manager/qubesmanager/global_settings.py
Marta Marczykowska-Górecka ee5625b65c
Use the new QubesDaemonAccessError
Replaces the old, unified approach.
2020-08-11 01:08:48 +02:00

617 lines
24 KiB
Python

#!/usr/bin/python3
#
# The Qubes OS Project, http://www.qubes-os.org
#
# Copyright (C) 2012 Agnieszka Kostrzewa <agnieszka.kostrzewa@gmail.com>
# Copyright (C) 2012 Marek Marczykowski <marmarek@mimuw.edu.pl>
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public License along
# with this program; if not, see <http://www.gnu.org/licenses/>.
#
#
import os
import subprocess
from PyQt5 import QtWidgets, QtCore, QtGui # pylint: disable=import-error
from qubesadmin.utils import parse_size
from qubesadmin import exc
from . import ui_globalsettingsdlg # pylint: disable=no-name-in-module
from . import utils
from configparser import ConfigParser
qmemman_config_path = '/etc/qubes/qmemman.conf'
def _run_qrexec_repo(service, arg=''):
# Set default locale to C in order to prevent error msg
# in subprocess call related to falling back to C locale
env = os.environ.copy()
env['LC_ALL'] = 'C'
# Fake up a "qrexec call" to dom0 because dom0 can't qrexec to itself yet
cmd = '/etc/qubes-rpc/' + service
p = subprocess.run(
['sudo', cmd, arg],
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
check=False,
env=env
)
if p.stderr:
raise RuntimeError(
QtCore.QCoreApplication.translate(
"GlobalSettings", 'qrexec call stderr was not empty'),
{'stderr': p.stderr.decode('utf-8')})
if p.returncode != 0:
raise RuntimeError(
QtCore.QCoreApplication.translate(
"GlobalSettings",
'qrexec call exited with non-zero return code'),
{'returncode': p.returncode})
return p.stdout.decode('utf-8')
class GlobalSettingsWindow(ui_globalsettingsdlg.Ui_GlobalSettings,
QtWidgets.QDialog):
def __init__(self, app, qubes_app, parent=None):
super(GlobalSettingsWindow, self).__init__(parent)
self.app = app
self.qubes_app = qubes_app
self.vm = self.qubes_app.domains[self.qubes_app.local_name]
self.setupUi(self)
self.buttonBox.accepted.connect(self.save_and_apply)
self.buttonBox.rejected.connect(self.reject)
self.__init_system_defaults__()
self.__init_kernel_defaults__()
self.__init_mem_defaults__()
self.__init_updates__()
self.__init_gui_defaults()
self.errors = []
def setup_application(self):
self.app.setApplicationName(self.tr("Qubes Global Settings"))
self.app.setWindowIcon(QtGui.QIcon.fromTheme("qubes-manager"))
def setup_widget_with_vms(self, widget, filter_function,
allow_none, holder, property_name):
try:
utils.initialize_widget_with_vms(
widget=widget,
qubes_app=self.qubes_app,
filter_function=filter_function,
allow_none=allow_none,
holder=holder,
property_name=property_name
)
except exc.QubesDaemonAccessError:
widget.clear()
widget.setCurrentText("unavailable")
widget.setEnabled(False)
def __init_system_defaults__(self):
# set up updatevm choice
self.setup_widget_with_vms(
widget=self.update_vm_combo,
filter_function=(lambda vm: vm.klass != 'TemplateVM'),
allow_none=True,
holder=self.qubes_app,
property_name="updatevm")
# set up clockvm choice
self.setup_widget_with_vms(
widget=self.clock_vm_combo,
filter_function=(lambda vm: vm.klass != 'TemplateVM'),
allow_none=True,
holder=self.qubes_app,
property_name="clockvm")
# set up default netvm
self.setup_widget_with_vms(
widget=self.default_netvm_combo,
filter_function=(lambda vm: getattr(
vm, 'provides_network', False)),
allow_none=True,
holder=self.qubes_app,
property_name="default_netvm")
# default template
self.setup_widget_with_vms(
widget=self.default_template_combo,
filter_function=(lambda vm: vm.klass == 'TemplateVM'),
allow_none=True,
holder=self.qubes_app,
property_name="default_template"
)
# default dispvm
self.setup_widget_with_vms(
widget=self.default_dispvm_combo,
filter_function=(lambda vm: getattr(
vm, 'template_for_dispvms', False)),
allow_none=True,
holder=self.qubes_app,
property_name="default_dispvm"
)
def __apply_system_defaults__(self):
# updatevm
if utils.did_widget_selection_change(self.update_vm_combo):
try:
self.qubes_app.updatevm = self.update_vm_combo.currentData()
except exc.QubesException as ex:
self.errors.append(
"Failed to set UpdateVM due to {}".format(str(ex)))
# clockvm
if utils.did_widget_selection_change(self.clock_vm_combo):
try:
self.qubes_app.clockvm = self.clock_vm_combo.currentData()
except exc.QubesException as ex:
self.errors.append(
"Failed to set ClockVM due to {}".format(str(ex)))
# default netvm
if utils.did_widget_selection_change(self.default_netvm_combo):
try:
self.qubes_app.default_netvm = \
self.default_netvm_combo.currentData()
except exc.QubesException as ex:
self.errors.append(
"Failed to set Default NetVM due to {}".format(str(ex)))
# default template
if utils.did_widget_selection_change(self.default_template_combo):
try:
self.qubes_app.default_template = \
self.default_template_combo.currentData()
except exc.QubesException as ex:
self.errors.append(
"Failed to set Default Template due to {}".format(str(ex)))
# default_dispvm
if utils.did_widget_selection_change(self.default_dispvm_combo):
try:
self.qubes_app.default_dispvm = \
self.default_dispvm_combo.currentData()
except exc.QubesException as ex:
self.errors.append(
"Failed to set Default DispVM due to {}".format(str(ex)))
def __init_kernel_defaults__(self):
try:
utils.initialize_widget_with_kernels(
widget=self.default_kernel_combo,
qubes_app=self.qubes_app,
allow_none=True,
holder=self.qubes_app,
property_name='default_kernel')
except exc.QubesDaemonAccessError:
self.default_kernel_combo.clear()
self.default_kernel_combo.setCurrentText("unavailable")
self.default_kernel_combo.setEnabled(False)
def __apply_kernel_defaults__(self):
if utils.did_widget_selection_change(self.default_kernel_combo):
try:
self.qubes_app.default_kernel = \
self.default_kernel_combo.currentData()
except exc.QubesException as ex:
self.errors.append(
"Failed to set Default Kernel due to {}".format(str(ex)))
def __init_gui_defaults(self):
utils.initialize_widget(
widget=self.allow_fullscreen,
choices=[
('default (disallow)', None),
('allow', True),
('disallow', False)
],
selected_value=utils.get_boolean_feature(
self.vm,
'gui-default-allow-fullscreen'))
utils.initialize_widget(
widget=self.allow_utf8,
choices=[
('default (disallow)', None),
('allow', True),
('disallow', False)
],
selected_value=utils.get_boolean_feature(
self.vm,
'gui-default-allow-utf8-titles'))
utils.initialize_widget(
widget=self.trayicon,
choices=[
('default (thin border)', None),
('full background', 'bg'),
('thin border', 'border1'),
('thick border', 'border2'),
('tinted icon', 'tint'),
('tinted icon with modified white', 'tint+whitehack'),
('tinted icon with 50% saturation', 'tint+saturation50')
],
selected_value=utils.get_feature(
self.vm, 'gui-default-trayicon-mode', None))
utils.initialize_widget(
widget=self.securecopy,
choices=[
('default (Ctrl+Shift+C)', None),
('Ctrl+Shift+C', 'Ctrl-Shift-c'),
('Ctrl+Win+C', 'Ctrl-Mod4-c'),
],
selected_value=utils.get_feature(
self.vm, 'gui-default-secure-copy-sequence', None))
utils.initialize_widget(
widget=self.securepaste,
choices=[
('default (Ctrl+Shift+V)', None),
('Ctrl+Shift+V', 'Ctrl-Shift-V'),
('Ctrl+Win+V', 'Ctrl-Mod4-v'),
('Ctrl+Insert', 'Ctrl-Ins'),
],
selected_value=utils.get_feature(
self.vm, 'gui-default-secure-paste-sequence', None))
def __apply_feature_change(self, widget, feature):
if utils.did_widget_selection_change(widget):
if widget.currentData() is None:
try:
del self.vm.features[feature]
except exc.QubesDaemonAccessError:
self.errors.append(
"Failed to set {} due to insufficient "
"permissions".format(feature))
else:
try:
self.vm.features[feature] = widget.currentData()
except exc.QubesDaemonAccessError as ex:
self.errors.append(
"Failed to set {} due to insufficient "
"permissions".format(feature))
def __apply_gui_defaults(self):
self.__apply_feature_change(widget=self.allow_fullscreen,
feature='gui-default-allow-fullscreen')
self.__apply_feature_change(widget=self.allow_utf8,
feature='gui-default-allow-utf8-titles')
self.__apply_feature_change(widget=self.trayicon,
feature='gui-default-trayicon-mode')
self.__apply_feature_change(widget=self.securecopy,
feature='gui-default-secure-copy-sequence')
self.__apply_feature_change(widget=self.securepaste,
feature='gui-default-secure-paste-sequence')
def __init_mem_defaults__(self):
# qmemman settings
try:
self.qmemman_config = ConfigParser()
self.vm_min_mem_val = '200MiB' # str(qmemman_algo.MIN_PREFMEM)
self.dom0_mem_boost_val = '350MiB' # str(qmemman_algo.DOM0_MEM_BOOST)
self.qmemman_config.read(qmemman_config_path)
if self.qmemman_config.has_section('global'):
self.vm_min_mem_val = \
self.qmemman_config.get('global', 'vm-min-mem')
self.dom0_mem_boost_val = \
self.qmemman_config.get('global', 'dom0-mem-boost')
self.vm_min_mem_val = parse_size(self.vm_min_mem_val)
self.dom0_mem_boost_val = parse_size(self.dom0_mem_boost_val)
self.min_vm_mem.setValue(
int(self.vm_min_mem_val / 1024 / 1024))
self.dom0_mem_boost.setValue(
int(self.dom0_mem_boost_val / 1024 / 1024))
except exc.QubesException:
self.min_vm_mem.setEnabled(False)
self.dom0_mem_boost.setEnabled(False)
def __apply_mem_defaults__(self):
if not self.min_vm_mem.isEnabled() or \
not self.dom0_mem_boost.isEnabled():
return
# qmemman settings
current_min_vm_mem = self.min_vm_mem.value()
current_dom0_mem_boost = self.dom0_mem_boost.value()
if current_min_vm_mem * 1024 * 1024 != self.vm_min_mem_val or \
current_dom0_mem_boost * 1024 * 1024 != self.dom0_mem_boost_val:
current_min_vm_mem = str(current_min_vm_mem) + 'MiB'
current_dom0_mem_boost = str(current_dom0_mem_boost) + 'MiB'
if not self.qmemman_config.has_section('global'):
# add the whole section
self.qmemman_config.add_section('global')
self.qmemman_config.set(
'global', 'vm-min-mem', current_min_vm_mem)
self.qmemman_config.set(
'global', 'dom0-mem-boost', current_dom0_mem_boost)
self.qmemman_config.set(
'global', 'cache-margin-factor', str(1.3))
# removed qmemman_algo.CACHE_FACTOR
try:
qmemman_config_file = open(qmemman_config_path, 'a')
self.qmemman_config.write(qmemman_config_file)
qmemman_config_file.close()
except Exception as ex:
self.errors.append(
"Failed to set memory settings due to {}".format(
str(ex)))
else:
# If there already is a 'global' section, we don't use
# SafeConfigParser.write() - it would get rid of
# all the comments...
lines_to_add = {}
lines_to_add['vm-min-mem'] = \
"vm-min-mem = " + current_min_vm_mem + "\n"
lines_to_add['dom0-mem-boost'] = \
"dom0-mem-boost = " + current_dom0_mem_boost + "\n"
config_lines = []
try:
qmemman_config_file = open(qmemman_config_path, 'r')
except Exception as ex:
self.errors.append(
"Failed to set memory settings due to {}".format(
str(ex)))
return
for line in qmemman_config_file:
if line.strip().startswith('vm-min-mem'):
config_lines.append(lines_to_add['vm-min-mem'])
del lines_to_add['vm-min-mem']
elif line.strip().startswith('dom0-mem-boost'):
config_lines.append(lines_to_add['dom0-mem-boost'])
del lines_to_add['dom0-mem-boost']
else:
config_lines.append(line)
qmemman_config_file.close()
for line in lines_to_add:
config_lines.append(line)
try:
qmemman_config_file = open(qmemman_config_path, 'w')
qmemman_config_file.writelines(config_lines)
qmemman_config_file.close()
except Exception as ex:
self.errors.append(
"Failed to set memory settings due to {}".format(
str(ex)))
return
def __init_updates__(self):
self.updates_dom0_val = bool(
utils.get_feature(self.qubes_app.domains['dom0'],
'service.qubes-update-check',
True))
self.updates_dom0.setChecked(self.updates_dom0_val)
try:
self.updates_vm.setChecked(self.qubes_app.check_updates_vm)
except exc.QubesDaemonAccessError:
self.updates_vm.isEnabled(False)
self.enable_updates_all.clicked.connect(self.__enable_updates_all)
self.disable_updates_all.clicked.connect(self.__disable_updates_all)
self.repos = repos = dict()
try:
for i in _run_qrexec_repo('qubes.repos.List').split('\n'):
lst = i.split('\0')
# Keyed by repo name
dct = repos[lst[0]] = dict()
dct['prettyname'] = lst[1]
dct['enabled'] = lst[2] == 'enabled'
except Exception as ex:
self.dom0_updates_repo.setEnabled(False)
self.itl_tmpl_updates_repo.setEnabled(False)
self.comm_tmpl_updates_repo.setEnabled(False)
if repos['qubes-dom0-unstable']['enabled']:
self.dom0_updates_repo.setCurrentIndex(3)
elif repos['qubes-dom0-current-testing']['enabled']:
self.dom0_updates_repo.setCurrentIndex(2)
elif repos['qubes-dom0-security-testing']['enabled']:
self.dom0_updates_repo.setCurrentIndex(1)
elif repos['qubes-dom0-current']['enabled']:
self.dom0_updates_repo.setCurrentIndex(0)
else:
raise Exception(
self.tr('Cannot detect enabled dom0 update repositories'))
if repos['qubes-templates-itl-testing']['enabled']:
self.itl_tmpl_updates_repo.setCurrentIndex(1)
elif repos['qubes-templates-itl']['enabled']:
self.itl_tmpl_updates_repo.setCurrentIndex(0)
else:
raise Exception(self.tr('Cannot detect enabled ITL template update '
'repositories'))
if repos['qubes-templates-community-testing']['enabled']:
self.comm_tmpl_updates_repo.setCurrentIndex(2)
elif repos['qubes-templates-community']['enabled']:
self.comm_tmpl_updates_repo.setCurrentIndex(1)
else:
self.comm_tmpl_updates_repo.setCurrentIndex(0)
def __enable_updates_all(self):
reply = QtWidgets.QMessageBox.question(
self, self.tr("Change state of all qubes"),
self.tr("Are you sure you want to set all qubes to check "
"for updates?"),
QtWidgets.QMessageBox.Yes | QtWidgets.QMessageBox.Cancel)
if reply == QtWidgets.QMessageBox.Cancel:
return
self.__set_updates_all(True)
def __disable_updates_all(self):
reply = QtWidgets.QMessageBox.question(
self, self.tr("Change state of all qubes"),
self.tr("Are you sure you want to set all qubes to not check "
"for updates?"),
QtWidgets.QMessageBox.Yes | QtWidgets.QMessageBox.Cancel)
if reply == QtWidgets.QMessageBox.Cancel:
return
self.__set_updates_all(False)
def __set_updates_all(self, state):
errors = []
for vm in self.qubes_app.domains:
if vm.klass != "AdminVM":
try:
vm.features['service.qubes-update-check'] = state
except exc.QubesDaemonAccessError:
errors.append(vm.name)
if errors:
QtWidgets.QMessageBox.warning(
self, "Error!",
"Failed to set state for some qubes: {}".format(
", ".join(errors)))
def __apply_updates__(self):
if self.updates_dom0.isEnabled() and \
self.updates_dom0.isChecked() != self.updates_dom0_val:
try:
self.qubes_app.domains['dom0'].features[
'service.qubes-update-check'] = \
self.updates_dom0.isChecked()
except exc.QubesDaemonAccessError:
self.errors.append("Failed to change dom0 update value due "
"to insufficient permissions.")
if self.updates_vm.isEnabled() and \
self.qubes_app.check_updates_vm != self.updates_vm.isChecked():
try:
self.qubes_app.check_updates_vm = self.updates_vm.isChecked()
except exc.QubesDaemonAccessError:
self.errors.append("Failed to set qube update checking due "
"to insufficient permissions.")
def _manage_repos(self, repolist, action):
for name in repolist:
if self.repos[name]['enabled'] and action == 'Enable' or \
not self.repos[name]['enabled'] and action == 'Disable':
continue
try:
result = _run_qrexec_repo('qubes.repos.' + action, name)
if result != 'ok\n':
raise RuntimeError(
self.tr('qrexec call stdout did not contain "ok"'
' as expected'),
{'stdout': result})
except RuntimeError as ex:
msg = '{desc}; {args}'.format(desc=ex.args[0], args=', '.join(
# This is kind of hard to mentally parse but really all
# it does is pretty-print args[1], which is a dictionary
['{key}: {val}'.format(key=i[0], val=i[1]) for i in
ex.args[1].items()]
))
QtWidgets.QMessageBox.warning(
None,
self.tr("ERROR!"),
self.tr("Error managing {repo} repository settings:"
" {msg}".format(repo=name, msg=msg)))
def _handle_dom0_updates_combobox(self, idx):
idx += 1
repolist = ['qubes-dom0-current', 'qubes-dom0-security-testing',
'qubes-dom0-current-testing', 'qubes-dom0-unstable']
enable = repolist[:idx]
disable = repolist[idx:]
self._manage_repos(enable, 'Enable')
self._manage_repos(disable, 'Disable')
# pylint: disable=invalid-name
def _handle_itl_tmpl_updates_combobox(self, idx):
idx += 1
repolist = ['qubes-templates-itl', 'qubes-templates-itl-testing']
enable = repolist[:idx]
disable = repolist[idx:]
self._manage_repos(enable, 'Enable')
self._manage_repos(disable, 'Disable')
# pylint: disable=invalid-name
def _handle_comm_tmpl_updates_combobox(self, idx):
# We don't increment idx by 1 because this is the only combobox that
# has an explicit "disable this repository entirely" option
repolist = ['qubes-templates-community',
'qubes-templates-community-testing']
enable = repolist[:idx]
disable = repolist[idx:]
self._manage_repos(enable, 'Enable')
self._manage_repos(disable, 'Disable')
def __apply_repos__(self):
if self.dom0_updates_repo.isEnabled():
self._handle_dom0_updates_combobox(
self.dom0_updates_repo.currentIndex())
if self.itl_tmpl_updates_repo.isEnabled():
self._handle_itl_tmpl_updates_combobox(
self.itl_tmpl_updates_repo.currentIndex())
if self.comm_tmpl_updates_repo.isEnabled():
self._handle_comm_tmpl_updates_combobox(
self.comm_tmpl_updates_repo.currentIndex())
def reject(self):
self.done(0)
def save_and_apply(self):
self.errors = []
self.__apply_system_defaults__()
self.__apply_kernel_defaults__()
self.__apply_mem_defaults__()
self.__apply_updates__()
self.__apply_repos__()
self.__apply_gui_defaults()
if self.errors:
err_msg = "Failed to apply some settings:\n" + "\n".join(
self.errors)
QtWidgets.QMessageBox.warning(self, "Error", err_msg)
def main():
utils.run_synchronous(GlobalSettingsWindow)
if __name__ == "__main__":
main()