Deny attachment of devices except to sd-devices
#1553
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This prevents the accidental attachment of a would-be malicious device to highly sensitive qubes. It takes advantage of Qubes' 4.3 features. Fixes #1428
Prevent the device attachment denial, since this is a feature only available since Qubes 4.3.
The fixture 'mock_block_device' was unable to run in parallel tests. The issue is related to the paralellization introduced in [1]. [1]: #1512
Necessary to inpect systemd journals
The device denial message is too generic to know that it was in fact the
problem ("Error: Got empty response from qubesd"). This could occlude
other problems with qubesd.
This adds a 'qubesd_log' fixture and uses it to search for the exact device
attachment message.
An alternative approach of mocking qubesd was considered but that would
be a more complex solution and the fact that qvm-block was called
through a subprocess would have made that mocking more complex.
deeplow
added
4.2-openqa-pending
Contributor
Author
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Deny attachment of devices except to
sd-devices. This is a temporary workaround while there is no salt support for QubesOS/qubes-mgmt-salt-dom0-qvm#36. Once we have that we can add it underqvm.prefs.This also adds a test where it creates a block device exposed in sys-usb and then attempts to attach it the expected qube. Unfortunately there was not enough information in the
qvm-block attachcommand and systemd journal logs were necessary to confirm the attach denial.Fixes #1428. Depends on #1373 (change base to
mainonce that's merged)Test plan
Qubes 4.3:
Checklist
This change accounts for:
MANIFEST.inandrpm-build/SPECS/securedrop-workstation-dom0-config.spec)