core-agent.spec 28 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916
  1. #
  2. # The Qubes OS Project, http://www.qubes-os.org
  3. #
  4. # Copyright (C) 2010 Joanna Rutkowska <joanna@invisiblethingslab.com>
  5. # Copyright (C) 2010 Rafal Wojtczuk <rafal@invisiblethingslab.com>
  6. #
  7. # This program is free software; you can redistribute it and/or
  8. # modify it under the terms of the GNU General Public License
  9. # as published by the Free Software Foundation; either version 2
  10. # of the License, or (at your option) any later version.
  11. #
  12. # This program is distributed in the hope that it will be useful,
  13. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  14. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15. # GNU General Public License for more details.
  16. #
  17. # You should have received a copy of the GNU General Public License
  18. # along with this program; if not, write to the Free Software
  19. # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  20. #
  21. #
  22. %define qubes_services qubes-core qubes-core-netvm qubes-core-early qubes-firewall qubes-iptables qubes-updates-proxy qubes-qrexec-agent qubes-updates-proxy-forwarder
  23. %define qubes_preset_file 75-qubes-vm.preset
  24. %{!?version: %define version %(cat version)}
  25. %{!?backend_vmm: %define backend_vmm %(echo $BACKEND_VMM)}
  26. %define scriptletfuns is_static() { \
  27. [ -f "%{_unitdir}/$1" ] && ! grep -q '^[[].nstall]' "%{_unitdir}/$1" \
  28. } \
  29. \
  30. is_masked() { \
  31. if [ ! -L %{_sysconfdir}/systemd/system/"$1" ] \
  32. then \
  33. return 1 \
  34. fi \
  35. target=`readlink %{_sysconfdir}/systemd/system/"$1" 2>/dev/null` || : \
  36. if [ "$target" = "/dev/null" ] \
  37. then \
  38. return 0 \
  39. fi \
  40. return 1 \
  41. } \
  42. \
  43. mask() { \
  44. ln -sf /dev/null %{_sysconfdir}/systemd/system/"$1" \
  45. } \
  46. \
  47. unmask() { \
  48. if ! is_masked "$1" \
  49. then \
  50. return 0 \
  51. fi \
  52. rm -f %{_sysconfdir}/systemd/system/"$1" \
  53. } \
  54. \
  55. preset_units() { \
  56. local represet= \
  57. cat "$1" | while read action unit_name \
  58. do \
  59. if [ "$action" = "#" -a "$unit_name" = "Units below this line will be re-preset on package upgrade" ] \
  60. then \
  61. represet=1 \
  62. continue \
  63. fi \
  64. echo "$action $unit_name" | grep -q '^[[:space:]]*[^#;]' || continue \
  65. [ -n "$action" -a -n "$unit_name" ] || continue \
  66. if [ "$2" = "initial" -o "$represet" = "1" ] \
  67. then \
  68. if [ "$action" = "disable" ] && is_static "$unit_name" \
  69. then \
  70. if ! is_masked "$unit_name" \
  71. then \
  72. # We must effectively mask these units, even if they are static. \
  73. mask "$unit_name" \
  74. fi \
  75. elif [ "$action" = "enable" ] && is_static "$unit_name" \
  76. then \
  77. if is_masked "$unit_name" \
  78. then \
  79. # We masked this static unit before, now we unmask it. \
  80. unmask "$unit_name" \
  81. fi \
  82. systemctl --no-reload preset "$unit_name" >/dev/null 2>&1 || : \
  83. else \
  84. systemctl --no-reload preset "$unit_name" >/dev/null 2>&1 || : \
  85. fi \
  86. fi \
  87. done \
  88. } \
  89. \
  90. restore_units() { \
  91. grep '^[[:space:]]*[^#;]' "$1" | while read action unit_name \
  92. do \
  93. if is_static "$unit_name" && is_masked "$unit_name" \
  94. then \
  95. # If the unit had been masked by us, we must unmask it here. \
  96. # Otherwise systemctl preset will fail badly. \
  97. unmask "$unit_name" \
  98. fi \
  99. systemctl --no-reload preset "$unit_name" >/dev/null 2>&1 || : \
  100. done \
  101. } \
  102. Name: qubes-core-agent
  103. Version: %{version}
  104. Release: 1%{dist}
  105. Summary: The Qubes core files for VM
  106. Group: Qubes
  107. Vendor: Invisible Things Lab
  108. License: GPL
  109. URL: http://www.qubes-os.org
  110. %if %{fedora} < 22
  111. Requires: yum-plugin-post-transaction-actions
  112. %endif
  113. %if %{fedora} >= 18
  114. # Fedora >= 18 defaults to firewalld, which isn't supported nor needed by Qubes
  115. Conflicts: firewalld
  116. %endif
  117. Requires: xdg-utils
  118. Requires: qubes-utils >= 3.1.3
  119. Requires: initscripts
  120. Requires: gawk
  121. Requires: sed
  122. Requires: util-linux
  123. # for qubes-desktop-run
  124. Requires: pygobject3-base
  125. Requires: dbus-python
  126. # for qubes-session-autostart, xdg-icon
  127. Requires: pyxdg
  128. Requires: python-daemon
  129. # for qvm-feature-request
  130. Requires: python2-qubesdb
  131. Requires: ImageMagick
  132. Requires: librsvg2-tools
  133. Requires: zenity
  134. Requires: qubes-core-agent-qrexec
  135. Requires: qubes-libvchan
  136. Requires: qubes-db-vm
  137. %if 0%{fedora} >= 23
  138. Requires: python3-dnf-plugins-qubes-hooks
  139. %else
  140. Requires: python2-dnf-plugins-qubes-hooks
  141. %endif
  142. %if 0%{?rhel} >= 7
  143. Requires: python34-dnf-plugins-qubes-hooks
  144. %endif
  145. Obsoletes: qubes-core-vm-kernel-placeholder <= 1.0
  146. Obsoletes: qubes-upgrade-vm < 3.2
  147. Provides: qubes-core-vm = %{version}-%{release}
  148. Obsoletes: qubes-core-vm < 4.0.0
  149. Provides: qubes-core-vm-doc = %{version}-%{release}
  150. Obsoletes: qubes-core-vm-doc < 4.0.0
  151. BuildRequires: pandoc
  152. BuildRequires: xen-devel
  153. BuildRequires: libX11-devel
  154. BuildRequires: qubes-utils-devel >= 3.1.3
  155. BuildRequires: qubes-libvchan-%{backend_vmm}-devel
  156. BuildRequires: pam-devel
  157. %description
  158. The Qubes core files for installation inside a Qubes VM.
  159. %package -n python2-dnf-plugins-qubes-hooks
  160. Summary: DNF plugin for Qubes specific post-installation actions
  161. BuildRequires: python2-devel
  162. %{?python_provide:%python_provide python2-dnf-plugins-qubes-hooks}
  163. %description -n python2-dnf-plugins-qubes-hooks
  164. DNF plugin for Qubes specific post-installation actions:
  165. * notify dom0 that updates were installed
  166. * refresh applications shortcut list
  167. %if 0%{fedora} >= 23
  168. %package -n python3-dnf-plugins-qubes-hooks
  169. Summary: DNF plugin for Qubes specific post-installation actions
  170. BuildRequires: python3-devel
  171. %{?python_provide:%python_provide python3-dnf-plugins-qubes-hooks}
  172. %description -n python3-dnf-plugins-qubes-hooks
  173. DNF plugin for Qubes specific post-installation actions:
  174. * notify dom0 that updates were installed
  175. * refresh applications shortcut list
  176. %endif
  177. %if 0%{?rhel} >= 7
  178. %package -n python34-dnf-plugins-qubes-hooks
  179. Summary: DNF plugin for Qubes specific post-installation actions
  180. BuildRequires: python34-devel
  181. %{?python_provide:%python_provide python34-dnf-plugins-qubes-hooks}
  182. %description -n python34-dnf-plugins-qubes-hooks
  183. DNF plugin for Qubes specific post-installation actions:
  184. * notify dom0 that updates were installed
  185. * refresh applications shortcut list
  186. %endif
  187. %package qrexec
  188. Summary: Qubes qrexec agent
  189. Requires: qubes-core-agent
  190. Requires: nautilus-python
  191. Conflicts: qubes-core-vm < 4.0.0
  192. %description qrexec
  193. Agent part of Qubes RPC system. A daemon responsible for starting processes as
  194. requested by dom0 or other VMs, according to dom0-enforced policy.
  195. %package nautilus
  196. Summary: Qubes integration for Nautilus
  197. Requires: qubes-core-agent
  198. Requires: nautilus-python
  199. Conflicts: qubes-core-vm < 4.0.0
  200. %description nautilus
  201. Nautilus addons for inter-VM file copy/move/open.
  202. %package dom0-updates
  203. Summary: Scripts required to handle dom0 updates
  204. Requires: qubes-core-agent
  205. Requires: fakeroot
  206. Conflicts: qubes-core-vm < 4.0.0
  207. %description dom0-updates
  208. Scripts required to handle dom0 updates.
  209. %package networking
  210. Summary: Networking support for Qubes VM
  211. Requires: ethtool
  212. Requires: net-tools
  213. Requires: nftables
  214. Requires: socat
  215. Requires: qubes-core-agent
  216. Requires: tinyproxy
  217. Conflicts: qubes-core-vm < 4.0.0
  218. %description networking
  219. This package provides:
  220. * basic network functionality (setting IP address, DNS, default gateway)
  221. * proxy service used by TemplateVMs to download updates
  222. * qubes-firewall service (FirewallVM)
  223. Note: if you want to use NetworkManager (you do want it in NetVM), install also
  224. qubes-core-agent-network-manager.
  225. %package network-manager
  226. Summary: NetworkManager integration for Qubes VM
  227. # to show/hide nm-applet
  228. Requires: NetworkManager >= 0.8.1-1
  229. Requires: glib2
  230. Requires: qubes-core-agent-networking
  231. Conflicts: qubes-core-vm < 4.0.0
  232. %description network-manager
  233. Integration of NetworkManager for Qubes VM:
  234. * make connections config persistent
  235. * adjust DNS redirections when needed
  236. * show/hide NetworkManager applet icon
  237. %package passwordless-root
  238. Summary: Passwordless root access from normal user
  239. Conflicts: qubes-core-vm < 4.0.0
  240. %description passwordless-root
  241. Configure sudo, PolicyKit and similar tool to not ask for any password when
  242. switching from user to root. Since all the user data in a VM is accessible
  243. already from normal user account, there is not much more to guard there. Qubes
  244. VM is a single user system.
  245. %define _builddir %(pwd)
  246. %define kde_service_dir /usr/share/kde4/services
  247. %prep
  248. # we operate on the current directory, so no need to unpack anything
  249. # symlink is to generate useful debuginfo packages
  250. rm -f %{name}-%{version}
  251. ln -sf . %{name}-%{version}
  252. %setup -T -D
  253. %build
  254. for dir in qubes-rpc qrexec misc; do
  255. (cd $dir; make)
  256. done
  257. make -C doc manpages
  258. %pre
  259. # Make sure there is a qubes group
  260. groupadd --force --system --gid 98 qubes
  261. id -u 'user' >/dev/null 2>&1 || {
  262. useradd --user-group --create-home --shell /bin/bash user
  263. }
  264. usermod -a --groups qubes user
  265. if [ "$1" != 1 ] ; then
  266. # do this whole %%pre thing only when updating for the first time...
  267. exit 0
  268. fi
  269. mkdir -p /var/lib/qubes
  270. if [ -e /etc/fstab ] ; then
  271. mv /etc/fstab /var/lib/qubes/fstab.orig
  272. fi
  273. usermod -L user
  274. %pre passwordless-root
  275. usermod -p '' root
  276. %install
  277. (cd qrexec; make install DESTDIR=$RPM_BUILD_ROOT)
  278. make install-vm DESTDIR=$RPM_BUILD_ROOT
  279. %if %{fedora} >= 22
  280. rm -f $RPM_BUILD_ROOT/etc/yum/post-actions/qubes-trigger-sync-appmenus.action
  281. %endif
  282. %if 0%{?rhel} >= 7
  283. sed -i \
  284. -e 's:-primary:-centos:' \
  285. -e 's:/fc:/centos:' \
  286. $RPM_BUILD_ROOT/etc/yum.repos.d/qubes-*.repo
  287. %endif
  288. %triggerin -- initscripts
  289. if [ -e /etc/init/serial.conf ]; then
  290. cp /usr/share/qubes/serial.conf /etc/init/serial.conf
  291. fi
  292. %triggerin -- grub2-tools
  293. if ! grep -q /etc/default/grub.qubes /etc/default/grub 2>/dev/null; then
  294. # do not keep Qubes-related settings directly in user-controlled config,
  295. # include another file
  296. echo '. /etc/default/grub.qubes' >> /etc/default/grub
  297. fi
  298. %post
  299. # disable some Upstart services
  300. for F in plymouth-shutdown prefdm splash-manager start-ttys tty ; do
  301. if [ -e /etc/init/$F.conf ]; then
  302. mv -f /etc/init/$F.conf /etc/init/$F.conf.disabled
  303. fi
  304. done
  305. # Remove old firmware updates link
  306. if [ -L /lib/firmware/updates ]; then
  307. rm -f /lib/firmware/updates
  308. fi
  309. if test -f /etc/yum.conf && ! grep -q '/etc/yum\.conf\.d/qubes-proxy\.conf' /etc/yum.conf; then
  310. echo >> /etc/yum.conf
  311. echo '# Yum does not support inclusion of config dir...' >> /etc/yum.conf
  312. echo 'include=file:///etc/yum.conf.d/qubes-proxy.conf' >> /etc/yum.conf
  313. fi
  314. # And actually setup the proxy usage in package managers
  315. /usr/lib/qubes/update-proxy-configs
  316. # Location of files which contains list of protected files
  317. mkdir -p /etc/qubes/protected-files.d
  318. . /usr/lib/qubes/init/functions
  319. # qubes-core-vm has been broken for some time - it overrides /etc/hosts; restore original content
  320. if ! is_protected_file /etc/hosts ; then
  321. if ! grep -q localhost /etc/hosts; then
  322. cat <<EOF > /etc/hosts
  323. 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 `hostname`
  324. ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
  325. EOF
  326. fi
  327. fi
  328. # ensure that hostname resolves to 127.0.0.1 resp. ::1 and that /etc/hosts is
  329. # in the form expected by qubes-sysinit.sh
  330. if ! is_protected_file /etc/hostname ; then
  331. for ip in '127\.0\.0\.1' '::1'; do
  332. if grep -q "^${ip}\(\s\|$\)" /etc/hosts; then
  333. sed -i "/^${ip}\s/,+0s/\(\s`hostname`\)\+\(\s\|$\)/\2/g" /etc/hosts
  334. sed -i "s/^${ip}\(\s\|$\).*$/\0 `hostname`/" /etc/hosts
  335. else
  336. echo "${ip} `hostname`" >> /etc/hosts
  337. fi
  338. done
  339. fi
  340. if [ "$1" != 1 ] ; then
  341. # do the rest of %%post thing only when updating for the first time...
  342. exit 0
  343. fi
  344. if [ -e /etc/init/serial.conf ] && ! [ -f /var/lib/qubes/serial.orig ] ; then
  345. cp /etc/init/serial.conf /var/lib/qubes/serial.orig
  346. fi
  347. # Remove most of the udev scripts to speed up the VM boot time
  348. # Just leave the xen* scripts, that are needed if this VM was
  349. # ever used as a net backend (e.g. as a VPN domain in the future)
  350. #echo "--> Removing unnecessary udev scripts..."
  351. mkdir -p /var/lib/qubes/removed-udev-scripts
  352. for f in /etc/udev/rules.d/*
  353. do
  354. if [ $(basename $f) == "xen-backend.rules" ] ; then
  355. continue
  356. fi
  357. if [ $(basename $f) == "50-qubes-misc.rules" ] ; then
  358. continue
  359. fi
  360. if echo $f | grep -q qubes; then
  361. continue
  362. fi
  363. mv $f /var/lib/qubes/removed-udev-scripts/
  364. done
  365. mkdir -p /rw
  366. #rm -f /etc/mtab
  367. #echo "--> Removing HWADDR setting from /etc/sysconfig/network-scripts/ifcfg-eth0"
  368. #mv /etc/sysconfig/network-scripts/ifcfg-eth0 /etc/sysconfig/network-scripts/ifcfg-eth0.orig
  369. #grep -v HWADDR /etc/sysconfig/network-scripts/ifcfg-eth0.orig > /etc/sysconfig/network-scripts/ifcfg-eth0
  370. %triggerin -- notification-daemon
  371. # Enable autostart of notification-daemon when installed
  372. if [ ! -e /etc/xdg/autostart/notification-daemon.desktop ]; then
  373. ln -s /usr/share/applications/notification-daemon.desktop /etc/xdg/autostart/
  374. fi
  375. exit 0
  376. %triggerin -- selinux-policy
  377. #echo "--> Disabling SELinux..."
  378. sed -e s/^SELINUX=.*$/SELINUX=disabled/ </etc/selinux/config >/etc/selinux/config.processed
  379. mv /etc/selinux/config.processed /etc/selinux/config
  380. setenforce 0 2>/dev/null
  381. exit 0
  382. %post network-manager
  383. # Create NetworkManager configuration if we do not have it
  384. if ! [ -e /etc/NetworkManager/NetworkManager.conf ]; then
  385. echo '[main]' > /etc/NetworkManager/NetworkManager.conf
  386. echo 'plugins = keyfile' >> /etc/NetworkManager/NetworkManager.conf
  387. echo '[keyfile]' >> /etc/NetworkManager/NetworkManager.conf
  388. fi
  389. # Remove ip_forward setting from sysctl, so NM will not reset it
  390. sed 's/^net.ipv4.ip_forward.*/#\0/' -i /etc/sysctl.conf
  391. /usr/lib/qubes/qubes-fix-nm-conf.sh
  392. %post networking
  393. %systemd_post qubes-firewall.service
  394. %systemd_post qubes-iptables.service
  395. %systemd_post qubes-network.service
  396. %systemd_post qubes-updates-proxy.service
  397. %post qrexec
  398. %systemd_post qubes-qrexec-agent.service
  399. %preun
  400. if [ "$1" = 0 ] ; then
  401. # no more packages left
  402. if [ -e /var/lib/qubes/fstab.orig ] ; then
  403. mv /var/lib/qubes/fstab.orig /etc/fstab
  404. fi
  405. mv /var/lib/qubes/removed-udev-scripts/* /etc/udev/rules.d/
  406. if [ -e /var/lib/qubes/serial.orig ] ; then
  407. mv /var/lib/qubes/serial.orig /etc/init/serial.conf
  408. fi
  409. fi
  410. %preun networking
  411. %systemd_preun qubes-firewall.service
  412. %systemd_preun qubes-iptables.service
  413. %systemd_preun qubes-network.service
  414. %systemd_preun qubes-updates-proxy.service
  415. %preun qrexec
  416. %systemd_preun qubes-qrexec-agent.service
  417. %postun
  418. if [ $1 -eq 0 ] ; then
  419. /usr/bin/glib-compile-schemas %{_datadir}/glib-2.0/schemas &> /dev/null || :
  420. if [ -L /lib/firmware/updates ]; then
  421. rm /lib/firmware/updates
  422. fi
  423. rm -rf /var/lib/qubes/xdg
  424. fi
  425. %postun passwordless-root
  426. if [ $1 -eq 0 ]; then
  427. usermod -p '*' root
  428. fi
  429. %posttrans
  430. /usr/bin/glib-compile-schemas %{_datadir}/glib-2.0/schemas &> /dev/null || :
  431. %clean
  432. rm -rf $RPM_BUILD_ROOT
  433. rm -f %{name}-%{version}
  434. %files
  435. %defattr(-,root,root,-)
  436. %dir /var/lib/qubes
  437. %dir /var/run/qubes
  438. %{kde_service_dir}/qvm-copy.desktop
  439. %{kde_service_dir}/qvm-move.desktop
  440. %{kde_service_dir}/qvm-dvm.desktop
  441. %config(noreplace) /etc/X11/xorg-preload-apps.conf
  442. /etc/fstab
  443. /etc/pki/rpm-gpg/RPM-GPG-KEY-qubes*
  444. %dir /etc/qubes-rpc
  445. %config(noreplace) /etc/qubes-rpc/qubes.Filecopy
  446. %config(noreplace) /etc/qubes-rpc/qubes.OpenInVM
  447. %config(noreplace) /etc/qubes-rpc/qubes.OpenURL
  448. %config(noreplace) /etc/qubes-rpc/qubes.GetAppmenus
  449. %config(noreplace) /etc/qubes-rpc/qubes.VMShell
  450. %config(noreplace) /etc/qubes-rpc/qubes.VMRootShell
  451. %config(noreplace) /etc/qubes-rpc/qubes.SuspendPre
  452. %config(noreplace) /etc/qubes-rpc/qubes.SuspendPreAll
  453. %config(noreplace) /etc/qubes-rpc/qubes.SuspendPost
  454. %config(noreplace) /etc/qubes-rpc/qubes.SuspendPostAll
  455. %config(noreplace) /etc/qubes-rpc/qubes.WaitForSession
  456. %config(noreplace) /etc/qubes-rpc/qubes.DetachPciDevice
  457. %config(noreplace) /etc/qubes-rpc/qubes.Backup
  458. %config(noreplace) /etc/qubes-rpc/qubes.Restore
  459. %config(noreplace) /etc/qubes-rpc/qubes.SelectFile
  460. %config(noreplace) /etc/qubes-rpc/qubes.SelectDirectory
  461. %config(noreplace) /etc/qubes-rpc/qubes.GetImageRGBA
  462. %config(noreplace) /etc/qubes-rpc/qubes.SetDateTime
  463. %config(noreplace) /etc/qubes-rpc/qubes.InstallUpdatesGUI
  464. %config(noreplace) /etc/qubes-rpc/qubes.ResizeDisk
  465. %config(noreplace) /etc/qubes-rpc/qubes.StartApp
  466. %config(noreplace) /etc/qubes-rpc/qubes.PostInstall
  467. %config(noreplace) /etc/qubes-rpc/qubes.GetDate
  468. %dir /etc/qubes/rpc-config
  469. /etc/qubes/rpc-config/README
  470. %config(noreplace) /etc/qubes/rpc-config/qubes.OpenInVM
  471. %config(noreplace) /etc/qubes/rpc-config/qubes.OpenURL
  472. %config(noreplace) /etc/qubes/rpc-config/qubes.SelectFile
  473. %config(noreplace) /etc/qubes/rpc-config/qubes.SelectDirectory
  474. %config(noreplace) /etc/qubes/rpc-config/qubes.StartApp
  475. %config(noreplace) /etc/qubes/rpc-config/qubes.InstallUpdatesGUI
  476. %dir /etc/qubes/autostart
  477. %config(noreplace) /etc/default/grub.qubes
  478. /etc/qubes/autostart/README.txt
  479. %config /etc/qubes/autostart/*.desktop.d/30_qubes.conf
  480. %dir /etc/qubes/suspend-pre.d
  481. /etc/qubes/suspend-pre.d/README
  482. %dir /etc/qubes/suspend-post.d
  483. /etc/qubes/suspend-post.d/README
  484. /etc/qubes/suspend-post.d/qvm-sync-clock.sh
  485. %dir /etc/qubes/post-install.d
  486. /etc/qubes/post-install.d/README
  487. /etc/qubes/post-install.d/*.sh
  488. %config(noreplace) /etc/sudoers.d/qt_x11_no_mitshm
  489. %config(noreplace) /etc/sysctl.d/20_tcp_timestamps.conf
  490. %config(noreplace) /etc/udev/rules.d/50-qubes-misc.rules
  491. %config(noreplace) /etc/qubes-suspend-module-blacklist
  492. %config(noreplace) /etc/yum.conf.d/qubes-proxy.conf
  493. %config(noreplace) /etc/yum.repos.d/qubes-r4.repo
  494. /etc/yum/pluginconf.d/yum-qubes-hooks.conf
  495. %config(noreplace) /etc/dnf/plugins/qubes-hooks.conf
  496. %if %{fedora} < 22
  497. /etc/yum/post-actions/qubes-trigger-sync-appmenus.action
  498. %endif
  499. /usr/lib/systemd/system/user@.service.d/90-session-stop-timeout.conf
  500. /usr/sbin/qubes-serial-login
  501. /usr/bin/qvm-copy-to-vm
  502. /usr/bin/qvm-move-to-vm
  503. /usr/bin/qvm-open-in-dvm
  504. /usr/bin/qvm-open-in-vm
  505. /usr/bin/qvm-run-vm
  506. /usr/bin/qvm-features-request
  507. /usr/bin/qvm-sync-clock
  508. /usr/bin/xenstore-watch-qubes
  509. /usr/bin/qubes-desktop-run
  510. /usr/bin/qubes-open
  511. /usr/bin/qubes-session-autostart
  512. %dir /usr/lib/qubes
  513. /usr/lib/qubes/prepare-suspend
  514. /usr/lib/qubes/qfile-agent
  515. %attr(4755,root,root) /usr/lib/qubes/qfile-unpacker
  516. /usr/lib/qubes/qopen-in-vm
  517. /usr/lib/qubes/qrun-in-vm
  518. /usr/lib/qubes/qubes-trigger-sync-appmenus.sh
  519. /usr/lib/qubes/qvm-copy-to-vm.kde
  520. /usr/lib/qubes/qvm-move-to-vm.kde
  521. /usr/lib/qubes/tar2qfile
  522. /usr/lib/qubes/vm-file-editor
  523. /usr/lib/qubes/close-window
  524. /usr/lib/qubes/xdg-icon
  525. /usr/lib/qubes/update-proxy-configs
  526. /usr/lib/qubes/upgrades-installed-check
  527. /usr/lib/qubes/upgrades-status-notify
  528. /usr/lib/qubes/qubes-sync-clock
  529. /usr/lib/yum-plugins/yum-qubes-hooks.py*
  530. /usr/lib/dracut/dracut.conf.d/30-qubes.conf
  531. %dir /usr/lib/qubes/init
  532. /usr/lib/qubes/init/bind-dirs.sh
  533. /usr/lib/qubes/init/control-printer-icon.sh
  534. /usr/lib/qubes/init/functions
  535. /usr/lib/qubes/init/misc-post-stop.sh
  536. /usr/lib/qubes/init/misc-post.sh
  537. /usr/lib/qubes/init/mount-dirs.sh
  538. /usr/lib/qubes/init/qubes-early-vm-config.sh
  539. /usr/lib/qubes/init/qubes-random-seed.sh
  540. /usr/lib/qubes/init/qubes-sysinit.sh
  541. /usr/lib/qubes/init/setup-rw.sh
  542. /usr/lib/qubes/init/setup-rwdev.sh
  543. /usr/lib/qubes/init/functions
  544. %dir /usr/lib/qubes-bind-dirs.d
  545. /usr/lib/qubes-bind-dirs.d/30_cron.conf
  546. /usr/lib/python2.7/site-packages/qubesxdg.py*
  547. /usr/share/qubes/serial.conf
  548. /usr/share/glib-2.0/schemas/20_org.gnome.settings-daemon.plugins.updates.qubes.gschema.override
  549. /usr/share/glib-2.0/schemas/20_org.gnome.nautilus.qubes.gschema.override
  550. /usr/share/glib-2.0/schemas/20_org.mate.NotificationDaemon.qubes.gschema.override
  551. /usr/share/glib-2.0/schemas/20_org.gnome.desktop.wm.preferences.qubes.gschema.override
  552. %{_mandir}/man1/qvm-*.1*
  553. %dir %{python_sitelib}/qubesagent-*-py2.7.egg-info
  554. %{python_sitelib}/qubesagent-*-py2.7.egg-info/*
  555. %dir %{python_sitelib}/qubesagent
  556. %{python_sitelib}/qubesagent/__init__.py*
  557. %{python_sitelib}/qubesagent/firewall.py*
  558. %{python_sitelib}/qubesagent/test_firewall.py*
  559. /usr/share/qubes/mime-override/globs
  560. /usr/share/qubes/qubes-master-key.asc
  561. %dir /mnt/removable
  562. %dir /rw
  563. %files -n python2-dnf-plugins-qubes-hooks
  564. %{python2_sitelib}/dnf-plugins/*
  565. %if 0%{fedora} >= 23
  566. %files -n python3-dnf-plugins-qubes-hooks
  567. %{python3_sitelib}/dnf-plugins/*
  568. %endif
  569. %if 0%{?rhel} >= 7
  570. %files -n python34-dnf-plugins-qubes-hooks
  571. %{python3_sitelib}/dnf-plugins/*
  572. %endif
  573. %files qrexec
  574. %config(noreplace) /etc/pam.d/qrexec
  575. /usr/bin/qrexec-fork-server
  576. /usr/bin/qrexec-client-vm
  577. /usr/lib/qubes/qrexec-agent
  578. /usr/lib/qubes/qrexec-client-vm
  579. /usr/lib/qubes/qrexec_client_vm
  580. /usr/lib/qubes/qubes-rpc-multiplexer
  581. /lib/systemd/system/qubes-qrexec-agent.service
  582. %{_mandir}/man1/qrexec-client-vm.1*
  583. %files nautilus
  584. /usr/lib/qubes/qvm-copy-to-vm.gnome
  585. /usr/lib/qubes/qvm-move-to-vm.gnome
  586. /usr/share/nautilus-python/extensions/qvm_copy_nautilus.py*
  587. /usr/share/nautilus-python/extensions/qvm_move_nautilus.py*
  588. /usr/share/nautilus-python/extensions/qvm_dvm_nautilus.py*
  589. %files dom0-updates
  590. %dir %attr(0775,user,user) /var/lib/qubes/dom0-updates
  591. /usr/lib/qubes/qubes-download-dom0-updates.sh
  592. %files networking
  593. %config(noreplace) /etc/qubes-rpc/qubes.UpdatesProxy
  594. %config(noreplace) /etc/qubes/ip6tables.rules
  595. %config(noreplace) /etc/qubes/iptables.rules
  596. %config(noreplace) /etc/tinyproxy/tinyproxy-updates.conf
  597. %config(noreplace) /etc/tinyproxy/updates-blacklist
  598. %config(noreplace) /etc/udev/rules.d/99-qubes-network.rules
  599. /etc/dhclient.d/qubes-setup-dnat-to-ns.sh
  600. /etc/xen/scripts/vif-qubes-nat.sh
  601. /etc/xen/scripts/vif-route-qubes
  602. /lib/systemd/system/qubes-firewall.service
  603. /lib/systemd/system/qubes-iptables.service
  604. /lib/systemd/system/qubes-network.service
  605. /lib/systemd/system/qubes-updates-proxy.service
  606. /usr/lib/qubes/init/network-proxy-setup.sh
  607. /usr/lib/qubes/init/qubes-iptables
  608. /usr/lib/qubes/iptables-updates-proxy
  609. /usr/lib/qubes/qubes-setup-dnat-to-ns
  610. /usr/lib/qubes/setup-ip
  611. /usr/lib/tmpfiles.d/qubes-core-agent-linux.conf
  612. /usr/sbin/qubes-firewall
  613. %files network-manager
  614. /etc/NetworkManager/dispatcher.d/30-qubes-external-ip
  615. /etc/NetworkManager/dispatcher.d/qubes-nmhook
  616. /etc/xdg/autostart/00-qubes-show-hide-nm-applet.desktop
  617. /usr/lib/NetworkManager/conf.d/30-qubes.conf
  618. /usr/lib/qubes/network-manager-prepare-conf-dir
  619. /usr/lib/qubes/qubes-fix-nm-conf.sh
  620. /usr/lib/qubes/show-hide-nm-applet.sh
  621. %files passwordless-root
  622. %config(noreplace) /etc/polkit-1/localauthority/50-local.d/qubes-allow-all.pkla
  623. %config(noreplace) /etc/polkit-1/rules.d/00-qubes-allow-all.rules
  624. %config(noreplace) /etc/sudoers.d/qubes
  625. %package sysvinit
  626. Summary: Qubes unit files for SysV init style or upstart
  627. License: GPL v2 only
  628. Group: Qubes
  629. Requires: upstart
  630. Requires: qubes-core-agent
  631. Requires: qubes-core-agent-qrexec
  632. Requires: qubes-core-agent-networking
  633. Provides: qubes-core-agent-init-scripts
  634. Conflicts: qubes-core-agent-systemd
  635. Provides: qubes-core-vm-sysvinit = %{version}-%{release}
  636. Obsoletes: qubes-core-vm-sysvinit < 4.0.0
  637. %description sysvinit
  638. The Qubes core startup configuration for SysV init (or upstart).
  639. %files sysvinit
  640. /etc/init.d/qubes-sysinit
  641. /etc/init.d/qubes-core-early
  642. /etc/init.d/qubes-core
  643. /etc/init.d/qubes-core-netvm
  644. /etc/init.d/qubes-firewall
  645. /etc/init.d/qubes-iptables
  646. /etc/init.d/qubes-updates-proxy
  647. /etc/init.d/qubes-qrexec-agent
  648. /etc/init.d/qubes-updates-proxy-forwarder
  649. /etc/sysconfig/modules/qubes-core.modules
  650. %post sysvinit
  651. #echo "--> Turning off unnecessary services..."
  652. # FIXME: perhaps there is more elegant way to do this?
  653. for f in /etc/init.d/*
  654. do
  655. srv=`basename $f`
  656. [ $srv = 'functions' ] && continue
  657. [ $srv = 'killall' ] && continue
  658. [ $srv = 'halt' ] && continue
  659. [ $srv = 'single' ] && continue
  660. [ $srv = 'reboot' ] && continue
  661. [ $srv = 'qubes-gui' ] && continue
  662. chkconfig $srv off
  663. done
  664. #echo "--> Enabling essential services..."
  665. chkconfig rsyslog on
  666. chkconfig haldaemon on
  667. chkconfig messagebus on
  668. for svc in %qubes_services ; do
  669. if [ "$1" = 1 ] ; then
  670. chkconfig --add $svc || echo "WARNING: Cannot add service $svc!"
  671. else
  672. chkconfig $svc resetpriorities || echo "WARNING: Cannot reset priorities of service $svc!"
  673. fi
  674. done
  675. # dropped services
  676. chkconfig qubes-netwatcher off || :
  677. # TODO: make this not display the silly message about security context...
  678. sed -i s/^id:.:initdefault:/id:3:initdefault:/ /etc/inittab
  679. %preun sysvinit
  680. if [ "$1" = 0 ] ; then
  681. # no more packages left
  682. for svc in %qubes_services ; do
  683. chkconfig --del $svc
  684. done
  685. fi
  686. %package systemd
  687. Summary: Qubes unit files for SystemD init style
  688. License: GPL v2 only
  689. Group: Qubes
  690. Requires: systemd
  691. Requires(post): systemd-units
  692. Requires(preun): systemd-units
  693. Requires(postun): systemd-units
  694. Requires: qubes-core-agent
  695. Provides: qubes-core-agent-init-scripts
  696. Conflicts: qubes-core-agent-sysvinit
  697. Provides: qubes-core-vm-systemd = %{version}-%{release}
  698. Obsoletes: qubes-core-vm-systemd < 4.0.0
  699. %description systemd
  700. The Qubes core startup configuration for SystemD init.
  701. %files systemd
  702. %defattr(-,root,root,-)
  703. /lib/systemd/system/qubes-misc-post.service
  704. /lib/systemd/system/qubes-mount-dirs.service
  705. /lib/systemd/system/qubes-sysinit.service
  706. /lib/systemd/system/qubes-early-vm-config.service
  707. /lib/systemd/system/qubes-update-check.service
  708. /lib/systemd/system/qubes-update-check.timer
  709. /lib/systemd/system/qubes-sync-time.service
  710. /lib/systemd/system/qubes-sync-time.timer
  711. /lib/systemd/system/qubes-updates-proxy-forwarder@.service
  712. /lib/systemd/system/qubes-updates-proxy-forwarder.socket
  713. /lib/systemd/system-preset/%qubes_preset_file
  714. /lib/modules-load.d/qubes-core.conf
  715. /lib/systemd/system/chronyd.service.d/30_qubes.conf
  716. /lib/systemd/system/crond.service.d/30_qubes.conf
  717. /lib/systemd/system/cups.service.d/30_qubes.conf
  718. /lib/systemd/system/cups.socket.d/30_qubes.conf
  719. /lib/systemd/system/cups.path.d/30_qubes.conf
  720. /lib/systemd/system/org.cups.cupsd.service.d/30_qubes.conf
  721. /lib/systemd/system/org.cups.cupsd.socket.d/30_qubes.conf
  722. /lib/systemd/system/org.cups.cupsd.path.d/30_qubes.conf
  723. /lib/systemd/system/getty@tty.service.d/30_qubes.conf
  724. /lib/systemd/system/ModemManager.service.d/30_qubes.conf
  725. /lib/systemd/system/NetworkManager.service.d/30_qubes.conf
  726. /lib/systemd/system/NetworkManager-wait-online.service.d/30_qubes.conf
  727. /lib/systemd/system/systemd-random-seed.service.d/30_qubes.conf
  728. /lib/systemd/system/systemd-timesyncd.service.d/30_qubes.conf
  729. /lib/systemd/system/tinyproxy.service.d/30_not_needed_in_qubes_by_default.conf
  730. /lib/systemd/system/tor.service.d/30_qubes.conf
  731. /lib/systemd/system/tor@default.service.d/30_qubes.conf
  732. /lib/systemd/system/tmp.mount.d/30_qubes.conf
  733. /usr/lib/systemd/user/pulseaudio.service.d/30_qubes.conf
  734. /usr/lib/systemd/user/pulseaudio.socket.d/30_qubes.conf
  735. %post systemd
  736. changed=
  737. %scriptletfuns
  738. if [ $1 -eq 1 ]
  739. then
  740. preset_units %{_presetdir}/%qubes_preset_file initial
  741. changed=true
  742. else
  743. preset_units %{_presetdir}/%qubes_preset_file upgrade
  744. changed=true
  745. # Upgrade path - now qubes-iptables is used instead
  746. for svc in iptables ip6tables
  747. do
  748. if [ -f "$svc".service ]
  749. then
  750. systemctl --no-reload preset "$svc".service
  751. changed=true
  752. fi
  753. done
  754. fi
  755. if [ $1 -eq 1 ]
  756. then
  757. # First install.
  758. # Set default "runlevel".
  759. # FIXME: this ought to be done via kernel command line.
  760. # The fewer deviations of the template from the seed
  761. # image, the better.
  762. rm -f %{_sysconfdir}/systemd/system/default.target
  763. ln -s %{_unitdir}/multi-user.target %{_sysconfdir}/systemd/system/default.target
  764. changed=true
  765. fi
  766. # remove old symlinks
  767. if [ -L %{_sysconfdir}/systemd/system/sysinit.target.wants/qubes-random-seed.service ]
  768. then
  769. rm -f %{_sysconfdir}/systemd/system/sysinit.target.wants/qubes-random-seed.service
  770. changed=true
  771. fi
  772. if [ -L %{_sysconfdir}/systemd/system/multi-user.target.wants/qubes-mount-home.service ]
  773. then
  774. rm -f %{_sysconfdir}/systemd/system/multi-user.target.wants/qubes-mount-home.service
  775. changed=true
  776. fi
  777. if [ "x$changed" != "x" ]
  778. then
  779. systemctl daemon-reload
  780. fi
  781. %preun systemd
  782. if [ $1 -eq 0 ] ; then
  783. # Run this only during uninstall.
  784. # Save the preset file to later use it to re-preset services there
  785. # once the Qubes OS preset file is removed.
  786. mkdir -p %{_rundir}/qubes-uninstall
  787. cp -f %{_presetdir}/%qubes_preset_file %{_rundir}/qubes-uninstall/
  788. fi
  789. %postun systemd
  790. changed=
  791. %scriptletfuns
  792. if [ -d %{_rundir}/qubes-uninstall ]
  793. then
  794. # We have a saved preset file (or more).
  795. # Re-preset the units mentioned there.
  796. restore_units %{_rundir}/qubes-uninstall/%qubes_preset_file
  797. rm -rf %{_rundir}/qubes-uninstall
  798. changed=true
  799. fi
  800. if [ "x$changed" != "x" ]
  801. then
  802. systemctl daemon-reload
  803. fi