ManagementVM support#35
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #35 +/- ##
=======================================
Coverage 83.72% 83.72%
=======================================
Files 1 1
Lines 215 215
=======================================
Hits 180 180
Misses 35 35
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
94f72a4 to
d21a98d
Compare
5a05c0c to
889511d
Compare
|
openQArun TEST=system_tests_gpu_passthrough |
OpenQA test summaryComplete test suite and dependencies: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2026053102-devel&flavor=pull-requests Test run included the following:
New failures, excluding unstableCompared to: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2026050504-devel&flavor=update
Failed tests56 failures
Fixed failuresCompared to: https://openqa.qubes-os.org/tests/176874#dependencies 21 fixed
Unstable testsDetails
Performance TestsPerformance degradation:26 performance degradations
Remaining performance tests:85 tests
|
|
|
||
| Requires: ansible | ||
| Requires: qubes-core-admin-client | ||
| Obsoletes: qubes-ansible-dom0 |
There was a problem hiding this comment.
This should have a version (< 1.3.2?) and there needs to be also Provides: qubes-ansible-dom0 for clean update and so installing qubes-ansible-dom0 keeps working.
This BTW is due to missing Provides: part. |
|
Hi @Andrea-Kuhn,
For 1: are you sure of your qube's name in the policy? The error is
about a denied policy for the qube "qubes-ansible" but your policy file
allows qrexec calls for "mgmtvm".
For 2: good point, I've added the new packages (qubes-ansible,
qubes-ansible-vm, qubes-ansible-admin) for Debian :)
…
*Andrea-Kuhn* left a comment (QubesOS/qubes-ansible#35)
<#35 (comment)>
Hey Hi All, I built all the packages with this changes included using
qubes-builderv2.
I've couple of questions. most likely I'm doing something wrong or
don't fully understand how it's supposed to work. and I can wait till
it gets GA with all the proper documents. But if you can answer these
that would be great.
1. when I'm trying to run a playbook from domU |qubes-ansible| AppVM
it is failing with policy denied for |admin.vm.List| not allowed
for |qubes-ansble| isn't it supposed to run this through mgmt vm?
I don't even see mgmt dispVM starting
my policies ->
|/etc/qubes/policy.d/30-mgmtvm.policy|
|## Ansible # Qubes Management admin.vm.Create.AppVM * mgmtvm dom0
allow admin.vm.Create.StandaloneVM * mgmtvm dom0 allow
admin.vm.Create.TemplateVM * mgmtvm dom0 allow admin.vm.property.Get *
mgmtvm @tag:created-by-mgmtvm allow target=dom0 # Proxy Plugin
admin.vm.Create.DispVM +default-mgmt-dvm mgmtvm dom0 allow
admin.vm.property.Get +label mgmtvm default-mgmt-dvmallow target=dom0
ansible.CreateManagementPolicies * mgmtvm @tag:created-by-mgmtvm allow
target=dom0 ansible.RemoveManagementPolicies * mgmtvm
@tag:created-by-mgmtvm allow target=dom0 ansible.WaitForCleanup *
mgmtvm @tag:created-by-mgmtvm allow target=dom0 qubes.AnsibleVM *
mgmtvm @tag:created-by-mgmtvm allow qubes.FileCopy * mgmtvm
@tag:created-by-mgmtvm allow |
|/etc/qubes/policy.d/include/admin-local-rwx|
|mgmtvm @tag:created-by-mgmtvm allow target=dom0 mgmtvm mgmtvm allow
target=dom0 |
|/etc/qubes/policy.d/include/admin-global-ro|
|#Ansible mgmtvm @adminvm allow target=dom0 mgmtvm
@tag:created-by-mgmtvm allow target=dom0 mgmtvm mgmtvm allow target=dom0 |
playbook
---
-hosts:localhost
strategy:qubesos.security.qubes_proxy
tasks:
# - name: test
# qubesos.core.command:
# command: createinventory
-name:Create a test qube
qubesos.core.qube:
name:testqube
state:present
template:"debian-12-xfce"
error ->
|PLAY [localhost]
*************************************************************** TASK
[Gathering Facts]
********************************************************* ok:
[localhost] TASK [Create a test qube]
****************************************************** An exception
occurred during task execution. To see the full traceback, use -vvv.
The error was: qubesadmin.exc.QubesDaemonAccessError: Service call
error: Request refused fatal: [localhost]: FAILED! => {"changed":
false, "module_stderr": "Traceback (most recent call last):\n File
\"/home/user/.ansible/tmp/ansible-tmp-1777903123.2660956-309234-268726384044453/AnsiballZ_qube.py\",
line 107, in <module>\n _ansiballz_main()\n ~~~~~~~~~~~~~~~^^\n File
\"/home/user/.ansible/tmp/ansible-tmp-1777903123.2660956-309234-268726384044453/AnsiballZ_qube.py\",
line 99, in _ansiballz_main\n invoke_module(zipped_mod, temp_path,
ANSIBALLZ_PARAMS)\n
~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n File
\"/home/user/.ansible/tmp/ansible-tmp-1777903123.2660956-309234-268726384044453/AnsiballZ_qube.py\",
line 47, in invoke_module\n
runpy.run_module(mod_name='ansible_collections.qubesos.core.plugins.modules.qube',
init_globals=dict(_module_fqn='ansible_collections.qubesos.core.plugins.modules.qube',
_modlib_path=modlib_path),\n
~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n
run_name='__main__', alter_sys=True)\n
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n File \"<frozen runpy>\", line
226, in run_module\n File \"<frozen runpy>\", line 98, in
_run_module_code\n File \"<frozen runpy>\", line 88, in _run_code\n
File
\"/tmp/ansible_qubesos.core.qube_payload_y5vwt35d/ansible_qubesos.core.qube_payload.zip/ansible_collections/qubesos/core/plugins/modules/qube.py\",
line 265, in <module>\n File
\"/tmp/ansible_qubesos.core.qube_payload_y5vwt35d/ansible_qubesos.core.qube_payload.zip/ansible_collections/qubesos/core/plugins/module_utils/qubes_module_qube.py\",
line 633, in main\n File
\"/tmp/ansible_qubesos.core.qube_payload_y5vwt35d/ansible_qubesos.core.qube_payload.zip/ansible_collections/qubesos/core/plugins/module_utils/qubes_module_qube.py\",
line 81, in __init__\n File
\"/usr/lib/python3.13/site-packages/qubesadmin/app.py\", line 136, in
get\n return self[item]\n ~~~~^^^^^^\n File
\"/usr/lib/python3.13/site-packages/qubesadmin/app.py\", line 107, in
__getitem__\n if not self.app.blind_mode and item not in self:\n
^^^^^^^^^^^^^^^^\n File
\"/usr/lib/python3.13/site-packages/qubesadmin/app.py\", line 143, in
__contains__\n self.refresh_cache()\n ~~~~~~~~~~~~~~~~~~^^\n File
\"/usr/lib/python3.13/site-packages/qubesadmin/app.py\", line 73, in
refresh_cache\n vm_list_data = self.app.qubesd_call(\"dom0\",
\"admin.vm.List\")\n File
\"/usr/lib/python3.13/site-packages/qubesadmin/app.py\", line 1023, in
qubesd_call\n raise qubesadmin.exc.QubesDaemonAccessError(\n \"Service
call error: %s\", stderr.decode()\n
)\nqubesadmin.exc.QubesDaemonAccessError: Service call error: Request
refused\n\n", "module_stdout": "", "msg": "MODULE FAILURE: No start of
json char found\nSee stdout/stderr for the exact error", "rc": 1} PLAY
RECAP
*********************************************************************
localhost : ok=1 changed=0 unreachable=0 failed=1 skipped=0 rescued=0
ignored=0 |
dom0 Journalctl
May 04 19:28:43 dom0 qrexec-policy-daemon[3570]: qrexec:
admin.vm.List: qubes-ansible -> dom0: denied: no matching rule found
2. qubes builder is not qubes-ansible-admin for debian vms is this
expected?
Screenshot_2026-05-03_21-48-50.png (view on web)
<https://github.com/user-attachments/assets/2db49466-ae7a-4c90-8028-65f339620a27>
—
Reply to this email directly, view it on GitHub
<#35 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ABJQ6FMJGRD2TDWJMPOKFWD4ZCPQLAVCNFSM6AAAAACXWBBOF6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DGNZRGY4TCMZZHE>.
Triage notifications on the go with GitHub Mobile for iOS
<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675>
or Android
<https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
f2f6986 to
b73a20c
Compare
|
Test fails on the new service, but unfortunately, I don't see stderr included in the CI output :( |
…admin package for VMs
|
A last minute change broke the new service call from mgmtvm... That's fixed and I rebased all the commits |
5 participants
Provides support for a ManagementVM qube.
This PR contains several fixes in the qubes proxy making it compatible with a ManagementVM:
/usr/bin/qrexec-client(dom0) or/usr/bin/qrexec-client-vm(qube)/usr/lib/qubes/qfile-dom0-agent(dom0) or/usr/lib/qubes/qfile-agent(qube)ansible.CreateManagementPolicies: Creates policies under/run/qubes/policy.d/30-qubes-ansible.policyansible.RemoveManagementPolicies: Remove policies from/run/qubes/policy.d/30-qubes-ansible.policy/usr/lib/qubes/qubes-rpc/qubes-ansible-manage-policiesqubes-ansiblepackage includes thequbesos.securitycollection preventing installation of ansible modules without the proxy (Fixes qubes-ansible: It's easy to accidentally not usequbes_proxyin dom0 qubes-issues#10414). This package also includes services files.qubes-ansible-dom0has been renamed toqubes-ansible-admin. It contains thequbesos.securitycollection and is intended for use on a Management qube.