Qubes-VM-hardening/vm-boot-protect.service

[Unit]
Description=Protect Qubes VM execution environment at startup
After=qubes-sysinit.service
Before=qubes-mount-dirs.service
ConditionPathExists=|/var/run/qubes-service/vm-boot-protect
ConditionPathExists=|/var/run/qubes-service/vm-boot-protect-root
ConditionPathExists=|/var/run/qubes-service/vm-boot-protect-cli
DefaultDependencies=false
OnFailure=shutdown.target
OnFailureJobMode=replace-irreversibly

[Service]
Type=oneshot
RemainAfterExit=no
# privdirs must begin with /rw
#Environment="privdirs=/rw/config /rw/usrlocal /rw/bind-dirs"
ExecStart=/usr/lib/qubes/init/vm-boot-protect.sh

[Install]
WantedBy=sysinit.target
Create vm-sudo-protect.service 2017-04-17 14:21:07 -04:00			`[Unit]`
Service rename to vm-boot-protect 2018-03-29 02:57:06 -04:00			`Description=Protect Qubes VM execution environment at startup`
Update vm-sudo-protect.service Should allow service to run without interference. Now supported as Qubes service `vm-sudo-protect`. 2017-04-20 19:20:25 -04:00			`After=qubes-sysinit.service`
Add parameters for Whonix Tested briefly on Whonix. Don't use 'vm-sudo-protect-root' service. 2017-04-21 11:26:55 -04:00			`Before=qubes-mount-dirs.service`
Service rename to vm-boot-protect 2018-03-29 02:57:06 -04:00			`ConditionPathExists=\|/var/run/qubes-service/vm-boot-protect`
			`ConditionPathExists=\|/var/run/qubes-service/vm-boot-protect-root`
			`ConditionPathExists=\|/var/run/qubes-service/vm-boot-protect-cli`
Add parameters for Whonix Tested briefly on Whonix. Don't use 'vm-sudo-protect-root' service. 2017-04-21 11:26:55 -04:00			`DefaultDependencies=false`
Fixes for testing. 2017-05-09 19:02:54 -04:00			`OnFailure=shutdown.target`
			`OnFailureJobMode=replace-irreversibly`
Create vm-sudo-protect.service 2017-04-17 14:21:07 -04:00
			`[Service]`
			`Type=oneshot`
			`RemainAfterExit=no`
Fix: Remove quotes from copy glob 2018-03-29 09:54:31 -04:00			`# privdirs must begin with /rw`
Improved whitelist processing 2017-05-12 05:47:53 -04:00			`#Environment="privdirs=/rw/config /rw/usrlocal /rw/bind-dirs"`
Service rename to vm-boot-protect 2018-03-29 02:57:06 -04:00			`ExecStart=/usr/lib/qubes/init/vm-boot-protect.sh`
Create vm-sudo-protect.service 2017-04-17 14:21:07 -04:00
			`[Install]`
Update vm-sudo-protect.service Should allow service to run without interference. Now supported as Qubes service `vm-sudo-protect`. 2017-04-20 19:20:25 -04:00			`WantedBy=sysinit.target`