Git-Mirrors/qubes-doc
1
0
Fork 0
mirror of https://github.com/QubesOS/qubes-doc.git synced 2025-04-26 10:49:17 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'patch-17' of https://github.com/deeplow/qubes-doc into deeplow-patch-17

Browse Source
This commit is contained in:
Andrew David Wong 2021-06-26 06:28:21 -07:00
commit 4f26651215
No known key found for this signature in database
GPG Key ID: 8CE137352A019A17
1 changed files with 55 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

68
developer/debugging/test-bench.md
View File

@ -14,21 +14,36 @@ This guide shows how to set up simple test bench that automatically test your co
We will set up a spare machine (bare metal, not a virtual) that will be hosting our experimental Dom0. We will communicate with it via Ethernet and SSH. This tutorial assumes you are familiar with [QubesBuilder](/doc/qubes-builder/) and you have it set up and running flawlessly. We will set up a spare machine (bare metal, not a virtual) that will be hosting our experimental Dom0. We will communicate with it via Ethernet and SSH. This tutorial assumes you are familiar with [QubesBuilder](/doc/qubes-builder/) and you have it set up and running flawlessly.
## Setting up the machine > **Notice:**
> This setup intentionally weakens some security properties in the testing system. So make sure you understand the risks and use exclusively for testing.
First, do a clean install from ISO you built or grabbed elsewhere. ## Setting up the Machine
You have to fix network, because it is intentionally broken. This script should reenable your network card without depending on anything else. ### Install ISO
First, do a clean install from the `.iso` [you built](/doc/qubes-iso-building/) or grabbed elsewhere (for example [here](https://qubes-os.discourse.group/t/qubesos-4-1-alpha-signed-weekly-builds/3601))
```bash ### Enabling Network Access in Dom0
#!/bin/sh
# adjust this for your NIC (run lspci) Internet access is intentionally disabled by default in dom0. But to ease the deployment process we will give it access. The following steps should be done in `dom0`.
BDF=0000:02:00.0
prog=$(basename $0) > **Note:** the following assume you have only one network card. If you have two, pick one and leave the other attached to `sys-net`.
pciunbind() { 1. Remove the network card (PCI device) from `sys-net`
2. Restart your computer (for the removal to take effect)
3. The following script should enable your network card in dom0. *Be sure to adjust the script's variables to suit your needs.* You'll need to run this at every startup (TODO: describe how to run this at every startup).
```bash
#!/bin/sh
# adjust this for your NIC (run lspci)
BDF=0000:02:00.0
# adjust this for your network driver
DRIVER=e1000e
prog=$(basename $0)
pciunbind() {
local path local path
path=/sys/bus/pci/devices/${1}/driver/unbind path=/sys/bus/pci/devices/${1}/driver/unbind
if ! [ -w ${path} ]; then if ! [ -w ${path} ]; then
@ -36,9 +51,9 @@ pciunbind() {
return 1 return 1
fi fi
echo -n ${1} >${path} echo -n ${1} >${path}
} }
pcibind() { pcibind() {
local path local path
path=/sys/bus/pci/drivers/${2}/bind path=/sys/bus/pci/drivers/${2}/bind
if ! [ -w ${path} ]; then if ! [ -w ${path} ]; then
@ -46,25 +61,24 @@ pcibind() {
return 1 return 1
fi fi
echo ${1} >${path} echo ${1} >${path}
} }
pciunbind ${BDF} pciunbind ${BDF}
pcibind ${BDF} e1000e pcibind ${BDF} ${DRIVER}
dhclient sleep 1
``` dhclient
```
TODO: describe how to run this at every startup 4. Configure your DHCP server so your testbench gets static IP and connect your machine to your local network. You should ensure that your testbench can reach the Internet.
Now configure your DHCP server so your testbench gets static IP and connect your machine to your local network. You should ensure that your testbench can reach the Internet. 5. Install `openssh-server` on your testbench.
Install `openssh-server` on your testbench: ~~~
sudo dnf --setopt=reposdir=/etc/yum.repos.d install openssh-server
~~~
~~~ > **Note:** If you want to install additional software in dom0 and your only network card was assigned to dom0, then _instead_ of the usual `sudo qubes-dom0-update <PACKAGE>` now you run `sudo dnf --setopt=reposdir=/etc/yum.repos.d install <PACKAGE>`.
yum install openssh-server
~~~
Ensure that sudo works without password from your user account (it should by default).
## Development VM ## Development VM
@ -86,7 +100,9 @@ Host testbench
HostName 192.168.123.45 HostName 192.168.123.45
~~~ ~~~
Then connect to your testbench and paste newly generated `id_ecdsa.pub` to `.ssh/authorized_keys` on testbench so you can log in without entering password every time. #### Passwordless SSH Login
To log to your testbench without entering password every time, copy your newly generated public key (`id_ecdsa.pub`) to `~/.ssh/authorized_keys` on your testbench. You can do this easily by running this command on `qubes-dev`: `ssh-copy-id -i ~/.ssh/id_ecdsa.pub user@192.168.123.45` (substituting with the actual username address of your testbench).
### Scripting ### Scripting
@ -115,7 +131,7 @@ fi
set -e set -e
ssh testbench mkdir -p "${TMPDIR}" ssh testbench mkdir -p "${TMPDIR}"
scp "${@}" testbench:"${TMPDIR}" scp "${@}" testbench:"${TMPDIR}" || echo "check if you have 'scp' installed on your testbench"
while [ $# -gt 0 ]; do while [ $# -gt 0 ]; do
ssh testbench sudo rpm -i --replacepkgs --replacefiles "${TMPDIR}/$(basename ${1})" ssh testbench sudo rpm -i --replacepkgs --replacefiles "${TMPDIR}/$(basename ${1})"