core-vm.spec 21 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645
  1. #
  2. # The Qubes OS Project, http://www.qubes-os.org
  3. #
  4. # Copyright (C) 2010 Joanna Rutkowska <joanna@invisiblethingslab.com>
  5. # Copyright (C) 2010 Rafal Wojtczuk <rafal@invisiblethingslab.com>
  6. #
  7. # This program is free software; you can redistribute it and/or
  8. # modify it under the terms of the GNU General Public License
  9. # as published by the Free Software Foundation; either version 2
  10. # of the License, or (at your option) any later version.
  11. #
  12. # This program is distributed in the hope that it will be useful,
  13. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  14. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15. # GNU General Public License for more details.
  16. #
  17. # You should have received a copy of the GNU General Public License
  18. # along with this program; if not, write to the Free Software
  19. # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  20. #
  21. #
  22. %{!?version: %define version %(cat version)}
  23. %{!?backend_vmm: %define backend_vmm %(echo $BACKEND_VMM)}
  24. Name: qubes-core-vm
  25. Version: %{version}
  26. Release: 1%{dist}
  27. Summary: The Qubes core files for VM
  28. Group: Qubes
  29. Vendor: Invisible Things Lab
  30. License: GPL
  31. URL: http://www.qubes-os.org
  32. Requires: fedora-release
  33. Requires: yum-plugin-post-transaction-actions
  34. Requires: NetworkManager >= 0.8.1-1
  35. %if %{fedora} >= 18
  36. # Fedora >= 18 defaults to firewalld, which isn't supported nor needed by Qubes
  37. Requires: iptables-services
  38. Conflicts: firewalld
  39. %endif
  40. Requires: /usr/bin/mimeopen
  41. Requires: ethtool
  42. Requires: tinyproxy
  43. Requires: ntpdate
  44. Requires: net-tools
  45. Requires: nautilus-python
  46. Requires: qubes-core-vm-kernel-placeholder
  47. Requires: qubes-utils
  48. Requires: initscripts
  49. # for qubes-desktop-run
  50. Requires: pygobject3-base
  51. %if %{fedora} >= 20
  52. # gpk-update-viewer required by qubes-manager
  53. Requires: gnome-packagekit-updater
  54. %endif
  55. Requires: ImageMagick
  56. Requires: fakeroot
  57. Requires: desktop-notification-daemon
  58. Requires: pygtk2
  59. Requires: zenity
  60. Requires: qubes-libvchan
  61. Requires: qubes-db-vm
  62. Provides: qubes-core-vm
  63. Obsoletes: qubes-core-commonvm
  64. Obsoletes: qubes-core-appvm
  65. Obsoletes: qubes-core-netvm
  66. Obsoletes: qubes-core-proxyvm
  67. Obsoletes: qubes-upgrade-vm < 3.0
  68. BuildRequires: xen-devel
  69. BuildRequires: libX11-devel
  70. BuildRequires: qubes-utils-devel >= 3.0.1
  71. BuildRequires: qubes-libvchan-%{backend_vmm}-devel
  72. %define _builddir %(pwd)
  73. %define kde_service_dir /usr/share/kde4/services
  74. %description
  75. The Qubes core files for installation inside a Qubes VM.
  76. %prep
  77. # we operate on the current directory, so no need to unpack anything
  78. # symlink is to generate useful debuginfo packages
  79. rm -f %{name}-%{version}
  80. ln -sf . %{name}-%{version}
  81. %setup -T -D
  82. %build
  83. for dir in qubes-rpc qrexec misc; do
  84. (cd $dir; make)
  85. done
  86. %pre
  87. # Make sure there is a qubes group
  88. groupadd --force --system --gid 98 qubes
  89. id -u 'user' >/dev/null 2>&1 || {
  90. useradd --user-group --create-home --shell /bin/bash user
  91. }
  92. usermod -a --groups qubes user
  93. if [ "$1" != 1 ] ; then
  94. # do this whole %pre thing only when updating for the first time...
  95. exit 0
  96. fi
  97. mkdir -p /var/lib/qubes
  98. if [ -e /etc/fstab ] ; then
  99. mv /etc/fstab /var/lib/qubes/fstab.orig
  100. fi
  101. usermod -p '' root
  102. usermod -L user
  103. %install
  104. (cd qrexec; make install DESTDIR=$RPM_BUILD_ROOT)
  105. make install-vm DESTDIR=$RPM_BUILD_ROOT
  106. cp -p $RPM_BUILD_ROOT/usr/lib/qubes/init/iptables $RPM_BUILD_ROOT/etc/sysconfig/iptables.qubes
  107. cp -p $RPM_BUILD_ROOT/usr/lib/qubes/init/ip6tables $RPM_BUILD_ROOT/etc/sysconfig/ip6tables.qubes
  108. %triggerin -- initscripts
  109. if [ -e /etc/init/serial.conf ]; then
  110. cp /usr/share/qubes/serial.conf /etc/init/serial.conf
  111. fi
  112. %triggerin -- pulseaudio-module-x11
  113. sed -i '/^\(Not\|Only\)ShowIn/d' /etc/xdg/autostart/pulseaudio.desktop
  114. echo 'NotShowIn=QUBES;' >> /etc/xdg/autostart/pulseaudio.desktop
  115. %triggerin -- iptables
  116. if ! grep -q IPTABLES_DATA /etc/sysconfig/iptables-config; then
  117. cat <<EOF >>/etc/sysconfig/iptables-config
  118. ### Automatically added by Qubes:
  119. # Override default rules location on Qubes
  120. IPTABLES_DATA=/etc/sysconfig/iptables.qubes
  121. EOF
  122. fi
  123. if ! grep -q IP6TABLES_DATA /etc/sysconfig/ip6tables-config; then
  124. cat <<EOF >>/etc/sysconfig/ip6tables-config
  125. ### Automatically added by Qubes:
  126. # Override default rules location on Qubes
  127. IP6TABLES_DATA=/etc/sysconfig/ip6tables.qubes
  128. EOF
  129. fi
  130. %post
  131. # disable some Upstart services
  132. for F in plymouth-shutdown prefdm splash-manager start-ttys tty ; do
  133. if [ -e /etc/init/$F.conf ]; then
  134. mv -f /etc/init/$F.conf /etc/init/$F.conf.disabled
  135. fi
  136. done
  137. remove_ShowIn () {
  138. if [ -e /etc/xdg/autostart/$1.desktop ]; then
  139. sed -i '/^\(Not\|Only\)ShowIn/d' /etc/xdg/autostart/$1.desktop
  140. fi
  141. }
  142. # reenable if disabled by some earlier version of package
  143. remove_ShowIn abrt-applet.desktop imsettings-start.desktop
  144. # don't want it at all
  145. for F in deja-dup-monitor krb5-auth-dialog pulseaudio restorecond sealertauto gnome-power-manager gnome-sound-applet gnome-screensaver orca-autostart; do
  146. if [ -e /etc/xdg/autostart/$F.desktop ]; then
  147. remove_ShowIn $F
  148. echo 'NotShowIn=QUBES;' >> /etc/xdg/autostart/$F.desktop
  149. fi
  150. done
  151. # don't want it in DisposableVM
  152. for F in gcm-apply ; do
  153. if [ -e /etc/xdg/autostart/$F.desktop ]; then
  154. remove_ShowIn $F
  155. echo 'NotShowIn=DisposableVM;' >> /etc/xdg/autostart/$F.desktop
  156. fi
  157. done
  158. # want it in AppVM only
  159. for F in gnome-keyring-gpg gnome-keyring-pkcs11 gnome-keyring-secrets gnome-keyring-ssh gnome-settings-daemon user-dirs-update-gtk gsettings-data-convert ; do
  160. if [ -e /etc/xdg/autostart/$F.desktop ]; then
  161. remove_ShowIn $F
  162. echo 'OnlyShowIn=GNOME;AppVM;' >> /etc/xdg/autostart/$F.desktop
  163. fi
  164. done
  165. # remove existing rule to add own later
  166. for F in gpk-update-icon nm-applet ; do
  167. remove_ShowIn $F
  168. done
  169. echo 'OnlyShowIn=GNOME;UpdateableVM;' >> /etc/xdg/autostart/gpk-update-icon.desktop || :
  170. %if %{fedora} >= 20
  171. echo 'OnlyShowIn=GNOME;QUBES;' >> /etc/xdg/autostart/nm-applet.desktop || :
  172. %else
  173. echo 'OnlyShowIn=GNOME;NetVM;' >> /etc/xdg/autostart/nm-applet.desktop || :
  174. %endif
  175. # Create NetworkManager configuration if we do not have it
  176. if ! [ -e /etc/NetworkManager/NetworkManager.conf ]; then
  177. echo '[main]' > /etc/NetworkManager/NetworkManager.conf
  178. echo 'plugins = keyfile' >> /etc/NetworkManager/NetworkManager.conf
  179. echo '[keyfile]' >> /etc/NetworkManager/NetworkManager.conf
  180. fi
  181. /usr/lib/qubes/qubes-fix-nm-conf.sh
  182. # Remove ip_forward setting from sysctl, so NM will not reset it
  183. sed 's/^net.ipv4.ip_forward.*/#\0/' -i /etc/sysctl.conf
  184. # Remove old firmware updates link
  185. if [ -L /lib/firmware/updates ]; then
  186. rm -f /lib/firmware/updates
  187. fi
  188. if ! grep -q '/etc/yum\.conf\.d/qubes-proxy\.conf' /etc/yum.conf; then
  189. echo >> /etc/yum.conf
  190. echo '# Yum does not support inclusion of config dir...' >> /etc/yum.conf
  191. echo 'include=file:///etc/yum.conf.d/qubes-proxy.conf' >> /etc/yum.conf
  192. fi
  193. # Revert 'Prevent unnecessary updates in VMs':
  194. sed -i -e '/^exclude = kernel/d' /etc/yum.conf
  195. # Location of files which contains list of protected files
  196. mkdir -p /etc/qubes/protected-files.d
  197. PROTECTED_FILE_LIST='/etc/qubes/protected-files.d'
  198. # qubes-core-vm has been broken for some time - it overrides /etc/hosts; restore original content
  199. if ! grep -rq "^/etc/hosts$" "${PROTECTED_FILE_LIST}" 2>/dev/null; then
  200. if ! grep -q localhost /etc/hosts; then
  201. cat <<EOF > /etc/hosts
  202. 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 `hostname`
  203. ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
  204. EOF
  205. fi
  206. fi
  207. # Make sure that /etc/sysconfig/ip(|6)tables exists. Otherwise iptales.service
  208. # would not start (even when configured to use another configuration file.
  209. if [ ! -e '/etc/sysconfig/iptables' ]; then
  210. ln -s iptables.qubes /etc/sysconfig/iptables
  211. fi
  212. if [ ! -e '/etc/sysconfig/ip6tables' ]; then
  213. ln -s ip6tables.qubes /etc/sysconfig/ip6tables
  214. fi
  215. # ensure that hostname resolves to 127.0.0.1 resp. ::1 and that /etc/hosts is
  216. # in the form expected by qubes-sysinit.sh
  217. if ! grep -rq "^/etc/hostname$" "${PROTECTED_FILE_LIST}" 2>/dev/null; then
  218. for ip in '127\.0\.0\.1' '::1'; do
  219. if grep -q "^${ip}\(\s\|$\)" /etc/hosts; then
  220. sed -i "/^${ip}\s/,+0s/\(\s`hostname`\)\+\(\s\|$\)/\2/g" /etc/hosts
  221. sed -i "s/^${ip}\(\s\|$\).*$/\0 `hostname`/" /etc/hosts
  222. else
  223. echo "${ip} `hostname`" >> /etc/hosts
  224. fi
  225. done
  226. fi
  227. %if %{fedora} >= 20
  228. # Make sure there is a default locale set so gnome-terminal will start
  229. if [ ! -e /etc/locale.conf ] || ! grep -q LANG /etc/locale.conf; then
  230. touch /etc/locale.conf
  231. echo "LANG=en_US.UTF-8" >> /etc/locale.conf
  232. fi
  233. # ... and make sure it is really generated
  234. current_locale=`grep LANG /etc/locale.conf|cut -f 2 -d = | tr -d '"'`
  235. if [ -n "$current_locale" ] && ! locale -a | grep -q "$current_locale"; then
  236. base=`echo "$current_locale" | cut -f 1 -d .`
  237. charmap=`echo "$current_locale.UTF-8" | cut -f 2 -d .`
  238. [ -n "$charmap" ] && charmap="-f $charmap"
  239. localedef -i $base $charmap $current_locale
  240. fi
  241. %endif
  242. if [ "$1" != 1 ] ; then
  243. # do the rest of %post thing only when updating for the first time...
  244. exit 0
  245. fi
  246. if [ -e /etc/init/serial.conf ] && ! [ -f /var/lib/qubes/serial.orig ] ; then
  247. cp /etc/init/serial.conf /var/lib/qubes/serial.orig
  248. fi
  249. # Remove most of the udev scripts to speed up the VM boot time
  250. # Just leave the xen* scripts, that are needed if this VM was
  251. # ever used as a net backend (e.g. as a VPN domain in the future)
  252. #echo "--> Removing unnecessary udev scripts..."
  253. mkdir -p /var/lib/qubes/removed-udev-scripts
  254. for f in /etc/udev/rules.d/*
  255. do
  256. if [ $(basename $f) == "xen-backend.rules" ] ; then
  257. continue
  258. fi
  259. if [ $(basename $f) == "50-qubes-misc.rules" ] ; then
  260. continue
  261. fi
  262. if echo $f | grep -q qubes; then
  263. continue
  264. fi
  265. mv $f /var/lib/qubes/removed-udev-scripts/
  266. done
  267. mkdir -p /rw
  268. #rm -f /etc/mtab
  269. #echo "--> Removing HWADDR setting from /etc/sysconfig/network-scripts/ifcfg-eth0"
  270. #mv /etc/sysconfig/network-scripts/ifcfg-eth0 /etc/sysconfig/network-scripts/ifcfg-eth0.orig
  271. #grep -v HWADDR /etc/sysconfig/network-scripts/ifcfg-eth0.orig > /etc/sysconfig/network-scripts/ifcfg-eth0
  272. %triggerin -- notification-daemon
  273. # Enable autostart of notification-daemon when installed
  274. if [ ! -e /etc/xdg/autostart/notification-daemon.desktop ]; then
  275. ln -s /usr/share/applications/notification-daemon.desktop /etc/xdg/autostart/
  276. fi
  277. exit 0
  278. %triggerin -- selinux-policy
  279. #echo "--> Disabling SELinux..."
  280. sed -e s/^SELINUX=.*$/SELINUX=disabled/ </etc/selinux/config >/etc/selinux/config.processed
  281. mv /etc/selinux/config.processed /etc/selinux/config
  282. setenforce 0 2>/dev/null
  283. exit 0
  284. %preun
  285. if [ "$1" = 0 ] ; then
  286. # no more packages left
  287. if [ -e /var/lib/qubes/fstab.orig ] ; then
  288. mv /var/lib/qubes/fstab.orig /etc/fstab
  289. fi
  290. mv /var/lib/qubes/removed-udev-scripts/* /etc/udev/rules.d/
  291. if [ -e /var/lib/qubes/serial.orig ] ; then
  292. mv /var/lib/qubes/serial.orig /etc/init/serial.conf
  293. fi
  294. fi
  295. %postun
  296. if [ $1 -eq 0 ] ; then
  297. /usr/bin/glib-compile-schemas %{_datadir}/glib-2.0/schemas &> /dev/null || :
  298. if [ -L /lib/firmware/updates ]; then
  299. rm /lib/firmware/updates
  300. fi
  301. fi
  302. %posttrans
  303. /usr/bin/glib-compile-schemas %{_datadir}/glib-2.0/schemas &> /dev/null || :
  304. %clean
  305. rm -rf $RPM_BUILD_ROOT
  306. rm -f %{name}-%{version}
  307. %files
  308. %defattr(-,root,root,-)
  309. %dir /var/lib/qubes
  310. %dir /var/run/qubes
  311. %dir %attr(0775,user,user) /var/lib/qubes/dom0-updates
  312. %{kde_service_dir}/qvm-copy.desktop
  313. %{kde_service_dir}/qvm-move.desktop
  314. %{kde_service_dir}/qvm-dvm.desktop
  315. /etc/NetworkManager/dispatcher.d/30-qubes-external-ip
  316. /etc/NetworkManager/dispatcher.d/qubes-nmhook
  317. %config(noreplace) /etc/X11/xorg-preload-apps.conf
  318. /etc/dispvm-dotfiles.tbz
  319. /etc/dhclient.d/qubes-setup-dnat-to-ns.sh
  320. /etc/fstab
  321. /etc/pki/rpm-gpg/RPM-GPG-KEY-qubes*
  322. %config(noreplace) /etc/polkit-1/localauthority/50-local.d/qubes-allow-all.pkla
  323. %config(noreplace) /etc/polkit-1/rules.d/00-qubes-allow-all.rules
  324. %dir /etc/qubes-rpc
  325. %config(noreplace) /etc/qubes-rpc/qubes.Filecopy
  326. %config(noreplace) /etc/qubes-rpc/qubes.OpenInVM
  327. %config(noreplace) /etc/qubes-rpc/qubes.GetAppmenus
  328. %config(noreplace) /etc/qubes-rpc/qubes.VMShell
  329. %config(noreplace) /etc/qubes-rpc/qubes.SyncNtpClock
  330. %config(noreplace) /etc/qubes-rpc/qubes.SuspendPre
  331. %config(noreplace) /etc/qubes-rpc/qubes.SuspendPost
  332. %config(noreplace) /etc/qubes-rpc/qubes.WaitForSession
  333. %config(noreplace) /etc/qubes-rpc/qubes.DetachPciDevice
  334. %config(noreplace) /etc/qubes-rpc/qubes.Backup
  335. %config(noreplace) /etc/qubes-rpc/qubes.Restore
  336. %config(noreplace) /etc/qubes-rpc/qubes.SelectFile
  337. %config(noreplace) /etc/qubes-rpc/qubes.SelectDirectory
  338. %config(noreplace) /etc/qubes-rpc/qubes.GetImageRGBA
  339. %config(noreplace) /etc/qubes-rpc/qubes.SetDateTime
  340. %config(noreplace) /etc/sudoers.d/qubes
  341. %config(noreplace) /etc/sysconfig/iptables.qubes
  342. %config(noreplace) /etc/sysconfig/ip6tables.qubes
  343. /usr/lib/qubes/init/iptables
  344. /usr/lib/qubes/init/ip6tables
  345. %config(noreplace) /etc/tinyproxy/filter-updates
  346. %config(noreplace) /etc/tinyproxy/tinyproxy-updates.conf
  347. %config(noreplace) /etc/udev/rules.d/50-qubes-misc.rules
  348. %config(noreplace) /etc/udev/rules.d/99-qubes-network.rules
  349. /etc/xdg/autostart/00-qubes-show-hide-nm-applet.desktop
  350. /etc/xen/scripts/vif-route-qubes
  351. %config(noreplace) /etc/yum.conf.d/qubes-proxy.conf
  352. %config(noreplace) /etc/yum.repos.d/qubes-r3.repo
  353. /etc/yum/pluginconf.d/yum-qubes-hooks.conf
  354. /etc/yum/post-actions/qubes-trigger-sync-appmenus.action
  355. /usr/lib/systemd/system/user@.service.d/90-session-stop-timeout.conf
  356. /usr/sbin/qubes-serial-login
  357. /usr/bin/qvm-copy-to-vm
  358. /usr/bin/qvm-move-to-vm
  359. /usr/bin/qvm-open-in-dvm
  360. /usr/bin/qvm-open-in-vm
  361. /usr/bin/qvm-run
  362. /usr/bin/qvm-mru-entry
  363. /usr/bin/xenstore-watch-qubes
  364. /usr/bin/qubes-desktop-run
  365. /usr/bin/qrexec-fork-server
  366. /usr/bin/qrexec-client-vm
  367. %dir /usr/lib/qubes
  368. /usr/lib/qubes/vusb-ctl.py*
  369. /usr/lib/qubes/dispvm-prerun.sh
  370. /usr/lib/qubes/sync-ntp-clock
  371. /usr/lib/qubes/prepare-suspend
  372. /usr/lib/qubes/network-manager-prepare-conf-dir
  373. /usr/lib/qubes/show-hide-nm-applet.sh
  374. /usr/lib/qubes/qrexec-agent
  375. /usr/lib/qubes/qrexec-client-vm
  376. /usr/lib/qubes/qrexec_client_vm
  377. /usr/lib/qubes/qubes-rpc-multiplexer
  378. /usr/lib/qubes/qfile-agent
  379. %attr(4755,root,root) /usr/lib/qubes/qfile-unpacker
  380. /usr/lib/qubes/qopen-in-vm
  381. /usr/lib/qubes/qrun-in-vm
  382. /usr/lib/qubes/qubes-download-dom0-updates.sh
  383. /usr/lib/qubes/qubes-fix-nm-conf.sh
  384. /usr/lib/qubes/qubes-setup-dnat-to-ns
  385. /usr/lib/qubes/qubes-trigger-sync-appmenus.sh
  386. /usr/lib/qubes/qvm-copy-to-vm.gnome
  387. /usr/lib/qubes/qvm-copy-to-vm.kde
  388. /usr/lib/qubes/qvm-move-to-vm.gnome
  389. /usr/lib/qubes/qvm-move-to-vm.kde
  390. /usr/lib/qubes/setup-ip
  391. /usr/lib/qubes/tar2qfile
  392. /usr/lib/qubes/vm-file-editor
  393. /usr/lib/qubes/wrap-in-html-if-url.sh
  394. /usr/lib/qubes/iptables-updates-proxy
  395. /usr/lib/qubes/close-window
  396. /usr/lib/yum-plugins/yum-qubes-hooks.py*
  397. /usr/sbin/qubes-firewall
  398. /usr/sbin/qubes-netwatcher
  399. /usr/share/qubes/serial.conf
  400. /usr/share/glib-2.0/schemas/org.gnome.settings-daemon.plugins.updates.gschema.override
  401. /usr/share/glib-2.0/schemas/org.gnome.nautilus.gschema.override
  402. /usr/share/nautilus-python/extensions/qvm_copy_nautilus.py*
  403. /usr/share/nautilus-python/extensions/qvm_move_nautilus.py*
  404. /usr/share/nautilus-python/extensions/qvm_dvm_nautilus.py*
  405. %dir /usr/share/qubes
  406. /usr/share/qubes/mime-override/globs
  407. %dir /home_volatile
  408. %attr(700,user,user) /home_volatile/user
  409. %dir /mnt/removable
  410. %dir /rw
  411. %package sysvinit
  412. Summary: Qubes unit files for SysV init style or upstart
  413. License: GPL v2 only
  414. Group: Qubes
  415. Requires: upstart
  416. Requires: qubes-core-vm
  417. Provides: qubes-core-vm-init-scripts
  418. Conflicts: qubes-core-vm-systemd
  419. %description sysvinit
  420. The Qubes core startup configuration for SysV init (or upstart).
  421. %files sysvinit
  422. /etc/init.d/qubes-core
  423. /etc/init.d/qubes-core-appvm
  424. /etc/init.d/qubes-core-netvm
  425. /etc/init.d/qubes-firewall
  426. /etc/init.d/qubes-netwatcher
  427. /etc/init.d/qubes-updates-proxy
  428. /etc/init.d/qubes-qrexec-agent
  429. /etc/sysconfig/modules/qubes-core.modules
  430. /etc/sysconfig/modules/qubes-misc.modules
  431. %post sysvinit
  432. #echo "--> Turning off unnecessary services..."
  433. # FIXME: perhaps there is more elegant way to do this?
  434. for f in /etc/init.d/*
  435. do
  436. srv=`basename $f`
  437. [ $srv = 'functions' ] && continue
  438. [ $srv = 'killall' ] && continue
  439. [ $srv = 'halt' ] && continue
  440. [ $srv = 'single' ] && continue
  441. [ $srv = 'reboot' ] && continue
  442. [ $srv = 'qubes-gui' ] && continue
  443. chkconfig $srv off
  444. done
  445. #echo "--> Enabling essential services..."
  446. chkconfig rsyslog on
  447. chkconfig haldaemon on
  448. chkconfig messagebus on
  449. chkconfig iptables on
  450. chkconfig ip6tables on
  451. chkconfig --add qubes-core || echo "WARNING: Cannot add service qubes-core!"
  452. chkconfig qubes-core on || echo "WARNING: Cannot enable service qubes-core!"
  453. chkconfig --add qubes-core-netvm || echo "WARNING: Cannot add service qubes-core-netvm!"
  454. chkconfig qubes-core-netvm on || echo "WARNING: Cannot enable service qubes-core-netvm!"
  455. chkconfig --add qubes-core-appvm || echo "WARNING: Cannot add service qubes-core-appvm!"
  456. chkconfig qubes-core-appvm on || echo "WARNING: Cannot enable service qubes-core-appvm!"
  457. chkconfig --add qubes-firewall || echo "WARNING: Cannot add service qubes-firewall!"
  458. chkconfig qubes-firewall on || echo "WARNING: Cannot enable service qubes-firewall!"
  459. chkconfig --add qubes-netwatcher || echo "WARNING: Cannot add service qubes-netwatcher!"
  460. chkconfig qubes-netwatcher on || echo "WARNING: Cannot enable service qubes-netwatcher!"
  461. chkconfig --add qubes-updates-proxy || echo "WARNING: Cannot add service qubes-updates-proxy!"
  462. chkconfig qubes-updates-proxy on || echo "WARNING: Cannot enable service qubes-updates-proxy!"
  463. chkconfig --add qubes-qrexec-agent || echo "WARNING: Cannot add service qubes-qrexec-agent!"
  464. chkconfig qubes-qrexec-agent on || echo "WARNING: Cannot enable service qubes-qrexec-agent!"
  465. # TODO: make this not display the silly message about security context...
  466. sed -i s/^id:.:initdefault:/id:3:initdefault:/ /etc/inittab
  467. %preun sysvinit
  468. if [ "$1" = 0 ] ; then
  469. # no more packages left
  470. chkconfig qubes-core off
  471. chkconfig qubes-core-netvm off
  472. chkconfig qubes-core-appvm off
  473. chkconfig qubes-firewall off
  474. chkconfig qubes-netwatcher off
  475. chkconfig qubes-updates-proxy off
  476. chkconfig qubes-qrexec-agent off
  477. fi
  478. %package systemd
  479. Summary: Qubes unit files for SystemD init style
  480. License: GPL v2 only
  481. Group: Qubes
  482. Requires: systemd
  483. Requires(post): systemd-units
  484. Requires(preun): systemd-units
  485. Requires(postun): systemd-units
  486. Requires: qubes-core-vm
  487. Provides: qubes-core-vm-init-scripts
  488. Conflicts: qubes-core-vm-sysvinit
  489. %description systemd
  490. The Qubes core startup configuration for SystemD init.
  491. %files systemd
  492. %defattr(-,root,root,-)
  493. /lib/systemd/system/qubes-dvm.service
  494. /lib/systemd/system/qubes-misc-post.service
  495. /lib/systemd/system/qubes-firewall.service
  496. /lib/systemd/system/qubes-mount-home.service
  497. /lib/systemd/system/qubes-netwatcher.service
  498. /lib/systemd/system/qubes-network.service
  499. /lib/systemd/system/qubes-sysinit.service
  500. /lib/systemd/system/qubes-update-check.service
  501. /lib/systemd/system/qubes-update-check.timer
  502. /lib/systemd/system/qubes-updates-proxy.service
  503. /lib/systemd/system/qubes-qrexec-agent.service
  504. /lib/systemd/system-preset/75-qubes-vm.preset
  505. /lib/modules-load.d/qubes-core.conf
  506. /lib/modules-load.d/qubes-misc.conf
  507. %dir /usr/lib/qubes/init
  508. /usr/lib/qubes/init/prepare-dvm.sh
  509. /usr/lib/qubes/init/network-proxy-setup.sh
  510. /usr/lib/qubes/init/misc-post.sh
  511. /usr/lib/qubes/init/misc-post-stop.sh
  512. /usr/lib/qubes/init/mount-home.sh
  513. /usr/lib/qubes/init/qubes-sysinit.sh
  514. /lib/systemd/system/chronyd.service.d/30_qubes.conf
  515. /lib/systemd/system/crond.service.d/30_qubes.conf
  516. /lib/systemd/system/cups.service.d/30_qubes.conf
  517. /lib/systemd/system/cups.socket.d/30_qubes.conf
  518. /lib/systemd/system/cups.path.d/30_qubes.conf
  519. /lib/systemd/system/getty@tty.service.d/30_qubes.conf
  520. /lib/systemd/system/ModemManager.service.d/30_qubes.conf
  521. /lib/systemd/system/NetworkManager.service.d/30_qubes.conf
  522. /lib/systemd/system/NetworkManager-wait-online.service.d/30_qubes.conf
  523. /lib/systemd/system/ntpd.service.d/30_qubes.conf
  524. %post systemd
  525. PRESET_FAILED=0
  526. if [ $1 -eq 1 ]; then
  527. /bin/systemctl --no-reload preset-all > /dev/null 2>&1 && PRESET_FAILED=0 || PRESET_FAILED=1
  528. else
  529. services="qubes-dvm qubes-misc-post qubes-firewall qubes-mount-home"
  530. services="$services qubes-netwatcher qubes-network qubes-sysinit"
  531. services="$services qubes-updates-proxy qubes-qrexec-agent"
  532. for srv in $services; do
  533. /bin/systemctl --no-reload preset $srv.service
  534. done
  535. /bin/systemctl --no-reload preset qubes-update-check.timer
  536. fi
  537. # Set default "runlevel"
  538. rm -f /etc/systemd/system/default.target
  539. ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
  540. grep '^[[:space:]]*[^#;]' /lib/systemd/system-preset/75-qubes-vm.preset | while read action unit_name; do
  541. case "$action" in
  542. (disable)
  543. if [ -f /lib/systemd/system/$unit_name ]; then
  544. if ! fgrep -q '[Install]' /lib/systemd/system/$unit_name; then
  545. # forcibly disable
  546. ln -sf /dev/null /etc/systemd/system/$unit_name
  547. fi
  548. fi
  549. ;;
  550. *)
  551. # preset-all is not available in fc20; so preset each unit file listed in 75-qubes-vm.preset
  552. if [ $1 -eq 1 -a "${PRESET_FAILED}" -eq 1 ]; then
  553. systemctl --no-reload preset "${unit_name}" > /dev/null 2>&1 || true
  554. fi
  555. ;;
  556. esac
  557. done
  558. /bin/systemctl daemon-reload
  559. exit 0
  560. %postun systemd
  561. #Do not run this part on upgrades
  562. if [ "$1" != 0 ] ; then
  563. exit 0
  564. fi
  565. for srv in qubes-dvm qubes-sysinit qubes-misc-post qubes-mount-home qubes-netwatcher qubes-network qubes-qrexec-agent; do
  566. /bin/systemctl disable $srv.service
  567. do