Skip to content

Support additional policy directories#134

Merged
marmarek merged 2 commits into
QubesOS:mainfrom
DemiMarie:runtime-policy-dir
Sep 25, 2024
Merged

Support additional policy directories#134
marmarek merged 2 commits into
QubesOS:mainfrom
DemiMarie:runtime-policy-dir

Conversation

@DemiMarie

@DemiMarie DemiMarie commented Jan 13, 2024 •
edited
Loading

Copy link
Copy Markdown
Contributor

This allows multiple directories to contain qrexec policy, which allows for transient policy that disappears on reboot.

Fixes: QubesOS/qubes-issues#8513

@DemiMarie
DemiMarie force-pushed the runtime-policy-dir branch 5 times, most recently from 69f5fe1 to 23d87ef Compare January 14, 2024 03:59
@DemiMarie
DemiMarie force-pushed the runtime-policy-dir branch from db6f542 to 1f83e62 Compare March 14, 2024 20:51
@deeplow

deeplow commented May 6, 2024

Copy link
Copy Markdown

There has been some community demand for having user directory on the user's home to ease backup and restore. Would this be a good place / timing to consider it?

@marmarek

marmarek commented May 6, 2024

Copy link
Copy Markdown
Member

I don't think keeping (some) policy in user home is a good idea. Better approach is to extend backup to include additional files/directories.

@deeplow

deeplow commented May 6, 2024

Copy link
Copy Markdown

I agree that's the correct approach. I was thinking here more pragmatically as to what could help users in the short-term, since policy backups will need careful consideration.

@marmarek

marmarek commented Jun 27, 2024

Copy link
Copy Markdown
Member

This needs a rebase now (probably simply dropping the 0bc884a commit, as #160 got merged)

@DemiMarie
DemiMarie force-pushed the runtime-policy-dir branch from 1f83e62 to 1d301f4 Compare June 27, 2024 15:42
@marmarek

marmarek commented Jun 27, 2024

Copy link
Copy Markdown
Member

Pylint complains, looks like an import got lost in rebase.

@DemiMarie
DemiMarie force-pushed the runtime-policy-dir branch from 1d301f4 to 820b383 Compare June 27, 2024 21:48
@codecov

codecov Bot commented Jun 27, 2024 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

Attention: Patch coverage is 93.33333% with 8 lines in your changes missing coverage. Please review.

Project coverage is 78.08%. Comparing base (60b54a6) to head (966e383).
Report is 17 commits behind head on main.

Files with missing lines Patch % Lines
qrexec/policy/parser.py 89.47% 4 Missing ⚠️
qrexec/tools/qrexec_policy_daemon.py 33.33% 2 Missing ⚠️
qrexec/tools/qrexec_legacy_convert.py 0.00% 1 Missing ⚠️
qrexec/tools/qrexec_policy_exec.py 83.33% 1 Missing ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main     #134      +/-   ##
==========================================
+ Coverage   77.99%   78.08%   +0.09%     
==========================================
  Files          54       54              
  Lines        9664     9718      +54     
==========================================
+ Hits         7537     7588      +51     
- Misses       2127     2130       +3

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@marmarek

marmarek commented Jun 28, 2024

Copy link
Copy Markdown
Member

A conflict on tests...

DemiMarie added 2 commits June 28, 2024 21:51
@DemiMarie
Support additional policy directories
f2ed5fb 
This allows multiple directories to contain qrexec policy, which allows
for transient policy that disappears on reboot.

Fixes: QubesOS/qubes-issues#8513
@DemiMarie
Use fully-qualified exception names in .pylintrc
966e383 
This avoids a deprecation warning from pylint.  Also fix an incorrect
comment.
@DemiMarie
DemiMarie force-pushed the runtime-policy-dir branch from 820b383 to 966e383 Compare June 29, 2024 01:51
This was referenced Jul 3, 2024
Merged
Merged
Merged
Merged
@qubesos-bot

qubesos-bot commented Jul 3, 2024 •
edited
Loading

Copy link
Copy Markdown

OpenQA test summary

Complete test suite and dependencies: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2024072115-4.3&flavor=pull-requests

Test run included the following:

New failures, excluding unstable

Compared to: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2024070519-4.3&flavor=update

Failed tests

63 failures

Fixed failures

Compared to: https://openqa.qubes-os.org/tests/105374#dependencies

4 fixed

Unstable tests

Details

  • system_tests_basic_vm_qrexec_gui

    TC_20_AudioVM_Pulse_whonix-workstation-17/test_220_audio_play_pulseaudio (1/5 times with errors)
    • job 103642 AssertionError: too short audio, expected 10s, got 8.64043083900226...
    TC_20_AudioVM_Pulse_whonix-workstation-17/test_221_audio_rec_muted_pulseaudio (1/5 times with errors)
    • job 103642 Cannot process volume group qubes_dom0...

  • system_tests_splitgpg

    TC_10_Thunderbird_debian-12-xfce/test_010_send_receive_inline_signed_only (1/5 times with errors)
    • job 105472 dogtail.tree.SearchError: descendent of [application | Thunderbird]...

  • system_tests_extra

    TC_00_QVCTest_debian-12-xfce/test_020_webcam (1/5 times with errors)
    • job 104728 AssertionError: 'qubes-video-companion webcam' exited early (0): b'...
    TC_00_QVCTest_fedora-40-xfce/test_020_webcam (3/5 times with errors)
    • job 105464 AssertionError: 'qubes-video-companion webcam' exited early (0): b'...
    • job 105868 AssertionError: 'qubes-video-companion webcam' exited early (0): b'...
    • job 106579 AssertionError: 'qubes-video-companion webcam' exited early (0): b'...
    TC_00_QVCTest_whonix-gateway-17/test_020_webcam (4/5 times with errors)
    • job 103649 self.assertNotEqual(vm.run('test -e /dev/vid... AssertionError: 0 == 0
    • job 105464 AssertionError: 'qubes-video-companion webcam' exited early (0): b'...
    • job 105868 AssertionError: 'qubes-video-companion webcam' exited early (0): b'...
    • job 106579 self.assertNotEqual(vm.run('test -e /dev/vid... AssertionError: 0 == 0
    TC_00_QVCTest_whonix-workstation-17/test_020_webcam (4/5 times with errors)
    • job 103649 AssertionError: 'qubes-video-companion webcam' exited early (0): b'...
    • job 105464 AssertionError: 'qubes-video-companion webcam' exited early (0): b'...
    • job 105868 AssertionError: 'qubes-video-companion webcam' exited early (0): b'...
    • job 106579 self.assertNotEqual(vm.run('test -e /dev/vid... AssertionError: 0 == 0

  • system_tests_usbproxy

    TC_20_USBProxy_core3_fedora-40-xfce/test_070_attach_not_installed_front (1/5 times with errors)
    • job 105442 qubesusbproxy.core3ext.QubesUSBException: Device attach failed: 202...

  • system_tests_network_updates

    TC_11_QvmTemplateMgmtVM_debian-12-xfce/test_000_template_list (1/5 times with errors)
    • job 105469 AssertionError: libvirt event impl drain timeout
    TC_10_QvmTemplate_whonix-gateway-17/test_010_template_install (2/5 times with errors)
    • job 103656 AssertionError: libvirt event impl drain timeout
    • job 105873 AssertionError: libvirt event impl drain timeout
    VmUpdates_debian-12-xfce/test_020_updates_available_notification (1/5 times with errors)
    • job 104735 subprocess.CalledProcessError: Command '/usr/lib/qubes/upgrades-sta...
    VmUpdates_debian-12-xfce/test_110_update_via_proxy_qubes_vm_update (1/5 times with errors)
    • job 104735 AssertionError: 1 not found in [0] : dpkg -l test-pkg | grep 1.1: b''
    VmUpdates_fedora-40-xfce/test_110_update_via_proxy_qubes_vm_update (1/5 times with errors)
    • job 104735 AssertionError: 1 not found in [0, 100] : rpm -q test-pkg | grep 1....
    VmUpdates_debian-12-xfce/test_111_update_via_proxy_qubes_vm_update_cli (1/5 times with errors)
    • job 104735 AssertionError: 1 not found in [0] : dpkg -l test-pkg | grep 1.1: b''
    VmUpdates_fedora-40-xfce/test_111_update_via_proxy_qubes_vm_update_cli (1/5 times with errors)
    • job 104735 AssertionError: 1 not found in [0, 100] : rpm -q test-pkg | grep 1....
    VmUpdates_debian-12-xfce/test_130_no_network_qubes_vm_update (1/5 times with errors)
    • job 104735 AssertionError: qubes-vm-update return unexpected code: 0 in (1, 2, 5)
    VmUpdates_fedora-40-xfce/test_130_no_network_qubes_vm_update (1/5 times with errors)
    • job 104735 AssertionError: qubes-vm-update return unexpected code: 0 in (1, 2, 5)
    VmUpdates_debian-12-xfce/test_131_no_network_qubes_vm_update_cli (1/5 times with errors)
    • job 104735 AssertionError: qubes-vm-update return unexpected code: 0 in (1, 2, 5)
    VmUpdates_fedora-40-xfce/test_131_no_network_qubes_vm_update_cli (1/5 times with errors)
    • job 104735 AssertionError: qubes-vm-update return unexpected code: 0 in (1, 2, 5)

  • system_tests_basic_vm_qrexec_gui_zfs

    TC_20_AudioVM_Pulse_debian-12-xfce-pool/test_223_audio_play_hvm (1/5 times with errors)
    • job 103646 AssertionError: only silence detected, no useful audio data

  • system_tests_basic_vm_qrexec_gui@hw1

    TC_20_AudioVM_Pulse_whonix-workstation-17/test_220_audio_play_pulseaudio (1/5 times with errors)
    • job 103642 AssertionError: too short audio, expected 10s, got 8.64043083900226...
    TC_20_AudioVM_Pulse_whonix-workstation-17/test_221_audio_rec_muted_pulseaudio (1/5 times with errors)
    • job 103642 Cannot process volume group qubes_dom0...

This was referenced Jul 3, 2024
Merged
Merged
This was referenced Jul 3, 2024
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
@ben-grande ben-grande mentioned this pull request Jul 10, 2024
Closed
This was referenced Jul 17, 2024
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Closed
marmarek
marmarek approved these changes Jul 19, 2024
View reviewed changes

@marmarek marmarek left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR is okay, but there needs to be matching documentation update, especially including info about extra directory, precedence order, behavior of same-named files, and how include interacts with it

This was referenced Jul 21, 2024
Merged
Merged
@marmarek

marmarek commented Sep 13, 2024

Copy link
Copy Markdown
Member

ping (doc update)?

@DemiMarie

DemiMarie commented Sep 15, 2024

Copy link
Copy Markdown
Contributor Author

@marmarek: QubesOS/qubes-doc#1427

@marmarek
marmarek merged commit 692209c into QubesOS:main Sep 25, 2024
@DemiMarie
DemiMarie deleted the runtime-policy-dir branch September 26, 2024 00:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@marmarek marmarek marmarek approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Provide a directory in /run for temporary qrexec policy

4 participants

@DemiMarie @deeplow @marmarek @qubesos-bot