From 7c27798b8a4da84ae88b3548c18730de9e0b5767 Mon Sep 17 00:00:00 2001 From: Federico Justus Denkena Date: Thu, 5 Dec 2024 14:21:14 +0100 Subject: [PATCH] app-emulation/qubes-core-agent-linux: new package, add 4.2.38, 4.3.12 Signed-off-by: Federico Justus Denkena --- app-emulation/qubes-core-agent-linux/Manifest | 3 + .../files/qubes-ensure-lib-modules.service | 19 + .../qubes-core-agent-linux-4.2.38.ebuild | 440 ++++++++++++++++++ .../qubes-core-agent-linux-4.3.12.ebuild | 440 ++++++++++++++++++ 4 files changed, 902 insertions(+) create mode 100644 app-emulation/qubes-core-agent-linux/Manifest create mode 100644 app-emulation/qubes-core-agent-linux/files/qubes-ensure-lib-modules.service create mode 100644 app-emulation/qubes-core-agent-linux/qubes-core-agent-linux-4.2.38.ebuild create mode 100644 app-emulation/qubes-core-agent-linux/qubes-core-agent-linux-4.3.12.ebuild diff --git a/app-emulation/qubes-core-agent-linux/Manifest b/app-emulation/qubes-core-agent-linux/Manifest new file mode 100644 index 0000000..766fcf2 --- /dev/null +++ b/app-emulation/qubes-core-agent-linux/Manifest @@ -0,0 +1,3 @@ +AUX qubes-ensure-lib-modules.service 430 BLAKE2B 454043bc962b1d541229002cb3649331f1b03787ef440745d70dd7013978eea2e88b122625ae4bad06ba17ad82d4160c3238d0e4883d76d99674d0bdce8fb512 SHA512 e8660d2daeefc263fb00a05ae50f34b484525a2489164fe8a84b3b92fa43fe3cfade8ce7f2a6691712ff59d326c09b0c453c7b69873d13f8a907b7efef135bf1 +EBUILD qubes-core-agent-linux-4.2.38.ebuild 12797 BLAKE2B e1583c90470893c0a18931a0071d3dcdc9aaa938f37901533ce955107c1d93e9bc93dac6da1ea72a39b3ad1e0ecbf74de871b11707639dc0f743121e4f1e6c71 SHA512 7252f140838f830cc88100b7e83d4ba8833aaa6402ce6644cdba6ad150f8384a2e90012622b2a997b0ad773c69f7dd1e32b8b102af4e5065096b9482330461f0 +EBUILD qubes-core-agent-linux-4.3.12.ebuild 12797 BLAKE2B e1583c90470893c0a18931a0071d3dcdc9aaa938f37901533ce955107c1d93e9bc93dac6da1ea72a39b3ad1e0ecbf74de871b11707639dc0f743121e4f1e6c71 SHA512 7252f140838f830cc88100b7e83d4ba8833aaa6402ce6644cdba6ad150f8384a2e90012622b2a997b0ad773c69f7dd1e32b8b102af4e5065096b9482330461f0 diff --git a/app-emulation/qubes-core-agent-linux/files/qubes-ensure-lib-modules.service b/app-emulation/qubes-core-agent-linux/files/qubes-ensure-lib-modules.service new file mode 100644 index 0000000..ea9cb26 --- /dev/null +++ b/app-emulation/qubes-core-agent-linux/files/qubes-ensure-lib-modules.service @@ -0,0 +1,19 @@ +[Unit] +Description=Qubes verification of /usr/lib/modules +DefaultDependencies=no +Documentation= +ConditionPathExists=/dev/xvdd +Before=systemd-modules-load.service +Before=systemd-udevd.service +Before=local-fs-pre.target +After=systemd-remount-fs.service +ConditionPathExists=!/usr/lib/modules/lost+found + +[Service] +Type=oneshot +ExecStart=/bin/mount /dev/xvdd /usr/lib/modules +StandardOutput=syslog + +[Install] +WantedBy=sysinit.target + diff --git a/app-emulation/qubes-core-agent-linux/qubes-core-agent-linux-4.2.38.ebuild b/app-emulation/qubes-core-agent-linux/qubes-core-agent-linux-4.2.38.ebuild new file mode 100644 index 0000000..a1677d1 --- /dev/null +++ b/app-emulation/qubes-core-agent-linux/qubes-core-agent-linux-4.2.38.ebuild @@ -0,0 +1,440 @@ +# Maintainer: Frédéric Pierret + +EAPI=7 + +PYTHON_COMPAT=( python3_{10..13} ) + +inherit git-r3 multilib distutils-r1 qubes + +if [[ ${PV} == *9999 ]]; then + EGIT_COMMIT=HEAD +else + EGIT_COMMIT="v${PV}" +fi + +EGIT_REPO_URI="https://github.com/QubesOS/qubes-core-agent-linux.git" + +KEYWORDS="amd64" +DESCRIPTION="The Qubes core files for installation inside a Qubes VM" +HOMEPAGE="http://www.qubes-os.org" +LICENSE="GPL-2" + +SLOT="0" +IUSE="nautilus networking network-manager passwordless-root pandoc-bin" + +DEPEND="app-emulation/qubes-libvchan-xen + app-emulation/qubes-db + app-emulation/qubes-utils + net-misc/socat + x11-misc/notification-daemon + x11-misc/xdg-utils + sys-apps/gentoo-systemd-integration + gnome-extra/zenity + pandoc-bin? ( + app-text/pandoc-bin + ) + !pandoc-bin? ( + app-text/pandoc + ) + networking? ( + sys-apps/ethtool + sys-apps/net-tools + net-firewall/iptables + net-proxy/tinyproxy + + network-manager? ( + net-misc/networkmanager + net-firewall/nftables + ) + ) + nautilus? ( + dev-python/nautilus-python + ) + ${PYTHON_DEPS} + " +RDEPEND="${DEPEND}" +PDEPEND="" + +src_prepare() { + qubes_verify_sources_git "${EGIT_COMMIT}" + + default +} + +src_compile() { + # Fix PAM + sed -i 's/postlogin/system-auth/g' passwordless-root/pam.d_su.qubes + + # Fix modules-load.d path + sed -i 's|$(SYSLIBDIR)/modules-load.d|$(LIBDIR)/modules-load.d|g' Makefile + + # Fix for network tools paths + sed -i 's:/sbin/ifconfig:/bin/ifconfig:g' network/* + sed -i 's:/sbin/route:/bin/route:g' network/* + sed -i 's:/sbin/ethtool:/usr/sbin/ethtool:g' network/* + sed -i 's:/sbin/ip:/bin/ip:g' network/* + + myopt="${myopt} DESTDIR="${D}" SYSTEMD=1 BACKEND_VMM=xen" + for dir in qubes-rpc misc; do + emake ${myopt} -C "$dir" + done +} + +src_install() { + emake ${myopt} install-corevm + emake ${myopt} -C app-menu install + emake ${myopt} -C filesystem install + emake ${myopt} -C misc install + emake ${myopt} -C qubes-rpc install + emake ${myopt} -C package-managers install + if use passwordless-root; then + emake ${myopt} -C passwordless-root install + fi + if use nautilus; then + emake ${myopt} -C qubes-rpc/nautilus install + fi + + if use networking; then + if use network-manager; then + emake ${myopt} install-netvm + fi + emake ${myopt} -C network install + emake ${myopt} install-networking + fi + + insopts -m 0644 + insinto /usr/lib/systemd/system/ + doins "${FILESDIR}"/qubes-ensure-lib-modules.service + + # Remove things unwanted in Gentoo + ${myopt} rm -r "$DESTDIR/etc/yum"* + ${myopt} rm -r "$DESTDIR/etc/dnf"* + ${myopt} rm -r "$DESTDIR/etc/init.d" +} + +pkg_preinst() { + update_default_user + + mkdir -p /var/lib/qubes + + if [ -e /etc/fstab ]; then + mv /etc/fstab /var/lib/qubes/fstab.orig + fi + + usermod -L root + usermod -L user +} + +pkg_postinst() { + update_qubesconfig + + mkdir -p /usr/lib/modules + ln -sf /usr/lib/modules /lib/ + systemctl enable qubes-ensure-lib-modules.service + + if [ -e /etc/init/serial.conf ] && ! [ -f /var/lib/qubes/serial.orig ]; then + cp /etc/init/serial.conf /var/lib/qubes/serial.orig + fi + + # Remove most of the udev scripts to speed up the VM boot time + # Just leave the xen* scripts, that are needed if this VM was + # ever used as a net backend (e.g. as a VPN domain in the future) + mkdir -p /var/lib/qubes/removed-udev-scripts + for f in /etc/udev/rules.d/* + do + if [ "$(basename "$f")" == "xen-backend.rules" ]; then + continue + fi + + if echo "$f" | grep -q qubes; then + continue + fi + + mv "$f" /var/lib/qubes/removed-udev-scripts/ + done + + mkdir -p /var/lib/qubes/removed-modules-load.d/ + if [ -e /usr/lib/modules-load.d/xen.conf ]; then + mv /usr/lib/modules-load.d/xen.conf /var/lib/qubes/removed-modules-load.d/ + fi + + if [ -e /var/lib/qubes/dom0-updates ]; then + chgrp user /var/lib/qubes/dom0-updates + fi + + mkdir -p /rw + + configure_notification_daemon + configure_selinux + configure_systemd 1 + + if use networking; then + if use network-manager; then + systemctl enable qubes-network.service + systemctl enable qubes-firewall.service + systemctl enable qubes-iptables.service + systemctl enable qubes-updates-proxy.service + + # Create NetworkManager configuration if we do not have it + if ! [ -e /etc/NetworkManager/NetworkManager.conf ]; then + echo '[main]' > /etc/NetworkManager/NetworkManager.conf + echo 'plugins = keyfile' >> /etc/NetworkManager/NetworkManager.conf + echo '[keyfile]' >> /etc/NetworkManager/NetworkManager.conf + fi + + /usr/lib/qubes/qubes-fix-nm-conf.sh + fi + fi +} + +pkg_prerm() { + systemctl disable qubes-ensure-lib-modules.service + + if [ -e /var/lib/qubes/fstab.orig ]; then + mv /var/lib/qubes/fstab.orig /etc/fstab + fi + + for f in /var/lib/qubes/removed-udev-scripts/* + do + mv /var/lib/qubes/removed-udev-scripts/"$f" /etc/udev/rules.d/ + done + + if [ -e /var/lib/qubes/removed-modules-load.d/xen.conf ]; then + mv /var/lib/qubes/removed-modules-load.d/xen.conf /usr/lib/modules-load.d/xen.conf + fi + + if [ -e /var/lib/qubes/serial.orig ]; then + mv /var/lib/qubes/serial.orig /etc/init/serial.conf + fi + + # Run this only during uninstall. + # Save the preset file to later use it to re-preset services there + # once the Qubes OS preset file is removed. + mkdir -p /run/qubes-uninstall + cp -f /lib/systemd/system-preset/75-qubes-vm.preset /run/qubes-uninstall/ + + if use networking; then + if use network-manager; then + systemctl disable qubes-network.service + systemctl disable qubes-firewall.service + systemctl disable qubes-iptables.service + systemctl disable qubes-updates-proxy.service + fi + fi +} + +pkg_postrm() { + changed= + + if [ -d /run/qubes-uninstall ]; then + # We have a saved preset file (or more). + # Re-preset the units mentioned there. + restore_units /run/qubes-uninstall/75-qubes-vm.preset + rm -rf /run/qubes-uninstall + changed=true + fi + + if [ -n "$changed" ]; then + systemctl daemon-reload + fi + + if [ -L /lib/firmware/updates ]; then + rm /lib/firmware/updates + fi + + rm -rf /var/lib/qubes/xdg + + for srv in qubes-sysinit qubes-misc-post qubes-mount-dirs; do + systemctl disable $srv.service + done +} + +### + +update_default_user() { + # Make sure there is a qubes group + groupadd --force --system --gid 98 qubes + + id -u 'user' >/dev/null 2>&1 || { + useradd --user-group --create-home --shell /bin/bash user + } + + usermod -a --groups qubes user +} + +configure_notification_daemon() { + # Enable autostart of notification-daemon when installed + if [ ! -L /etc/xdg/autostart/notification-daemon.desktop ]; then + ln -sf /usr/share/applications/notification-daemon.desktop /etc/xdg/autostart/ + fi +} + +configure_selinux() { + if [ -e /etc/selinux/config ]; then + sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config + setenforce 0 2>/dev/null + fi +} + +update_qubesconfig() { + # Remove old firmware updates link + if [ -L /lib/firmware/updates ]; then + rm -f /lib/firmware/updates + fi + + # convert /usr/local symlink to a mount point + if [ -L /usr/local ]; then + rm -f /usr/local + mkdir /usr/local + mount /usr/local || : + fi + + if ! [ -r /etc/dconf/profile/user ]; then + mkdir -p /etc/dconf/profile + echo "user-db:user" >> /etc/dconf/profile/user + echo "system-db:local" >> /etc/dconf/profile/user + fi + + dconf update &> /dev/null || : + + # Location of files which contains list of protected files + mkdir -p /etc/qubes/protected-files.d + # shellcheck source=init/functions + . /usr/lib/qubes/init/functions + + # qubes-core-vm has been broken for some time - it overrides /etc/hosts; restore original content + if ! is_protected_file /etc/hosts; then + if ! grep -q localhost /etc/hosts; then + + cat < /etc/hosts +127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 $(hostname) +::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 +EOF + + fi + fi + + # ensure that hostname resolves to 127.0.0.1 resp. ::1 and that /etc/hosts is + # in the form expected by qubes-sysinit.sh + if ! is_protected_file /etc/hostname; then + for ip in '127\.0\.0\.1' '::1'; do + if grep -q "^${ip}\(\s\|$\)" /etc/hosts; then + sed -i "/^${ip}\s/,+0s/\(\s$(hostname)\)\+\(\s\|$\)/\2/g" /etc/hosts + sed -i "s/^${ip}\(\s\|$\).*$/\0 $(hostname)/" /etc/hosts + else + echo "${ip} $(hostname)" >> /etc/hosts + fi + done + fi + +} + +is_static() { + [ -f "/usr/lib/systemd/system/$1" ] && ! grep -q '^[[].nstall]' "/usr/lib/systemd/system/$1" +} + +is_masked() { + if [ ! -L /etc/systemd/system/"$1" ]; then + return 1 + fi + target=$(readlink /etc/systemd/system/"$1" 2>/dev/null) || : + if [ "$target" = "/dev/null" ]; then + return 0 + fi + return 1 +} + +mask() { + ln -sf /dev/null /etc/systemd/system/"$1" +} + +unmask() { + if ! is_masked "$1"; then + return 0 + fi + rm -f /etc/systemd/system/"$1" +} + +preset_units() { + local represet= + while read -r action unit_name + do + if [ "$action" = "#" ] && [ "$unit_name" = "Units below this line will be re-preset on package upgrade" ]; then + represet=1 + continue + fi + echo "$action $unit_name" | grep -q '^[[:space:]]*[^#;]' || continue + [[ -n "$action" && -n "$unit_name" ]] || continue + if [ "$2" = "initial" ] || [ "$represet" = "1" ]; then + if [ "$action" = "disable" ] && is_static "$unit_name"; then + if ! is_masked "$unit_name"; then + # We must effectively mask these units, even if they are static. + mask "$unit_name" + fi + elif [ "$action" = "enable" ] && is_static "$unit_name"; then + if is_masked "$unit_name"; then + # We masked this static unit before, now we unmask it. + unmask "$unit_name" + fi + systemctl --no-reload preset "$unit_name" >/dev/null 2>&1 || : + else + systemctl --no-reload preset "$unit_name" >/dev/null 2>&1 || : + fi + fi + done < "$1" +} + +restore_units() { + grep '^[[:space:]]*[^#;]' "$1" | while read -r action unit_name + do + if is_static "$unit_name" && is_masked "$unit_name"; then + # If the unit had been masked by us, we must unmask it here. + # Otherwise systemctl preset will fail badly. + unmask "$unit_name" + fi + systemctl --no-reload preset "$unit_name" >/dev/null 2>&1 || : + done +} + +configure_systemd() { + if [ "$1" -eq 1 ]; then + preset_units /lib/systemd/system-preset/75-qubes-vm.preset initial + changed=true + else + preset_units /lib/systemd/system-preset/75-qubes-vm.preset upgrade + changed=true + # Upgrade path - now qubes-iptables is used instead + for svc in iptables ip6tables + do + if [ -f "$svc".service ]; then + systemctl --no-reload preset "$svc".service + changed=true + fi + done + fi + + if [ "$1" -eq 1 ]; then + # First install. + # Set default "runlevel". + # FIXME: this ought to be done via kernel command line. + # The fewer deviations of the template from the seed + # image, the better. + rm -f /etc/systemd/system/default.target + ln -sf /lib/systemd/system/multi-user.target /etc/systemd/system/default.target + changed=true + fi + + # remove old symlinks + if [ -L /etc/systemd/system/sysinit.target.wants/qubes-random-seed.service ]; then + rm -f /etc/systemd/system/sysinit.target.wants/qubes-random-seed.service + changed=true + fi + if [ -L /etc/systemd/system/multi-user.target.wants/qubes-mount-home.service ]; then + rm -f /etc/systemd/system/multi-user.target.wants/qubes-mount-home.service + changed=true + fi + + if [ -n "$changed" ]; then + systemctl daemon-reload + fi +} diff --git a/app-emulation/qubes-core-agent-linux/qubes-core-agent-linux-4.3.12.ebuild b/app-emulation/qubes-core-agent-linux/qubes-core-agent-linux-4.3.12.ebuild new file mode 100644 index 0000000..a1677d1 --- /dev/null +++ b/app-emulation/qubes-core-agent-linux/qubes-core-agent-linux-4.3.12.ebuild @@ -0,0 +1,440 @@ +# Maintainer: Frédéric Pierret + +EAPI=7 + +PYTHON_COMPAT=( python3_{10..13} ) + +inherit git-r3 multilib distutils-r1 qubes + +if [[ ${PV} == *9999 ]]; then + EGIT_COMMIT=HEAD +else + EGIT_COMMIT="v${PV}" +fi + +EGIT_REPO_URI="https://github.com/QubesOS/qubes-core-agent-linux.git" + +KEYWORDS="amd64" +DESCRIPTION="The Qubes core files for installation inside a Qubes VM" +HOMEPAGE="http://www.qubes-os.org" +LICENSE="GPL-2" + +SLOT="0" +IUSE="nautilus networking network-manager passwordless-root pandoc-bin" + +DEPEND="app-emulation/qubes-libvchan-xen + app-emulation/qubes-db + app-emulation/qubes-utils + net-misc/socat + x11-misc/notification-daemon + x11-misc/xdg-utils + sys-apps/gentoo-systemd-integration + gnome-extra/zenity + pandoc-bin? ( + app-text/pandoc-bin + ) + !pandoc-bin? ( + app-text/pandoc + ) + networking? ( + sys-apps/ethtool + sys-apps/net-tools + net-firewall/iptables + net-proxy/tinyproxy + + network-manager? ( + net-misc/networkmanager + net-firewall/nftables + ) + ) + nautilus? ( + dev-python/nautilus-python + ) + ${PYTHON_DEPS} + " +RDEPEND="${DEPEND}" +PDEPEND="" + +src_prepare() { + qubes_verify_sources_git "${EGIT_COMMIT}" + + default +} + +src_compile() { + # Fix PAM + sed -i 's/postlogin/system-auth/g' passwordless-root/pam.d_su.qubes + + # Fix modules-load.d path + sed -i 's|$(SYSLIBDIR)/modules-load.d|$(LIBDIR)/modules-load.d|g' Makefile + + # Fix for network tools paths + sed -i 's:/sbin/ifconfig:/bin/ifconfig:g' network/* + sed -i 's:/sbin/route:/bin/route:g' network/* + sed -i 's:/sbin/ethtool:/usr/sbin/ethtool:g' network/* + sed -i 's:/sbin/ip:/bin/ip:g' network/* + + myopt="${myopt} DESTDIR="${D}" SYSTEMD=1 BACKEND_VMM=xen" + for dir in qubes-rpc misc; do + emake ${myopt} -C "$dir" + done +} + +src_install() { + emake ${myopt} install-corevm + emake ${myopt} -C app-menu install + emake ${myopt} -C filesystem install + emake ${myopt} -C misc install + emake ${myopt} -C qubes-rpc install + emake ${myopt} -C package-managers install + if use passwordless-root; then + emake ${myopt} -C passwordless-root install + fi + if use nautilus; then + emake ${myopt} -C qubes-rpc/nautilus install + fi + + if use networking; then + if use network-manager; then + emake ${myopt} install-netvm + fi + emake ${myopt} -C network install + emake ${myopt} install-networking + fi + + insopts -m 0644 + insinto /usr/lib/systemd/system/ + doins "${FILESDIR}"/qubes-ensure-lib-modules.service + + # Remove things unwanted in Gentoo + ${myopt} rm -r "$DESTDIR/etc/yum"* + ${myopt} rm -r "$DESTDIR/etc/dnf"* + ${myopt} rm -r "$DESTDIR/etc/init.d" +} + +pkg_preinst() { + update_default_user + + mkdir -p /var/lib/qubes + + if [ -e /etc/fstab ]; then + mv /etc/fstab /var/lib/qubes/fstab.orig + fi + + usermod -L root + usermod -L user +} + +pkg_postinst() { + update_qubesconfig + + mkdir -p /usr/lib/modules + ln -sf /usr/lib/modules /lib/ + systemctl enable qubes-ensure-lib-modules.service + + if [ -e /etc/init/serial.conf ] && ! [ -f /var/lib/qubes/serial.orig ]; then + cp /etc/init/serial.conf /var/lib/qubes/serial.orig + fi + + # Remove most of the udev scripts to speed up the VM boot time + # Just leave the xen* scripts, that are needed if this VM was + # ever used as a net backend (e.g. as a VPN domain in the future) + mkdir -p /var/lib/qubes/removed-udev-scripts + for f in /etc/udev/rules.d/* + do + if [ "$(basename "$f")" == "xen-backend.rules" ]; then + continue + fi + + if echo "$f" | grep -q qubes; then + continue + fi + + mv "$f" /var/lib/qubes/removed-udev-scripts/ + done + + mkdir -p /var/lib/qubes/removed-modules-load.d/ + if [ -e /usr/lib/modules-load.d/xen.conf ]; then + mv /usr/lib/modules-load.d/xen.conf /var/lib/qubes/removed-modules-load.d/ + fi + + if [ -e /var/lib/qubes/dom0-updates ]; then + chgrp user /var/lib/qubes/dom0-updates + fi + + mkdir -p /rw + + configure_notification_daemon + configure_selinux + configure_systemd 1 + + if use networking; then + if use network-manager; then + systemctl enable qubes-network.service + systemctl enable qubes-firewall.service + systemctl enable qubes-iptables.service + systemctl enable qubes-updates-proxy.service + + # Create NetworkManager configuration if we do not have it + if ! [ -e /etc/NetworkManager/NetworkManager.conf ]; then + echo '[main]' > /etc/NetworkManager/NetworkManager.conf + echo 'plugins = keyfile' >> /etc/NetworkManager/NetworkManager.conf + echo '[keyfile]' >> /etc/NetworkManager/NetworkManager.conf + fi + + /usr/lib/qubes/qubes-fix-nm-conf.sh + fi + fi +} + +pkg_prerm() { + systemctl disable qubes-ensure-lib-modules.service + + if [ -e /var/lib/qubes/fstab.orig ]; then + mv /var/lib/qubes/fstab.orig /etc/fstab + fi + + for f in /var/lib/qubes/removed-udev-scripts/* + do + mv /var/lib/qubes/removed-udev-scripts/"$f" /etc/udev/rules.d/ + done + + if [ -e /var/lib/qubes/removed-modules-load.d/xen.conf ]; then + mv /var/lib/qubes/removed-modules-load.d/xen.conf /usr/lib/modules-load.d/xen.conf + fi + + if [ -e /var/lib/qubes/serial.orig ]; then + mv /var/lib/qubes/serial.orig /etc/init/serial.conf + fi + + # Run this only during uninstall. + # Save the preset file to later use it to re-preset services there + # once the Qubes OS preset file is removed. + mkdir -p /run/qubes-uninstall + cp -f /lib/systemd/system-preset/75-qubes-vm.preset /run/qubes-uninstall/ + + if use networking; then + if use network-manager; then + systemctl disable qubes-network.service + systemctl disable qubes-firewall.service + systemctl disable qubes-iptables.service + systemctl disable qubes-updates-proxy.service + fi + fi +} + +pkg_postrm() { + changed= + + if [ -d /run/qubes-uninstall ]; then + # We have a saved preset file (or more). + # Re-preset the units mentioned there. + restore_units /run/qubes-uninstall/75-qubes-vm.preset + rm -rf /run/qubes-uninstall + changed=true + fi + + if [ -n "$changed" ]; then + systemctl daemon-reload + fi + + if [ -L /lib/firmware/updates ]; then + rm /lib/firmware/updates + fi + + rm -rf /var/lib/qubes/xdg + + for srv in qubes-sysinit qubes-misc-post qubes-mount-dirs; do + systemctl disable $srv.service + done +} + +### + +update_default_user() { + # Make sure there is a qubes group + groupadd --force --system --gid 98 qubes + + id -u 'user' >/dev/null 2>&1 || { + useradd --user-group --create-home --shell /bin/bash user + } + + usermod -a --groups qubes user +} + +configure_notification_daemon() { + # Enable autostart of notification-daemon when installed + if [ ! -L /etc/xdg/autostart/notification-daemon.desktop ]; then + ln -sf /usr/share/applications/notification-daemon.desktop /etc/xdg/autostart/ + fi +} + +configure_selinux() { + if [ -e /etc/selinux/config ]; then + sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config + setenforce 0 2>/dev/null + fi +} + +update_qubesconfig() { + # Remove old firmware updates link + if [ -L /lib/firmware/updates ]; then + rm -f /lib/firmware/updates + fi + + # convert /usr/local symlink to a mount point + if [ -L /usr/local ]; then + rm -f /usr/local + mkdir /usr/local + mount /usr/local || : + fi + + if ! [ -r /etc/dconf/profile/user ]; then + mkdir -p /etc/dconf/profile + echo "user-db:user" >> /etc/dconf/profile/user + echo "system-db:local" >> /etc/dconf/profile/user + fi + + dconf update &> /dev/null || : + + # Location of files which contains list of protected files + mkdir -p /etc/qubes/protected-files.d + # shellcheck source=init/functions + . /usr/lib/qubes/init/functions + + # qubes-core-vm has been broken for some time - it overrides /etc/hosts; restore original content + if ! is_protected_file /etc/hosts; then + if ! grep -q localhost /etc/hosts; then + + cat < /etc/hosts +127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 $(hostname) +::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 +EOF + + fi + fi + + # ensure that hostname resolves to 127.0.0.1 resp. ::1 and that /etc/hosts is + # in the form expected by qubes-sysinit.sh + if ! is_protected_file /etc/hostname; then + for ip in '127\.0\.0\.1' '::1'; do + if grep -q "^${ip}\(\s\|$\)" /etc/hosts; then + sed -i "/^${ip}\s/,+0s/\(\s$(hostname)\)\+\(\s\|$\)/\2/g" /etc/hosts + sed -i "s/^${ip}\(\s\|$\).*$/\0 $(hostname)/" /etc/hosts + else + echo "${ip} $(hostname)" >> /etc/hosts + fi + done + fi + +} + +is_static() { + [ -f "/usr/lib/systemd/system/$1" ] && ! grep -q '^[[].nstall]' "/usr/lib/systemd/system/$1" +} + +is_masked() { + if [ ! -L /etc/systemd/system/"$1" ]; then + return 1 + fi + target=$(readlink /etc/systemd/system/"$1" 2>/dev/null) || : + if [ "$target" = "/dev/null" ]; then + return 0 + fi + return 1 +} + +mask() { + ln -sf /dev/null /etc/systemd/system/"$1" +} + +unmask() { + if ! is_masked "$1"; then + return 0 + fi + rm -f /etc/systemd/system/"$1" +} + +preset_units() { + local represet= + while read -r action unit_name + do + if [ "$action" = "#" ] && [ "$unit_name" = "Units below this line will be re-preset on package upgrade" ]; then + represet=1 + continue + fi + echo "$action $unit_name" | grep -q '^[[:space:]]*[^#;]' || continue + [[ -n "$action" && -n "$unit_name" ]] || continue + if [ "$2" = "initial" ] || [ "$represet" = "1" ]; then + if [ "$action" = "disable" ] && is_static "$unit_name"; then + if ! is_masked "$unit_name"; then + # We must effectively mask these units, even if they are static. + mask "$unit_name" + fi + elif [ "$action" = "enable" ] && is_static "$unit_name"; then + if is_masked "$unit_name"; then + # We masked this static unit before, now we unmask it. + unmask "$unit_name" + fi + systemctl --no-reload preset "$unit_name" >/dev/null 2>&1 || : + else + systemctl --no-reload preset "$unit_name" >/dev/null 2>&1 || : + fi + fi + done < "$1" +} + +restore_units() { + grep '^[[:space:]]*[^#;]' "$1" | while read -r action unit_name + do + if is_static "$unit_name" && is_masked "$unit_name"; then + # If the unit had been masked by us, we must unmask it here. + # Otherwise systemctl preset will fail badly. + unmask "$unit_name" + fi + systemctl --no-reload preset "$unit_name" >/dev/null 2>&1 || : + done +} + +configure_systemd() { + if [ "$1" -eq 1 ]; then + preset_units /lib/systemd/system-preset/75-qubes-vm.preset initial + changed=true + else + preset_units /lib/systemd/system-preset/75-qubes-vm.preset upgrade + changed=true + # Upgrade path - now qubes-iptables is used instead + for svc in iptables ip6tables + do + if [ -f "$svc".service ]; then + systemctl --no-reload preset "$svc".service + changed=true + fi + done + fi + + if [ "$1" -eq 1 ]; then + # First install. + # Set default "runlevel". + # FIXME: this ought to be done via kernel command line. + # The fewer deviations of the template from the seed + # image, the better. + rm -f /etc/systemd/system/default.target + ln -sf /lib/systemd/system/multi-user.target /etc/systemd/system/default.target + changed=true + fi + + # remove old symlinks + if [ -L /etc/systemd/system/sysinit.target.wants/qubes-random-seed.service ]; then + rm -f /etc/systemd/system/sysinit.target.wants/qubes-random-seed.service + changed=true + fi + if [ -L /etc/systemd/system/multi-user.target.wants/qubes-mount-home.service ]; then + rm -f /etc/systemd/system/multi-user.target.wants/qubes-mount-home.service + changed=true + fi + + if [ -n "$changed" ]; then + systemctl daemon-reload + fi +}