Source code for qubes.ext.core_features
# -*- encoding: utf-8 -*-
#
# The Qubes OS Project, http://www.qubes-os.org
#
# Copyright (C) 2017 Marek Marczykowski-Górecki
# <marmarek@invisiblethingslab.com>
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, see <https://www.gnu.org/licenses/>.
import datetime
import re
import string
import qubes.ext
_version_re = re.compile(r"[0-9]{1,3}\.[0-9]{1,3}")
[docs]
class CoreFeatures(qubes.ext.Extension):
# pylint: disable=too-few-public-methods
@qubes.ext.handler('features-request')
async def qubes_features_request(self, vm, event, untrusted_features):
'''Handle features provided by qubes-core-agent and qubes-gui-agent'''
# pylint: disable=unused-argument
if getattr(vm, 'template', None):
vm.log.warning(
'Ignoring qubes.NotifyTools for template-based VM')
return
if "os-distribution" in untrusted_features:
# entry point already validates values for safe characters
vm.features["os-distribution"] = \
untrusted_features["os-distribution"]
if "os-version" in untrusted_features:
# no letters in versions please
safe_set = string.digits + ".-"
untrusted_version = untrusted_features["os-version"]
if all(c in safe_set for c in untrusted_version) \
and untrusted_version[0].isdigit():
vm.features["os-version"] = untrusted_version
else:
# safe to log the value as passed preliminary filtering already
vm.log.warning(
"Invalid 'os-version' value '%s', must start "
"with a digit and only digits and _ or . are allowed",
untrusted_version)
if "os-eol" in untrusted_features:
untrusted_eol = untrusted_features["os-eol"]
valid = False
if re.match(r"\A\d{4}-\d{2}-\d{2}\Z", untrusted_eol):
try:
datetime.date.fromisoformat(untrusted_eol)
valid = True
except ValueError:
pass
if valid:
vm.features["os-eol"] = untrusted_eol
else:
vm.log.warning(
"Invalid 'os-eol' value '%s', expected YYYY-MM-DD",
untrusted_eol)
requested_features = {}
for feature in (
'qrexec', 'gui', 'gui-emulated', 'qubes-firewall', 'vmexec'):
untrusted_value = untrusted_features.get(feature, None)
if untrusted_value in ('1', '0'):
requested_features[feature] = bool(int(untrusted_value))
if 'qubes-agent-version' in untrusted_features:
untrusted_value = untrusted_features['qubes-agent-version']
if _version_re.fullmatch(untrusted_value):
vm.features['qubes-agent-version'] = untrusted_value
del untrusted_features
# default user for qvm-run etc
# starting with Qubes 4.x ignored
# qrexec agent presence (0 or 1)
# gui agent presence (0 or 1)
qrexec_before = vm.features.get('qrexec', False)
for feature in ('qrexec', 'gui', 'gui-emulated'):
# do not allow (Template)VM to override setting if already set
# some other way
if feature in requested_features and feature not in vm.features:
vm.features[feature] = requested_features[feature]
# those features can be freely enabled or disabled by template
for feature in ('qubes-firewall', 'vmexec'):
if feature in requested_features:
vm.features[feature] = requested_features[feature]
if not qrexec_before and vm.features.get('qrexec', False):
# if this is the first time qrexec was advertised, now can finish
# template setup
await vm.fire_event_async('template-postinstall')
def set_servicevm_feature(self, subject):
if getattr(subject, 'provides_network', False):
subject.features['servicevm'] = 1
# icon is calculated based on this feature
subject.fire_event('property-reset:icon', name='icon')
elif 'servicevm' in subject.features:
del subject.features['servicevm']
# icon is calculated based on this feature
subject.fire_event('property-reset:icon', name='icon')
@qubes.ext.handler('property-set:provides_network')
def on_property_set(self, subject, event, name, newvalue, oldvalue=None):
# pylint: disable=unused-argument
self.set_servicevm_feature(subject)
@qubes.ext.handler('property-reset:provides_network')
def on_property_reset(self, subject, event, name, oldvalue=None):
# pylint: disable=unused-argument
self.set_servicevm_feature(subject)
@qubes.ext.handler('domain-load')
def on_domain_load(self, subject, event):
# pylint: disable=unused-argument
self.set_servicevm_feature(subject)