Skip to content

Instantly share code, notes, and snippets.

@marmarek
Last active June 12, 2019 13:24
Show Gist options
  • Save marmarek/b36478ac9e4c07b4a30ac49a11948d2a to your computer and use it in GitHub Desktop.
Save marmarek/b36478ac9e4c07b4a30ac49a11948d2a to your computer and use it in GitHub Desktop.
qubes-core-admin to limit admin.vm.List return value based on qrexec policy
import qubes.ext
import qubespolicy
class AdminListExtension(qubes.ext.Extension):
def get_system_info(self, app):
system_info = {'domains': {
domain.name: {
'tags': list(domain.tags),
'type': domain.__class__.__name__,
'template_for_dispvms':
getattr(domain, 'template_for_dispvms', False),
'default_dispvm': (str(domain.default_dispvm) if
getattr(domain, 'default_dispvm', None) else None),
'icon': str(domain.label.icon),
} for domain in app.domains
}}
return system_info
@qubes.ext.handler('admin-permission:admin.vm.List')
def admin_vm_list(self, vm, event, arg, **kwargs):
# allow listing everything in dom0
if vm.klass == 'AdminVM':
return
policy = qubespolicy.Policy('admin.vm.List')
system_info = self.get_system_info(vm.app)
def filter_vms(dest_vm):
try:
result = policy.evaluate(system_info, vm.name, dest_vm.name)
if result.action == qubespolicy.Action.allow:
return True
# TODO: what about 'ask' action?
except qubespolicy.AccessDenied:
# skip
pass
return False
return (filter_vms,)
from setuptools import setup
if __name__ == '__main__':
setup(
name='adminlistfilter',
packages=['adminlistfilter'],
entry_points={
'qubes.ext': [
'adminlistfilter = adminlistfilter:AdminListExtension',
]
},
)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment