updates proxy.

Fixes QubesOS/qubes-issues#1854
2017-05-26 05:25:29 +02:00

165 lines
6.0 KiB
Plaintext

etc/NetworkManager/dispatcher.d/30-qubes-external-ip
etc/NetworkManager/dispatcher.d/qubes-nmhook
etc/X11/xorg-preload-apps.conf
etc/apt/apt.conf.d/00notify-hook
etc/apt/sources.list.d/qubes-r3.list
etc/apt/trusted.gpg.d/qubes-archive-keyring.gpg
etc/dhclient.d/qubes-setup-dnat-to-ns.sh
etc/fstab
etc/needrestart/conf.d/50_qubes.conf
etc/pam.d/su.qubes
etc/polkit-1/localauthority/50-local.d/qubes-allow-all.pkla
etc/polkit-1/rules.d/00-qubes-allow-all.rules
etc/profile.d/qt_x11_no_mitshm.sh
etc/qubes-rpc/qubes.Backup
etc/qubes-rpc/qubes.DetachPciDevice
etc/qubes-rpc/qubes.Filecopy
etc/qubes-rpc/qubes.GetAppmenus
etc/qubes-rpc/qubes.GetImageRGBA
etc/qubes-rpc/qubes.InstallUpdatesGUI
etc/qubes-rpc/qubes.OpenInVM
etc/qubes-rpc/qubes.OpenURL
etc/qubes-rpc/qubes.ResizeDisk
etc/qubes-rpc/qubes.Restore
etc/qubes-rpc/qubes.SelectDirectory
etc/qubes-rpc/qubes.SelectFile
etc/qubes-rpc/qubes.SetDateTime
etc/qubes-rpc/qubes.StartApp
etc/qubes-rpc/qubes.SuspendPost
etc/qubes-rpc/qubes.SuspendPostAll
etc/qubes-rpc/qubes.SuspendPre
etc/qubes-rpc/qubes.SuspendPreAll
etc/qubes-rpc/qubes.SyncNtpClock
etc/qubes-rpc/qubes.UpdatesProxy
etc/qubes-rpc/qubes.VMShell
etc/qubes-rpc/qubes.WaitForSession
etc/qubes-suspend-module-blacklist
etc/qubes/autostart/*
etc/qubes/ip6tables.rules
etc/qubes/iptables.rules
etc/qubes/suspend-post.d/README
etc/qubes/suspend-pre.d/README
etc/sudoers.d/qt_x11_no_mitshm
etc/sudoers.d/qubes
etc/sudoers.d/umask
etc/sysctl.d/20_tcp_timestamps.conf
etc/sysctl.d/80-qubes.conf
etc/systemd/system/haveged.service
etc/tinyproxy/tinyproxy-updates.conf
etc/tinyproxy/updates-blacklist
etc/udev/rules.d/50-qubes-misc.rules
etc/udev/rules.d/99-qubes-network.rules
etc/xdg/autostart/00-qubes-show-hide-nm-applet.desktop
etc/xen/scripts/vif-qubes-nat.sh
etc/xen/scripts/vif-route-qubes
lib/modules-load.d/qubes-core.conf
lib/modules-load.d/qubes-misc.conf
lib/systemd/system-preset/75-qubes-vm.preset
lib/systemd/system/ModemManager.service.d/30_qubes.conf
lib/systemd/system/NetworkManager-wait-online.service.d/30_qubes.conf
lib/systemd/system/NetworkManager.service.d/30_qubes.conf
lib/systemd/system/anacron-resume.service.d/30_qubes.conf
lib/systemd/system/anacron.service.d/30_qubes.conf
lib/systemd/system/avahi-daemon.service.d/30_qubes.conf
lib/systemd/system/chronyd.service.d/30_qubes.conf
lib/systemd/system/cron.service.d/30_qubes.conf
lib/systemd/system/cups.path.d/30_qubes.conf
lib/systemd/system/cups.service.d/30_qubes.conf
lib/systemd/system/cups.socket.d/30_qubes.conf
lib/systemd/system/exim4.service.d/30_qubes.conf
lib/systemd/system/getty@tty.service.d/30_qubes.conf
lib/systemd/system/netfilter-persistent.service.d/30_qubes.conf
lib/systemd/system/org.cups.cupsd.path.d/30_qubes.conf
lib/systemd/system/org.cups.cupsd.service.d/30_qubes.conf
lib/systemd/system/org.cups.cupsd.socket.d/30_qubes.conf
lib/systemd/system/qubes-dvm.service
lib/systemd/system/qubes-early-vm-config.service
lib/systemd/system/qubes-firewall.service
lib/systemd/system/qubes-iptables.service
lib/systemd/system/qubes-misc-post.service
lib/systemd/system/qubes-mount-dirs.service
lib/systemd/system/qubes-network.service
lib/systemd/system/qubes-qrexec-agent.service
lib/systemd/system/qubes-sysinit.service
lib/systemd/system/qubes-update-check.service
lib/systemd/system/qubes-update-check.timer
lib/systemd/system/qubes-updates-proxy.service
lib/systemd/system/qubes-updates-proxy-forwarder@.service
lib/systemd/system/qubes-updates-proxy-forwarder.socket
lib/systemd/system/systemd-random-seed.service.d/30_qubes.conf
lib/systemd/system/tinyproxy.service.d/30_not_needed_in_qubes_by_default.conf
lib/systemd/system/tmp.mount.d/30_qubes.conf
lib/systemd/system/tor.service.d/30_qubes.conf
lib/systemd/system/tor@default.service.d/30_qubes.conf
usr/bin/qrexec-client-vm
usr/bin/qrexec-fork-server
usr/bin/qubes-desktop-run
usr/bin/qubes-open
usr/bin/qubes-session-autostart
usr/bin/qvm-copy-to-vm
usr/bin/qvm-features-request
usr/bin/qvm-move-to-vm
usr/bin/qvm-open-in-dvm
usr/bin/qvm-open-in-vm
usr/bin/qvm-run-vm
usr/bin/xenstore-watch-qubes
usr/lib/NetworkManager/conf.d/30-qubes.conf
usr/lib/python2.7/dist-packages/qubesxdg.py
usr/lib/python2.7/dist-packages/qubesagent-*.egg-info/*
usr/lib/python2.7/dist-packages/qubesagent/*
usr/lib/qubes-bind-dirs.d/30_cron.conf
usr/lib/qubes/close-window
usr/lib/qubes/dispvm-prerun.sh
usr/lib/qubes/init/bind-dirs.sh
usr/lib/qubes/init/control-printer-icon.sh
usr/lib/qubes/init/functions
usr/lib/qubes/init/misc-post-stop.sh
usr/lib/qubes/init/misc-post.sh
usr/lib/qubes/init/mount-dirs.sh
usr/lib/qubes/init/network-proxy-setup.sh
usr/lib/qubes/init/prepare-dvm.sh
usr/lib/qubes/init/qubes-early-vm-config.sh
usr/lib/qubes/init/qubes-iptables
usr/lib/qubes/init/qubes-random-seed.sh
usr/lib/qubes/init/qubes-sysinit.sh
usr/lib/qubes/init/setup-dvm-home.sh
usr/lib/qubes/init/setup-rw.sh
usr/lib/qubes/init/setup-rwdev.sh
usr/lib/qubes/iptables-updates-proxy
usr/lib/qubes/network-manager-prepare-conf-dir
usr/lib/qubes/prepare-suspend
usr/lib/qubes/qfile-agent
usr/lib/qubes/qfile-unpacker
usr/lib/qubes/qopen-in-vm
usr/lib/qubes/qrexec-agent
usr/lib/qubes/qrexec-client-vm
usr/lib/qubes/qrexec_client_vm
usr/lib/qubes/qrun-in-vm
usr/lib/qubes/qubes-download-dom0-updates.sh
usr/lib/qubes/qubes-fix-nm-conf.sh
usr/lib/qubes/qubes-rpc-multiplexer
usr/lib/qubes/qubes-setup-dnat-to-ns
usr/lib/qubes/qubes-trigger-sync-appmenus.sh
usr/lib/qubes/qvm-copy-to-vm.gnome
usr/lib/qubes/qvm-copy-to-vm.kde
usr/lib/qubes/qvm-move-to-vm.gnome
usr/lib/qubes/qvm-move-to-vm.kde
usr/lib/qubes/setup-ip
usr/lib/qubes/show-hide-nm-applet.sh
usr/lib/qubes/sync-ntp-clock
usr/lib/qubes/tar2qfile
usr/lib/qubes/update-proxy-configs
usr/lib/qubes/upgrades-installed-check
usr/lib/qubes/upgrades-status-notify
usr/lib/qubes/vm-file-editor
usr/lib/qubes/vusb-ctl.py
usr/lib/qubes/xdg-icon
usr/lib/systemd/user/pulseaudio.service.d/30_qubes.conf
usr/lib/systemd/user/pulseaudio.socket.d/30_qubes.conf
usr/lib/tmpfiles.d/qubes-core-agent-linux.conf
usr/sbin/qubes-firewall
usr/share/glib-2.0/schemas/*
usr/share/kde4/services/*.desktop
usr/share/qubes/mime-override/globs
usr/share/qubes/qubes-master-key.asc