Add property-set:template handler, refactor to reduce redundancy#2
Conversation
|
I wonder, should it also remove tag when changing to non-kicksecure template? At least if the old one was kicksecure (to at least partially try to not remove tag added by the user manually). But then, interaction with the whonix addon will be tricky (like changing template from kicksecure to whonix-workstation for example)... |
|
PipelineRetry |
I guess it could, and the existing mechanism can (and in practice likely will) result in useless tags being left around on VMs that don't need them anymore. The issue with switching between Kicksecure and Whonix templates can be prevented easily enough with some special-casing, although switching a VM between Kicksecure and Whonix isn't something I think we support since a switch either direction could result in an anonymity compromise. I'd be happy to augment this and the addon-whonix PR to remove the tags when reasonable. |
|
Thinking about it, I think it should remove the tag (here and in the other PR). This should for example cover the situation when user momentarily switches to kicksecure/whonix template by mistake, and fixing it should not leave extra tags behind. |
OpenQA test summaryComplete test suite and dependencies: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2026041101-4.3&flavor=pull-requests Test run included the following:
New failures, excluding unstableCompared to: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2026032404-devel&flavor=update
Failed tests18 failures
Fixed failuresCompared to: https://openqa.qubes-os.org/tests/170766#dependencies 31 fixed
Unstable testsDetails
Performance TestsPerformance degradation:9 performance degradations
Remaining performance tests:102 tests
|
Now when a user sets an AppVM to be based on a Kicksecure template, it will automatically be tagged appropriately. Fixes: QubesOS/qubes-issues#10645
ArrayBolt3
force-pushed
the
arraybolt3/property-set-template
branch
from
94974e6 to
b69a94d
Compare
What do you think about this part? Do you think user should be allowed to add those tags to non-whonix-based qubes? Right now, if they do, and then change the template (for example switch from fedora-42 to fedora-43), the tags will be removed. If you think tags shouldn't be removed in such situation, take a look at the |
|
@marmarek That's a good question, I missed that bit when looking at this. I guess it's not impossible that someone would use sdwdate and sdwdate-gui on Fedora or another non-Kicksecure platform, but given that both of them depend on both helper-scripts and privleap, it's somewhat unlikely. I don't think there's any meaningful attack surface here though (the protocol is intentionally very simple), so it won't necessarily hurt anything to keep the tags around. @adrelanos What do you think? |
|
Best to keep things simple and non-Kicksecure / non-Whonix Templates unsupported. |
4 participants
Now when a user sets an AppVM to be based on a Kicksecure template, it will automatically be tagged appropriately.
Fixes the other half of QubesOS/qubes-issues#10645 (should go with QubesOS/qubes-core-admin-addon-whonix#30).