Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Phase out legacy qrexec policy files #8000

Closed
marmarek opened this issue Jan 24, 2023 · 13 comments · Fixed by QubesOS/qubes-core-qrexec#123
Closed

Phase out legacy qrexec policy files #8000

marmarek opened this issue Jan 24, 2023 · 13 comments · Fixed by QubesOS/qubes-core-qrexec#123
Assignees
@marmarta
Labels
C: core C: mgmt P: default Priority: default. Default priority for new issues, to be replaced given sufficient information. r4.2-host-stable r4.2-vm-bookworm-stable r4.2-vm-bullseye-stable r4.2-vm-centos-stream8-stable r4.2-vm-fc37-stable r4.2-vm-fc38-stable r4.2-vm-fc39-stable release notes This issue should be mentioned in the release notes.
Milestone
Release 4.2

Comments

@marmarek
Copy link
Member

How to file a helpful issue

The problem you're addressing (if any)

Legacy qrexec policy files (those in /etc/qubes-rpc/policy) are incompatible with GUI tool for setting policy, and hard to maintain via other automation while still allowing user to modify them manually.

New policy format (in /etc/qubes/policy.d) solves those issues, but legacy files (generally, when present) take precedence, limiting its usefulness.

The solution you'd like

  1. Phase out legacy policy files in new installs
  2. Provide conversion tool for existing user-customized setups.

The value to a user, and who that user might be

More possible value from GUI tools and other automation for policy management.
@marmarek marmarek added T: enhancement C: core C: mgmt P: default Priority: default. Default priority for new issues, to be replaced given sufficient information. labels Jan 24, 2023
@marmarek marmarek added this to the Release 4.2 milestone Jan 24, 2023
marmarek added a commit to marmarek/qubes-app-linux-input-proxy that referenced this issue Jan 24, 2023
@marmarek
Drop legacy policy files
353724e 
New policy should be placed in /etc/qubes/policy.d. But don't place any
explicit defaults and rely on implicit deny by default. This way it's
easier to integrate with custom policies and GUI tools.

QubesOS/qubes-issues#8000
@marmarek marmarek mentioned this issue Jan 24, 2023
Merged
marmarek added a commit to marmarek/qubes-mgmt-salt-dom0-virtual-machines that referenced this issue Feb 2, 2023
@marmarek
Use new policy format
81eab07 
QubesOS/qubes-issues#8000
This was referenced Feb 2, 2023
Merged
Closed
marmarek added a commit to QubesOS/qubes-core-admin that referenced this issue Feb 2, 2023
@marmarek
Move policy for qubes.SyncAppMenus
8caec0a 
It doesn't make sense in qubes-core-dom0-linux package, which has
nothing to do with appmenus (anymore).

QubesOS/qubes-issues#8000
marmarek added a commit to marmarek/qubes-core-admin-linux that referenced this issue Feb 2, 2023
@marmarek
Convert policy to the new format
b94e8c6 
1. Convert qubes.ReceiveUpdates to 90-default-linux.policy
2. Move qubes.SyncAppMenus to 90-default.policy in core-admin
3. Drop qubes.repos.*, since those are "deny" by default anyway

QubesOS/qubes-issues#8000
@marmarek marmarek mentioned this issue Feb 2, 2023
Merged
marmarek added a commit to marmarek/qubes-core-admin-linux that referenced this issue Feb 2, 2023
@marmarek
Convert policy to the new format
c2dbaec 
1. Convert qubes.ReceiveUpdates to 90-default-linux.policy
2. Move qubes.SyncAppMenus to 90-default.policy in core-admin
3. Drop qubes.repos.*, since those are "deny" by default anyway

QubesOS/qubes-issues#8000
marmarek added a commit to marmarek/qubes-core-admin-linux that referenced this issue Feb 3, 2023
@marmarek
Convert policy to the new format
540864c 
1. Convert qubes.ReceiveUpdates to 90-default-linux.policy
2. Move qubes.SyncAppMenus to 90-default.policy in core-admin
3. Drop qubes.repos.*, since those are "deny" by default anyway

QubesOS/qubes-issues#8000
marmarek added a commit to marmarek/qubes-app-linux-split-gpg that referenced this issue Feb 3, 2023
@marmarek
Don't install policy on R4.2
612fcb0 
New policy editor / global config handles Split-GPG policy now, don't
get in its way.

QubesOS/qubes-issues#8000
@marmarek marmarek mentioned this issue Feb 3, 2023
Merged
marmarek added a commit to marmarek/qubes-core-admin-linux that referenced this issue Feb 3, 2023
@marmarek
Convert policy to the new format
b0304ce 
1. Convert qubes.ReceiveUpdates to 90-default-linux.policy
2. Move qubes.SyncAppMenus to 90-default.policy in core-admin
3. Drop qubes.repos.*, since those are "deny" by default anyway

QubesOS/qubes-issues#8000
This was referenced Feb 3, 2023
Closed
Closed
Closed
Closed
Closed
Closed
Closed
This was referenced Mar 4, 2023
Closed
Closed
@marmarek
Copy link
Member Author

The conversion tool should take care to not duplicate default rules, and should put user-defined rules into 30-user.policy file. The high level idea should be: if user did not modified the (old) policy, the conversion should result in no extra rules (so it will rely on 90-default.policy etc). If user have modified it, the conversion should only add those custom rules and not duplicate the default ones (as long as possible while preserving their semantics). Especially, explicit deny at the end should not be added (should rely on implicit one, or one in default rules), as long as it doesn't change the policy semantic.
The reasoning is that in R4.2 we have many GUI tools to manipulate the policy and they operate on 50- policy files. User custom rules (intentionally) take precedence, so to make the GUI tools as useful as possible, better not generate spurious custom rules.

A stretch goal is to detect policy patterns supported by GUI tools and put those into appropriate 50- policy files (for example for input proxy or split-gpg). But this need to be done carefully, as GUI global config supports only some specific rule patterns, not arbitrary rules for every service.

marmarek added a commit to marmarek/qubes-core-qrexec that referenced this issue Jul 8, 2023
@marmarek
Make policy.RegisterArgument use new policy format
349e42c 
Make it add rules into
/etc/qubes/policy.d/60-registered-arguments.policy, instead of legacy
/etc/qubes-rpc/policy.
Since the new format can have multiple rules in a single file, locking
is necessary. Do it the same way as other policy.* services, so it's
coordinated too.

QubesOS/qubes-issues#8000
@marmarek marmarek mentioned this issue Jul 8, 2023
Merged
@qubesos-bot
Copy link

Automated announcement from builder-github

The component core-qrexec (including package core-qrexec) has been pushed to the r4.2 testing repository for the Fedora template.
To test this update, please install it with the following command:

sudo dnf update --enablerepo=qubes-vm-r4.2-current-testing

Changes included in this update

marmarek added a commit to marmarek/qubes-app-linux-pdf-converter that referenced this issue Oct 12, 2023
@marmarek
Migrate to new policy format
bfe9610 
Do it when building R4.2 package only.

QubesOS/qubes-issues#8000
@marmarek marmarek mentioned this issue Oct 12, 2023
Merged
marmarek added a commit to marmarek/qubes-app-linux-pdf-converter that referenced this issue Oct 12, 2023
@marmarek
Migrate to new policy format
c1d3d73 
Do it when building R4.2 package only.

QubesOS/qubes-issues#8000
This was referenced Oct 13, 2023
Closed
Closed
@qubesos-bot
Copy link

Automated announcement from builder-github

The package core-qrexec has been pushed to the r4.2 stable repository for the CentOS centos-stream8 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

@qubesos-bot
Copy link

Automated announcement from builder-github

The package core-qrexec has been pushed to the r4.2 stable repository for the Debian template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

@qubesos-bot
Copy link

Automated announcement from builder-github

The package core-qrexec has been pushed to the r4.2 stable repository for the Debian template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

@qubesos-bot
Copy link

Automated announcement from builder-github

The component core-qrexec (including package core-qrexec) has been pushed to the r4.2 stable repository for the Fedora template.
To install this update, please use the standard update command:

sudo dnf update

Changes included in this update

@qubesos-bot
Copy link

Automated announcement from builder-github

The component core-qrexec (including package core-qrexec) has been pushed to the r4.2 stable repository for the Fedora template.
To install this update, please use the standard update command:

sudo dnf update

Changes included in this update

@qubesos-bot
Copy link

Automated announcement from builder-github

The component core-qrexec (including package core-qrexec) has been pushed to the r4.2 stable repository for the Fedora template.
To install this update, please use the standard update command:

sudo dnf update

Changes included in this update

@qubesos-bot qubesos-bot mentioned this issue Jan 7, 2024
Closed
@qubesos-bot qubesos-bot mentioned this issue Feb 5, 2024
Closed
@qubesos-bot qubesos-bot mentioned this issue Apr 18, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@marmarta marmarta

Labels
C: core C: mgmt P: default Priority: default. Default priority for new issues, to be replaced given sufficient information. r4.2-host-stable r4.2-vm-bookworm-stable r4.2-vm-bullseye-stable r4.2-vm-centos-stream8-stable r4.2-vm-fc37-stable r4.2-vm-fc38-stable r4.2-vm-fc39-stable release notes This issue should be mentioned in the release notes.
Projects
None yet
Milestone
Release 4.2
Development

Successfully merging a pull request may close this issue.

Add a tool to convert legacy policy files to new format marmarta/qubes-core-qrexec
4 participants
@marmarek @marmarta @andrewdavidwong @qubesos-bot