Skip to content

Improve policy admin client and related tools#223

Merged
marmarek merged 19 commits into
QubesOS:mainfrom
ben-grande:nonroot-editor
May 7, 2026
Merged

Improve policy admin client and related tools#223
marmarek merged 19 commits into
QubesOS:mainfrom
ben-grande:nonroot-editor

Conversation

@ben-grande
Copy link
Copy Markdown
Contributor

@ben-grande ben-grande commented Mar 2, 2026

  • reduce number of statements
  • pass -- to shell commands
  • prints traeback on errors
  • custom .policy extension so editors can recognize the filetype and load syntax accordingly
  • remove the non-root blocker, unnecessary since using PolicyClient

And many more things as commit grew. Check each commit message.

Fixes: QubesOS/qubes-issues#10745
Fixes: QubesOS/qubes-issues#10746

@codecov
Copy link
Copy Markdown

codecov Bot commented Mar 2, 2026

Codecov Report

❌ Patch coverage is 84.03548% with 72 lines in your changes missing coverage. Please review.
✅ Project coverage is 80.91%. Comparing base (f6e44ea) to head (842a543).

Files with missing lines Patch % Lines
qrexec/tools/qubes_policy_editor.py 0.00% 67 Missing ⚠️
qrexec/utils.py 70.00% 3 Missing ⚠️
qrexec/policy/admin.py 95.23% 1 Missing ⚠️
qrexec/tools/qubes_policy.py 91.66% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main     #223      +/-   ##
==========================================
+ Coverage   78.96%   80.91%   +1.94%     
==========================================
  Files          55       58       +3     
  Lines       10544    10813     +269     
==========================================
+ Hits         8326     8749     +423     
+ Misses       2218     2064     -154     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@ben-grande ben-grande force-pushed the nonroot-editor branch 14 times, most recently from 572ddcd to 1dbf790 Compare March 6, 2026 14:12
ben-grande added a commit to ben-grande/qubes-desktop-linux-manager that referenced this pull request Mar 6, 2026
@ben-grande ben-grande changed the title Improve qubes policy editor Improve policy admin client and related tools Mar 9, 2026
rpc = "List"
return self.call(rpc, is_include=is_include).rstrip("\n").split("\n")

def policy_include_list(self) -> List[str]:
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please keep policy_include_* (as wrappers for new methods) for compatibility. It is a public API after all.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added them back. I tried to issue a DeprecationWarning, but I am not sure why it not emitted.

PYTHONPATH=. python3
import qrexec.policy.admin_client
client = qrexec.policy.admin_client
client.policy_include_list()

Warning is not emitted.

https://docs.python.org/3/library/warnings.html

@marmarek
Copy link
Copy Markdown
Member

And also black complains about minor thing

@ben-grande ben-grande force-pushed the nonroot-editor branch 2 times, most recently from 77a5c32 to 12b0b4f Compare March 17, 2026 03:28
@ben-grande
Copy link
Copy Markdown
Contributor Author

PipelineRetryFailed

Comment thread qrexec/tools/qubes_policy_editor.py Outdated
else:
client.policy_replace(name, content, token)
except subprocess.CalledProcessError as e:
policy_replace(name, content, token)
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rebase failure (should be between try/except)? You do fix it in a later commit (0b26e0a)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, messed up rebase.

@marmarek
Copy link
Copy Markdown
Member

https://gitlab.com/QubesOS/qubes-core-qrexec/-/jobs/13694697611

$ xvfb-run ./run-vim-tests
endfunction
/usr/bin/xvfb-run: line 186: kill: (2943) - No such process

Bug in xvfb-run? :/

@ben-grande
Copy link
Copy Markdown
Contributor Author

/usr/bin/xvfb-run: line 186: kill: (2943) - No such process

Attempting to address this in #228.

@ben-grande ben-grande force-pushed the nonroot-editor branch 2 times, most recently from 1d1972f to 1c8e634 Compare April 29, 2026 13:32
marmarek added a commit to QubesOS/qubes-desktop-linux-manager that referenced this pull request Apr 29, 2026
* origin/pr/301:
  Use new policy admin exceptions

Pull request description:

For: QubesOS/qubes-issues#10746
Requires: QubesOS/qubes-core-qrexec#223
Largely duplicate of the server side methods, but creating it anyway as
it serves two purposes:

- If the client can receive appropriate exceptions
- If the client methods works
The repository is already reformatted with black using that same line
length.
@ben-grande ben-grande force-pushed the nonroot-editor branch 3 times, most recently from b9b6b0f to be28027 Compare April 29, 2026 16:37
Easier to move test files around.
Easier to identify which test file relates to which file when they are
under the same directory structure.
@ben-grande
Copy link
Copy Markdown
Contributor Author

PipelineRetryFailed

@marmarek marmarek merged commit a41a858 into QubesOS:main May 7, 2026
5 of 6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

3 participants