qusal/salt/qubes-builder/files/admin/policy/default.policy
Ben Grande ba5b4813f2
fix: signature check breaks qubes-builder update
The state module git.latest does not allow setting environment variable
for us to set the correct GNUPGHOME. The module environ.set does not
work as we call git as the normal user and not as root, but may still be
the problem of git.latest not respecting environment variables.

The problem with always pulling new commits is that it may conflict with
the current work the user has done on the repository locally. It will
also not work in case the last commit is not signed by a trusted key
deployed by the formula, in this case, you should add the key manually
to verify the commit.

Setting the gpg.program only for the required repositories solves the
aforementioned problem and also enhances usability by removing extra
commands that the user needs to learn and remember.

Fixes: https://github.com/ben-grande/qusal/issues/58
2024-06-14 19:11:16 +02:00

31 lines
1.5 KiB
Plaintext

# SPDX-FileCopyrightText: 2023 The Qubes OS Project <https://www.qubes-os.org>
# SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
#
# SPDX-License-Identifier: GPL-2.0-only
## Do not modify this file, create a new policy with with a lower number in the
## file name instead. For example `30-user.policy`.
## TODO: split-gpg2 configuration for isolated_gnupghomedirs.
qubes.Gpg2 * {{ sls_path }} @default allow target=sys-pgp
qusal.GitInit +qubes-builder {{ sls_path }} @default allow target=sys-git
qusal.GitFetch +qubes-builder {{ sls_path }} @default allow target=sys-git
qusal.GitPush +qubes-builder {{ sls_path }} @default ask target=sys-git default_target=sys-git
qusal.SshAgent +qubes-builder {{ sls_path }} @default allow target=sys-ssh-agent
qusal.SshAgent +qubes-builder {{ sls_path }} @anyvm deny
admin.vm.CreateDisposable * {{ sls_path }} dom0 allow
admin.vm.CreateDisposable * {{ sls_path }} dvm-qubes-builder allow target=dom0
admin.vm.Start * {{ sls_path }} @tag:disp-created-by-{{ sls_path }} allow target=dom0
admin.vm.Kill * {{ sls_path }} @tag:disp-created-by-{{ sls_path }} allow target=dom0
qubesbuilder.FileCopyIn * {{ sls_path }} @tag:disp-created-by-{{ sls_path }} allow
qubesbuilder.FileCopyOut * {{ sls_path }} @tag:disp-created-by-{{ sls_path }} allow
qubes.Filecopy * {{ sls_path }} @tag:disp-created-by-{{ sls_path }} allow
qubes.WaitForSession * {{ sls_path }} @tag:disp-created-by-{{ sls_path }} allow
qubes.VMShell * {{ sls_path }} @tag:disp-created-by-{{ sls_path }} allow
## vim:ft=qrexecpolicy