Skip to content

Commit da72845

Browse files
GuiiixGuiiix
committed
minimal-vms: mask gvfs-daemon to prevent dbus timeout
Some programs try to start gvfs-daemon, which refusing to start when minimal-vm is enabled, using a dbus method call and resulting in timeouts. Trying to start a masked service is detected by Dbus and doesn't trigger any timeout. The service is masked at runtime thanks to a new service executed when running a qube with minimal-netvm or minimal-usbvm.
1 parent f26fc08 commit da72845

11 files changed

Lines changed: 89 additions & 22 deletions

‎Makefile‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -146,20 +146,23 @@ endif
146146

147147
# Systemd service files
148148
SYSTEMD_ALL_SERVICES := $(wildcard vm-systemd/qubes-*.service) vm-systemd/dev-xvdc1-swap.service
149-
SYSTEMD_NETWORK_SERVICES := vm-systemd/qubes-firewall.service vm-systemd/qubes-iptables.service vm-systemd/qubes-updates-proxy.service vm-systemd/qubes-antispoof.service vm-systemd/qubes-sysctl-minimal-sys-net.service
149+
SYSTEMD_NETWORK_SERVICES := vm-systemd/qubes-firewall.service vm-systemd/qubes-iptables.service vm-systemd/qubes-updates-proxy.service vm-systemd/qubes-antispoof.service
150150
SYSTEMD_SELINUX_SERVICES := vm-systemd/qubes-relabel-root.service vm-systemd/qubes-relabel-rw.service
151151
SYSTEMD_CORE_SERVICES := $(filter-out $(SYSTEMD_NETWORK_SERVICES) $(SYSTEMD_SELINUX_SERVICES), $(SYSTEMD_ALL_SERVICES))
152+
SYSTEMD_USER_SERVICES := $(wildcard vm-systemd/user/qubes-*.service)
152153

153154
.PHONY: install-systemd
154155
install-systemd: install-init
155156
install -d $(DESTDIR)$(SYSLIBDIR)/systemd/system{,-preset} \
157+
$(DESTDIR)$(SYSLIBDIR)/systemd/user{,-preset} \
156158
$(DESTDIR)$(LIBDIR)/qubes/init \
157159
$(DESTDIR)$(SYSLIBDIR)/modules-load.d \
158160
$(DESTDIR)/etc/systemd/system \
159161
$(DESTDIR)$(SYSLIBDIR)/systemd/network \
160162
$(DESTDIR)$(SYSLIBDIR)/systemd/resolved.conf.d/ \
161163
$(DESTDIR)$(SYSLIBDIR)/systemd/user-environment-generators
162164
install -m 0644 $(SYSTEMD_CORE_SERVICES) $(DESTDIR)$(SYSLIBDIR)/systemd/system/
165+
install -m 0644 $(SYSTEMD_USER_SERVICES) $(DESTDIR)$(SYSLIBDIR)/systemd/user/
163166
install -m 0644 vm-systemd/qubes-*.timer $(DESTDIR)$(SYSLIBDIR)/systemd/system/
164167
install -m 0644 vm-systemd/75-qubes-vm.preset $(DESTDIR)$(SYSLIBDIR)/systemd/system-preset/
165168
install -m 0644 vm-systemd/qubes-core.conf $(DESTDIR)$(SYSLIBDIR)/modules-load.d/
@@ -169,6 +172,8 @@ install-systemd: install-init
169172
install -m 0644 vm-systemd/home.mount $(DESTDIR)$(SYSLIBDIR)/systemd/system/
170173
install -m 0755 vm-systemd/user-environment-generators/30-qubes.sh $(DESTDIR)$(SYSLIBDIR)/systemd/user-environment-generators/30-qubes.sh
171174
install -m 0644 vm-systemd/usr-local.mount $(DESTDIR)$(SYSLIBDIR)/systemd/system/
175+
install -m 0755 vm-systemd/setup-minimal-vm $(DESTDIR)$(LIBDIR)/qubes/setup-minimal-vm
176+
install -m 0644 vm-systemd/user/75-qubes-vm.preset $(DESTDIR)$(SYSLIBDIR)/systemd/user-preset/
172177

173178
.PHONY: install-sysvinit
174179
install-sysvinit: install-init

‎debian/qubes-core-agent-networking.install‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ lib/systemd/system/qubes-antispoof.service
1818
lib/systemd/system/qubes-network.service
1919
lib/systemd/system/qubes-network-uplink.service
2020
lib/systemd/system/qubes-network-uplink@.service
21-
lib/systemd/system/qubes-sysctl-minimal-sys-net.service
2221
lib/systemd/system/qubes-updates-proxy.service
2322
lib/systemd/network/80-qubes-vif.link
2423
usr/lib/qubes/init/network-proxy-setup.sh

‎debian/qubes-core-agent.install‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,7 @@ lib/systemd/system/qubes-early-vm-config.service
100100
lib/systemd/system/qubes-misc-post.service
101101
lib/systemd/system/qubes-mount-dirs.service
102102
lib/systemd/system/qubes-rootfs-resize.service
103+
lib/systemd/system/qubes-setup-minimal-vm.service
103104
lib/systemd/system/qubes-sysinit.service
104105
lib/systemd/system/qubes-update-check.service
105106
lib/systemd/system/qubes-update-check.timer
@@ -122,7 +123,9 @@ lib/systemd/system/user@.service.d/90-session-stop-timeout.conf
122123
lib/systemd/resolved.conf.d/30_resolved-no-mdns-or-llmnr.conf
123124
lib/systemd/system/home.mount
124125
lib/systemd/system/usr-local.mount
126+
lib/systemd/user/qubes-setup-minimal-vm.service
125127
lib/systemd/user-environment-generators/30-qubes.sh
128+
lib/systemd/user-preset/75-qubes-vm.preset
126129
usr/lib/sysctl.d/20-qubes-core.conf
127130
usr/lib/systemd/user/tracker-extract-3.service.d/30_qubes.conf
128131
usr/lib/systemd/user/tracker-miner-fs-3.service.d/30_qubes.conf
@@ -189,6 +192,7 @@ usr/lib/qubes/qvm-move-to-vm.gnome
189192
usr/lib/qubes/qvm-move-to-vm.kde
190193
usr/lib/qubes/qvm-service-wrapper
191194
usr/lib/qubes/resize-rootfs
195+
usr/lib/qubes/setup-minimal-vm
192196
usr/lib/qubes/tar2qfile
193197
usr/lib/qubes/update-proxy-configs
194198
usr/lib/qubes/upgrades-installed-check

‎debian/qubes-core-agent.postinst‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,11 +129,13 @@ case "${1}" in
129129

130130
# Systemd preload-all
131131
preset_units /lib/systemd/system-preset/75-qubes-vm.preset initial
132+
preset_units /lib/systemd/user-preset/75-qubes-vm.preset initial "--global"
132133

133134
# Maybe install overridden serial.conf init script
134135
installSerialConf
135136
else
136137
preset_units /lib/systemd/system-preset/75-qubes-vm.preset upgrade
138+
preset_units /lib/systemd/user-preset/75-qubes-vm.preset upgrade "--global"
137139
fi
138140
systemctl reenable haveged || :
139141

‎rpm_spec/core-agent.spec.in‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1145,7 +1145,6 @@ rm -f %{name}-%{version}
11451145
%_unitdir/qubes-network.service
11461146
%_unitdir/qubes-network-uplink.service
11471147
%_unitdir/qubes-network-uplink@.service
1148-
%_unitdir/qubes-sysctl-minimal-sys-net.service
11491148
%_unitdir/qubes-updates-proxy.service
11501149
/usr/lib/systemd/network/80-qubes-vif.link
11511150
/usr/lib/qubes/init/network-proxy-setup.sh
@@ -1251,6 +1250,7 @@ The Qubes core startup configuration for SystemD init.
12511250
%_unitdir/systemd-nsresourced.service.d/30_qubes.conf
12521251
%dir %_unitdir/systemd-nsresourced.socket.d
12531252
%_unitdir/systemd-nsresourced.socket.d/30_qubes.conf
1253+
%_unitdir/qubes-setup-minimal-vm.service
12541254
%dir %_userunitdir/*.service.d
12551255
%_userunitdir/tracker-extract-3.service.d/30_qubes.conf
12561256
%_userunitdir/tracker-miner-fs-3.service.d/30_qubes.conf
@@ -1267,6 +1267,9 @@ The Qubes core startup configuration for SystemD init.
12671267
%_userunitdir/pipewire.service.d/40_minimal.conf
12681268
%_userunitdir/wireplumber.service.d/30_qubes.conf
12691269
/usr/lib/systemd/user-environment-generators/30-qubes.sh
1270+
%_userunitdir/qubes-setup-minimal-vm.service
1271+
%{_userunitdir}-preset/75-qubes-vm.preset
1272+
/usr/lib/qubes/setup-minimal-vm
12701273

12711274
%post systemd
12721275

@@ -1277,9 +1280,11 @@ changed=
12771280
if [ $1 -eq 1 ]
12781281
then
12791282
preset_units %{_presetdir}/%qubes_preset_file initial
1283+
preset_units %{_userunitdir}-preset/75-qubes-vm.preset initial "--global"
12801284
changed=true
12811285
else
12821286
preset_units %{_presetdir}/%qubes_preset_file upgrade
1287+
preset_units %{_userunitdir}-preset/75-qubes-vm.preset upgrade "--global"
12831288
changed=true
12841289
# Upgrade path - now qubes-iptables is used instead
12851290
for svc in iptables ip6tables

‎vm-systemd/75-qubes-vm.preset‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,7 @@ enable qubes-psu-client@.service default sys-usb
118118
enable dev-xvdc1-swap.service
119119
enable NetworkManager.service
120120
enable NetworkManager-dispatcher.service
121-
enable qubes-sysctl-minimal-sys-net.service
121+
enable qubes-setup-minimal-vm.service
122122

123123
# Disable useless Xen services in Qubes VM
124124
disable xenstored.service

‎vm-systemd/qubes-setup-minimal-vm.service‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
[Unit]
2+
Description=Apply minimal vm runtime configuration
3+
DefaultDependencies=no
4+
Conflicts=shutdown.target
5+
After=systemd-modules-load.service qubes-sysinit.service
6+
Before=sysinit.target shutdown.target
7+
ConditionPathExists=|/var/run/qubes-service/minimal-netvm
8+
ConditionPathExists=|/var/run/qubes-service/minimal-usbvm
9+
10+
[Service]
11+
Type=oneshot
12+
ExecStart=/usr/lib/qubes/setup-minimal-vm
13+
14+
[Install]
15+
WantedBy=sysinit.target

‎vm-systemd/qubes-sysctl-minimal-sys-net.service‎

Lines changed: 0 additions & 18 deletions
This file was deleted.

‎vm-systemd/setup-minimal-vm‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
#!/bin/bash
2+
3+
# License: GPL-2+
4+
#
5+
# This program is free software; you can redistribute it and/or
6+
# modify it under the terms of the GNU General Public License
7+
# as published by the Free Software Foundation; either version 2
8+
# of the License, or (at your option) any later version.
9+
#
10+
# This program is distributed in the hope that it will be useful,
11+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
12+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13+
# GNU General Public License for more details.
14+
#
15+
# You should have received a copy of the GNU General Public License
16+
# along with this program. If not, see <http://www.gnu.org/licenses/>.
17+
18+
19+
20+
is_minimal_netvm() {
21+
test -f /run/qubes-service/minimal-netvm
22+
}
23+
24+
is_minimal_usbvm() {
25+
test -f /run/qubes-service/minimal-usbvm
26+
}
27+
28+
29+
setup_minimal_netvm() {
30+
if [ "$UID" == "0" ]; then
31+
/usr/lib/systemd/systemd-sysctl /etc/sysctl.d/82-qubes-minimal-sys-net.conf.optional
32+
else
33+
/usr/bin/systemctl --user --runtime mask gvfs-daemon.service
34+
fi
35+
}
36+
37+
is_minimal_netvm && setup_minimal_netvm

‎vm-systemd/user/75-qubes-vm.preset‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Units below this line will be re-preset on package upgrade
2+
3+
enable qubes-setup-minimal-vm.service

0 commit comments

Comments
 (0)