mirror of
https://github.com/ben-grande/qusal.git
synced 2025-08-14 08:55:30 -04:00
feat: default to disposable netvm
- Default sys-net and sys-firewall to disposable; - Set global and per vm preferences by starting the qubes or shutting down them when necessary; and - Less manual steps remaining for the user: just rename the net qube, as it can only be done via Qubes Manager.
This commit is contained in:
Ben Grande
parent
8a8252d6f0
commit
0216297ee6
10 changed files with 186 additions and 59 deletions
|
|
@ -15,25 +15,26 @@ provides the state "qvm.sys-net", but it will create only "sys-net", which can
|
|||
be a disposable or not. This package takes a different approach, it will
|
||||
create an AppVM "sys-net" and a DispVM "disp-sys-net".
|
||||
|
||||
By default, the chosen one is "sys-net", but you can choose which qube type
|
||||
becomes the upstream net qube "default_netvm", the "clockvm" and the fallback
|
||||
target for the "qubes.UpdatesProxy" service in case no rule matched before.
|
||||
By default, the chosen one is "disp-sys-net", but you can choose which qube
|
||||
type becomes the upstream net qube "default_netvm" and the fallback target for
|
||||
the "qubes.UpdatesProxy" service in case no rule matched before.
|
||||
|
||||
## Installation
|
||||
|
||||
Before installation, rename your current `sys-net` to another name such as
|
||||
`sys-net-old`, the old qube will be used to install packages require for the
|
||||
template. After successful installation and testing the new net qube
|
||||
`sys-net-old`, the old qube will be used to install packages required for the
|
||||
minimal template. After successful installation and testing the new net qube
|
||||
capabilities, you can remove the old one. If you want the default net qube
|
||||
back, just set `sys-net` template to the full template you are using, such as
|
||||
Debian or Fedora.
|
||||
Debian or Fedora. Before starting, turn on the `default_netvm` and check if
|
||||
DNS is working, after that, proceed with the installation.
|
||||
|
||||
- Top:
|
||||
```sh
|
||||
qubesctl top.enable sys-net
|
||||
qubesctl --targets=tpl-sys-net state.apply
|
||||
qubesctl top.disable sys-net
|
||||
qubesctl state.apply sys-net.prefs
|
||||
qubesctl state.apply sys-net.prefs-disp
|
||||
```
|
||||
|
||||
- State:
|
||||
|
|
@ -41,7 +42,7 @@ qubesctl state.apply sys-net.prefs
|
|||
```sh
|
||||
qubesctl state.apply sys-net.create
|
||||
qubesctl --skip-dom0 --targets=tpl-sys-net state.apply sys-net.install
|
||||
qubesctl state.apply sys-net.prefs
|
||||
qubesctl state.apply sys-net.prefs-disp
|
||||
```
|
||||
<!-- pkg:end:post-install -->
|
||||
|
||||
|
|
@ -50,9 +51,9 @@ If you need to debug a net qube, install some helper tools:
|
|||
qubesctl --skip-dom0 --targets=tpl-sys-net state.apply sys-net.install-debug
|
||||
```
|
||||
|
||||
If you prefer to have a disposable net qube:
|
||||
If you prefer to have an app qube as the net qube:
|
||||
```sh
|
||||
qubesctl state.apply sys-net.prefs-disp
|
||||
qubesctl state.apply sys-net.prefs
|
||||
```
|
||||
|
||||
You might need to install some firmware on the template for your network
|
||||
|
|
|
|||
|
|
@ -6,6 +6,3 @@ SPDX-License-Identifier: AGPL-3.0-or-later
|
|||
|
||||
{% from 'utils/macros/clone-template.sls' import clone_template -%}
|
||||
{{ clone_template('debian-minimal', sls_path) }}
|
||||
|
||||
{% from 'utils/macros/clone-template.sls' import clone_template -%}
|
||||
{{ clone_template('debian', sls_path) }}
|
||||
|
|
|
|||
11
salt/sys-net/files/admin/policy/default-disp.policy
Normal file
11
salt/sys-net/files/admin/policy/default-disp.policy
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
# SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com>
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
## Do not modify this file, create a new policy with with a lower number in the
|
||||
## file name instead. For example `30-user.policy`.
|
||||
qubes.UpdatesProxy * @tag:whonix-updatevm @default allow target=sys-whonix
|
||||
qubes.UpdatesProxy * @tag:whonix-updatevm @anyvm deny
|
||||
qubes.UpdatesProxy * @type:TemplateVM @default allow target=disp-{{ sls_path }}
|
||||
qubes.UpdatesProxy * @type:TemplateVM @anyvm deny
|
||||
## vim:ft=qrexecpolicy
|
||||
|
|
@ -6,6 +6,6 @@
|
|||
## file name instead. For example `30-user.policy`.
|
||||
qubes.UpdatesProxy * @tag:whonix-updatevm @default allow target=sys-whonix
|
||||
qubes.UpdatesProxy * @tag:whonix-updatevm @anyvm deny
|
||||
qubes.UpdatesProxy * @type:TemplateVM @default allow target=disp-{{ sls_path }}
|
||||
qubes.UpdatesProxy * @type:TemplateVM @default allow target={{ sls_path }}
|
||||
qubes.UpdatesProxy * @type:TemplateVM @anyvm deny
|
||||
## vim:ft=qrexecpolicy
|
||||
|
|
|
|||
|
|
@ -4,17 +4,46 @@ SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com>
|
|||
SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
#}
|
||||
|
||||
include:
|
||||
- .create
|
||||
|
||||
{% set netvm = 'disp-' ~ slsdotpath -%}
|
||||
{% set default_netvm = salt['cmd.shell']('qubes-prefs default_netvm') -%}
|
||||
"{{ slsdotpath }}-set-{{ default_netvm }}-netvm-to-disp-{{ slsdotpath }}":
|
||||
|
||||
{% set running = 0 -%}
|
||||
{% if salt['cmd.shell']('qvm-ls --no-spinner --raw-list --running ' ~ default_netvm) == default_netvm -%}
|
||||
{% set running = 1 -%}
|
||||
{% endif -%}
|
||||
|
||||
"{{ slsdotpath }}-{{ default_netvm }}-shutdown":
|
||||
qvm.shutdown:
|
||||
- name: {{ default_netvm }}
|
||||
- flags:
|
||||
- wait
|
||||
- force
|
||||
|
||||
{% set default_netvm_netvm = salt['cmd.shell']('qvm-prefs ' ~ default_netvm ~ ' netvm') -%}
|
||||
{% if default_netvm_netvm -%}
|
||||
"{{ slsdotpath }}-{{ default_netvm_netvm }}-shutdown":
|
||||
qvm.shutdown:
|
||||
- require:
|
||||
- qvm: "{{ slsdotpath }}-{{ default_netvm }}-shutdown"
|
||||
- name: {{ default_netvm_netvm }}
|
||||
- flags:
|
||||
- wait
|
||||
- force
|
||||
{% endif -%}
|
||||
|
||||
{% from 'utils/macros/policy.sls' import policy_set_full with context -%}
|
||||
{{ policy_set_full(slsdotpath, '/etc/qubes/policy.d/80-' ~ slsdotpath ~ '.policy', 'salt://' ~ slsdotpath ~ '/files/admin/policy/default-disp.policy') }}
|
||||
|
||||
"{{ slsdotpath }}-set-{{ default_netvm }}-netvm-to-{{ netvm }}":
|
||||
qvm.vm:
|
||||
- require:
|
||||
- qvm: disp-{{ slsdotpath }}
|
||||
- qvm: "{{ slsdotpath }}-{{ default_netvm }}-shutdown"
|
||||
- name: {{ default_netvm }}
|
||||
- prefs:
|
||||
- netvm: disp-{{ slsdotpath }}
|
||||
- netvm: {{ netvm }}
|
||||
|
||||
{% from 'utils/macros/policy.sls' import policy_set with context -%}
|
||||
{{ policy_set(sls_path, '80') }}
|
||||
{% if running == 1 -%}
|
||||
"{{ slsdotpath }}-{{ default_netvm }}-start":
|
||||
qvm.start:
|
||||
- name: {{ default_netvm }}
|
||||
{% endif -%}
|
||||
|
|
|
|||
|
|
@ -4,17 +4,47 @@ SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com>
|
|||
SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
#}
|
||||
|
||||
include:
|
||||
- .create
|
||||
{% set netvm = slsdotpath -%}
|
||||
|
||||
{% set default_netvm = salt['cmd.shell']('qubes-prefs default_netvm') -%}
|
||||
"{{ slsdotpath }}-set-{{ default_netvm }}-netvm-to-{{ slsdotpath }}":
|
||||
qvm.vm:
|
||||
- require:
|
||||
- qvm: {{ slsdotpath }}
|
||||
|
||||
{% set running = 0 -%}
|
||||
{% if salt['cmd.shell']('qvm-ls --no-spinner --raw-list --running ' ~ default_netvm) == default_netvm -%}
|
||||
{% set running = 1 -%}
|
||||
{% endif -%}
|
||||
|
||||
"{{ slsdotpath }}-{{ default_netvm }}-shutdown":
|
||||
qvm.shutdown:
|
||||
- name: {{ default_netvm }}
|
||||
- prefs:
|
||||
- netvm: {{ slsdotpath }}
|
||||
- flags:
|
||||
- wait
|
||||
- force
|
||||
|
||||
{% set default_netvm_netvm = salt['cmd.shell']('qvm-prefs ' ~ default_netvm ~ ' netvm') -%}
|
||||
{% if default_netvm_netvm -%}
|
||||
"{{ slsdotpath }}-{{ default_netvm_netvm }}-shutdown":
|
||||
qvm.shutdown:
|
||||
- require:
|
||||
- qvm: "{{ slsdotpath }}-{{ default_netvm }}-shutdown"
|
||||
- name: {{ default_netvm_netvm }}
|
||||
- flags:
|
||||
- wait
|
||||
- force
|
||||
{% endif -%}
|
||||
|
||||
{% from 'utils/macros/policy.sls' import policy_set with context -%}
|
||||
{{ policy_set(sls_path, '80') }}
|
||||
|
||||
"{{ slsdotpath }}-set-{{ default_netvm }}-netvm-to-{{ netvm }}":
|
||||
qvm.vm:
|
||||
- require:
|
||||
- qvm: "{{ slsdotpath }}-{{ default_netvm }}-shutdown"
|
||||
- name: {{ default_netvm }}
|
||||
- prefs:
|
||||
- netvm: {{ netvm }}
|
||||
|
||||
{% if running == 1 -%}
|
||||
"{{ slsdotpath }}-{{ default_netvm }}-start":
|
||||
qvm.start:
|
||||
- name: {{ default_netvm }}
|
||||
{% endif -%}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue