Git-Mirrors/qubes-doc
1
0
Fork 0
mirror of https://github.com/QubesOS/qubes-doc.git synced 2024-10-01 01:25:40 -04:00
Code Issues Packages Projects Releases Wiki Activity

SoftwareUpdateVM changed

Browse Source 
Correct inaccuracies and handicapped logic in the last edit
This commit is contained in:
Joanna Rutkowska 2013-12-05 10:18:50 +00:00
parent cf62390cc1
commit 2b57710fbb
1 changed files with 1 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
SoftwareUpdateVM.md
View File

@ -89,6 +89,4 @@ qvm-create <vmname> --template <templatename> --label <label>
Temporarily allowing networking for software installation
---------------------------------------------------------
Some applications cannot be installed using the standard yum repositories, and need to be manually downloaded and installed. These applications are less secure. So it is recommended to install them only in a Standalone VM.
When the installation requires internet connection to access repositories, it will not complete because Standalone VM firewall rules only allow connection to standard yum repositories. So it is necessary to modify firewall rules to allow internet access. Of course, as soon as software installation is completed, firewall rules should be returned to the default state.
Some 3rd party applications cannot be installed using the standard yum repositories, and need to be manually downloaded and installed. When the installation requires internet connection to access 3rd party repositories, it will naturally fail when run in a Template VM because the default firewall rules for templates only allow connections to standard yum repositories. So it is necessary to modify firewall rules to allow less restrictive internet access for the time of the installation, if one really wants to install those applications into a template. As soon as software installation is completed, firewall rules should be returned back to the default state. The user should decided by themselves whether such 3rd party applications should be equally trusted as the ones that come from the standard Fedora signed repositories and whether their installation will not compromise the default Template VM, and potentially consider installing them into a separate template or a standalone VM (in which case the problem of limited networking access doesn't apply by default), as described above.