mirror of
https://github.com/QubesOS/qubes-doc.git
synced 2025-08-05 21:24:15 -04:00
ba399ac488
Changing `bash` lexer to `console` because it is appropriate most of the time. Then after a manual review, some lexer have been changed. I used `text` each time I was unsure, and for prompt outputs. The page `/developer/building/qubes-iso-building.rst` still need to be reviewed (look for lines starting with `$ #`). I'm not sure about the Windows pages, should we use [doscon](https://pygments.org/docs/lexers/#pygments.lexers.shell.MSDOSSessionLexer) or `powershell`? Is there an appropriate lexer for `guid.conf` content? **Statistics - Before** 870 bash 9 python 9 c 2 yaml **Statistics - After** 684 console 111 text 44 bash 16 yaml 9 systemd 9 c 8 python 4 ini 4 doscon 2 markdown 2 desktop 1 xorg.conf 1 xml+jinja 1 xml 1 kconfig 1 html This suggests that the default lexer should be `console`.
53 lines
1.8 KiB
ReStructuredText
53 lines
1.8 KiB
ReStructuredText
=================================
|
||
Passwordless root access in qubes
|
||
=================================
|
||
|
||
|
||
The rationale behind passwordless root in qubes is set out :doc:`here </user/security-in-qubes/vm-sudo>`. Implementation is by the qubes-core-agent-passwordless-root package.
|
||
|
||
This page sets out the configuration changes made, with (not necessary complete) list of mechanisms depending on each of them:
|
||
|
||
1. sudo (``/etc/sudoers.d/qubes``):
|
||
|
||
.. code:: text
|
||
|
||
Defaults !requiretty
|
||
%qubes ALL=(ALL) ROLE=unconfined_r TYPE=unconfined_t NOPASSWD: ALL
|
||
|
||
(...)
|
||
|
||
|
||
|
||
- Easy user -> root access (main option for the user).
|
||
|
||
- ``qvm-usb`` (not really working, as of R2).
|
||
|
||
|
||
|
||
2. PolicyKit (``/etc/polkit-1/rules.d/00-qubes-allow-all.rules``):
|
||
|
||
.. code:: text
|
||
|
||
//allow any action, detailed reasoning in sudoers.d/qubes
|
||
polkit.addRule(function(action,subject) { if (subject.isInGroup("qubes")) return polkit.Result.YES; });
|
||
|
||
|
||
PAM (``/etc/pam.d/su.qubes`` or ``/usr/share/pam-configs/su.qubes``) ``auth sufficient pam_succeed_if.so use_uid user ingroup qubes``
|
||
|
||
- NetworkManager configuration from normal user (``nm-applet``).
|
||
|
||
- Updates installation (``gpk-update-viewer``).
|
||
|
||
- User can use pkexec just like sudo **Note:** above is needed mostly because Qubes user GUI session isn’t treated by PolicyKit/logind as “local” session because of the way in which X server and session is started. Perhaps we will address this issue in the future, but this is really low priority. Patches welcomed anyway.
|
||
|
||
|
||
|
||
3. Empty root password:
|
||
|
||
- Used for access to ‘root’ account from text console (``qvm-console-dispvm``) - the only way to access the VM when GUI isn’t working.
|
||
|
||
- Can be used for easy ‘su -’ from user to root.
|
||
|
||
|
||
|
||
|