From 91e0ed04e4422fadf6f657e2a82070993c2e2b51 Mon Sep 17 00:00:00 2001 From: Brian Duggan Date: Sat, 19 Apr 2025 15:18:53 -0400 Subject: [PATCH] Set user parameter for qubes.VMRootShell policy in README According to qubes.VMRootShell: ```bash # This is the same as qubes.VMShell. The actual difference is in qrexec policy, # which contains 'user=root' option. ``` Without the user parameter on a policy, dom0 executes the RPC as the default user: ```console mgmtvm$ echo "whoami" | qvm-run --pass-io --service workvm qubes.VMRootShell user ``` This change updates the documentation to make qubes.VMRootShell behave as intended: ```console mgmtvm$ echo "whoami" | qvm-run --pass-io --service workvm qubes.VMRootShell root ``` --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 2c43ad6..3034956 100644 --- a/README.md +++ b/README.md @@ -29,7 +29,7 @@ admin.vm.Remove * mgmtvm @tag:created-by-mgmtvm allow target=dom0 qubes.Filecopy * mgmtvm @tag:created-by-mgmtvm allow qubes.WaitForSession * mgmtvm @tag:created-by-mgmtvm allow qubes.VMShell * mgmtvm @tag:created-by-mgmtvm allow -qubes.VMRootShell * mgmtvm @tag:created-by-mgmtvm allow +qubes.VMRootShell * mgmtvm @tag:created-by-mgmtvm allow user=root ``` ### 4. Update Admin Local Read-Write policy