Skip to content

Commit ecf49dc

Browse files
marmartamarmarta
committed
Fix setting default updatevm/whonix updatevm to none
Correctly put in policy a deny row when either is set to none. fixes QubesOS/qubes-issues#10294
1 parent 2614254 commit ecf49dc

5 files changed

Lines changed: 59 additions & 39 deletions

File tree

‎mypy.ini‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
[mypy]
22
files = qubes_config
3+
exclude = qubes_config/tests/*
34

45
ignore_missing_imports = True
56
check_untyped_defs = True

‎qubes_config/global_config/basics_handler.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@ def __init__(
134134
widget: Gtk.ComboBox,
135135
vm_filter: Optional[Callable] = None,
136136
readable_name: Optional[str] = None,
137-
additional_options: Optional[Dict[str, str]] = None,
137+
additional_options: Dict[Any | str | None, str] | None = None,
138138
):
139139
self.qapp = qapp
140140
self.trait_holder = trait_holder

‎qubes_config/global_config/rule_list_widgets.py‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
# You should have received a copy of the GNU Lesser General Public License along
1919
# with this program; if not, see <http://www.gnu.org/licenses/>.
2020
"""Widgets used by various list of policy rules."""
21-
from typing import Optional, Dict, Callable
21+
from typing import Optional, Dict, Callable, Any
2222

2323
from ..widgets.gtk_widgets import (
2424
VMListModeler,
@@ -43,36 +43,36 @@
4343
t = gettext.translation("desktop-linux-manager", fallback=True)
4444
_ = t.gettext
4545

46-
SOURCE_CATEGORIES = {
46+
SOURCE_CATEGORIES: dict[Any | str | None, str] | None = {
4747
"@anyvm": _("ALL QUBES"),
4848
"@type:AppVM": _("TYPE: APP"),
4949
"@type:TemplateVM": _("TYPE: TEMPLATES"),
5050
"@type:DispVM": _("TYPE: DISPOSABLE"),
5151
}
5252

53-
SOURCE_CATEGORIES_ADMIN = {
53+
SOURCE_CATEGORIES_ADMIN: dict[Any | str | None, str] | None = {
5454
"@anyvm": _("ALL QUBES"),
5555
"@type:AppVM": _("TYPE: APP"),
5656
"@type:TemplateVM": _("TYPE: TEMPLATES"),
5757
"@type:DispVM": _("TYPE: DISPOSABLE"),
5858
"@adminvm": _("TYPE: ADMINVM"),
5959
}
6060

61-
TARGET_CATEGORIES = {
61+
TARGET_CATEGORIES: dict[Any | str | None, str] | None = {
6262
"@anyvm": _("ALL QUBES"),
6363
"@dispvm": _("Default Disposable Qube"),
6464
"@type:AppVM": _("TYPE: APP"),
6565
"@type:TemplateVM": _("TYPE: TEMPLATES"),
6666
"@type:DispVM": _("TYPE: DISPOSABLE"),
6767
}
6868

69-
LIMITED_CATEGORIES = {
69+
LIMITED_CATEGORIES: dict[Any | str | None, str] | None = {
7070
"@type:AppVM": _("TYPE: APP"),
7171
"@type:TemplateVM": _("TYPE: TEMPLATES"),
7272
"@type:DispVM": _("TYPE: DISPOSABLE"),
7373
}
7474

75-
DISPVM_CATEGORIES = {
75+
DISPVM_CATEGORIES: dict[Any | str | None, str] | None = {
7676
"@dispvm": _("Default Disposable Template"),
7777
}
7878

@@ -83,12 +83,12 @@ class VMWidget(Gtk.Box):
8383
def __init__(
8484
self,
8585
qapp: qubesadmin.Qubes,
86-
categories: Optional[Dict[str, str]],
86+
categories: Dict[Any | str | None, str] | None,
8787
initial_value: str,
8888
additional_text: Optional[str] = None,
89-
additional_widget: Optional[Gtk.Widget] = None,
90-
filter_function: Optional[Callable[[qubesadmin.vm.QubesVM], bool]] = None,
91-
change_callback: Optional[Callable] = None,
89+
additional_widget: Gtk.Widget | None = None,
90+
filter_function: Callable[[qubesadmin.vm.QubesVM], bool] | None = None,
91+
change_callback: Callable | None = None,
9292
):
9393
"""
9494
:param qapp: Qubes object

‎qubes_config/global_config/updates_handler.py‎

Lines changed: 34 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -491,13 +491,18 @@ def load_rules(self):
491491

492492
for rule in reversed(self.rules):
493493
if rule.source == "@type:TemplateVM":
494-
def_updatevm = rule.action.target
494+
if rule.action == "deny":
495+
def_updatevm = None
496+
else:
497+
def_updatevm = rule.action.target
495498
elif rule.source == "@tag:whonix-updatevm":
496-
def_whonix_updatevm = rule.action.target
499+
if rule.action == "deny":
500+
def_whonix_updatevm = None
501+
else:
502+
def_whonix_updatevm = rule.action.target
497503

498-
if def_updatevm:
499-
self.updatevm_model.select_value(str(def_updatevm))
500-
self.updatevm_model.update_initial()
504+
self.updatevm_model.select_value(str(def_updatevm))
505+
self.updatevm_model.update_initial()
501506

502507
if self.has_whonix:
503508
self.whonix_updatevm_model.select_value(str(def_whonix_updatevm))
@@ -589,27 +594,41 @@ def save(self):
589594
new_update_proxies.add(self.qapp.domains[rule.target])
590595

591596
if self.has_whonix:
592-
raw_rules.append(
593-
self.policy_manager.new_rule(
597+
if self.whonix_updatevm_model.get_selected():
598+
rule = self.policy_manager.new_rule(
594599
service=self.service_name,
595600
source="@tag:whonix-updatevm",
596601
target="@default",
597602
action="allow "
598603
f"target={self.whonix_updatevm_model.get_selected()}",
599604
)
600-
)
601-
new_update_proxies.add(self.whonix_updatevm_model.get_selected())
602-
603-
if self.updatevm_model.get_selected():
604-
raw_rules.append(
605-
self.policy_manager.new_rule(
605+
else:
606+
rule = self.policy_manager.new_rule(
606607
service=self.service_name,
607-
source="@type:TemplateVM",
608+
source="@tag:whonix-updatevm",
608609
target="@default",
609-
action="allow " f"target={self.updatevm_model.get_selected()}",
610+
action="deny",
610611
)
612+
raw_rules.append(rule)
613+
new_update_proxies.add(self.whonix_updatevm_model.get_selected())
614+
615+
# always have a rule for updatevm
616+
if self.updatevm_model.get_selected():
617+
rule = self.policy_manager.new_rule(
618+
service=self.service_name,
619+
source="@type:TemplateVM",
620+
target="@default",
621+
action=f"allow target={self.updatevm_model.get_selected()}",
611622
)
612623
new_update_proxies.add(self.updatevm_model.get_selected())
624+
else:
625+
rule = self.policy_manager.new_rule(
626+
service=self.service_name,
627+
source="@type:TemplateVM",
628+
target="@default",
629+
action="deny",
630+
)
631+
raw_rules.append(rule)
613632

614633
self.policy_manager.save_rules(
615634
self.policy_file_name, raw_rules, self.current_token

‎qubes_config/widgets/gtk_widgets.py‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
t = gettext.translation("desktop-linux-manager", fallback=True)
3939
_ = t.gettext
4040

41-
NONE_CATEGORY = {"None": _("(none)")}
41+
NONE_CATEGORY: dict[Any | str | None, str] = {"None": _("(none)")}
4242

4343

4444
class TokenName(Gtk.Box):
@@ -50,12 +50,12 @@ def __init__(
5050
self,
5151
token_name: str,
5252
qapp: qubesadmin.Qubes,
53-
categories: Optional[Dict[str, str]] = None,
53+
categories: Optional[Dict[Any | str | None, str]] = None,
5454
):
5555
"""
5656
:param token_name: string for of the token
5757
:param qapp: Qubes object
58-
:param categories: dict of human-readable names for token strings
58+
:param categories: dict of human-readable names for tokens
5959
"""
6060
super().__init__(orientation=Gtk.Orientation.HORIZONTAL)
6161
self.qapp = qapp
@@ -228,12 +228,12 @@ def __init__(
228228
self,
229229
combobox: Gtk.ComboBox,
230230
qapp: qubesadmin.Qubes,
231-
filter_function: Optional[Callable[[qubesadmin.vm.QubesVM], bool]] = None,
232-
event_callback: Optional[Callable[[], None]] = None,
233-
default_value: Optional[Union[qubesadmin.vm.QubesVM, str]] = None,
234-
current_value: Optional[Union[qubesadmin.vm.QubesVM, str]] = None,
231+
filter_function: Callable[[qubesadmin.vm.QubesVM], bool] | None = None,
232+
event_callback: Callable[[], None] | None = None,
233+
default_value: qubesadmin.vm.QubesVM | str | None = None,
234+
current_value: qubesadmin.vm.QubesVM | str | None = None,
235235
style_changes: bool = False,
236-
additional_options: Optional[Dict[str, str]] = None,
236+
additional_options: Dict[qubesadmin.vm.QubesVM | str | None, str] | None = None,
237237
):
238238
"""
239239
:param combobox: target ComboBox object
@@ -253,7 +253,7 @@ def __init__(
253253
:param style_changes: if True, combo-changed style class will be
254254
applied when combobox value changes
255255
:param additional_options: Dictionary of token: readable name of
256-
addiitonal options to be added to the combobox
256+
additonal options to be added to the combobox
257257
"""
258258
self.qapp = qapp
259259
self.combo = combobox
@@ -321,10 +321,10 @@ def _get_icon(self, name):
321321

322322
def _create_entries(
323323
self,
324-
filter_function: Optional[Callable[[qubesadmin.vm.QubesVM], bool]],
325-
default_value: Optional[Union[qubesadmin.vm.QubesVM, str]],
326-
additional_options: Optional[Dict[str, str]] = None,
327-
current_value: Optional[str] = None,
324+
filter_function: Callable[[qubesadmin.vm.QubesVM], bool] | None,
325+
default_value: qubesadmin.vm.QubesVM | str | None,
326+
additional_options: Dict[qubesadmin.vm.QubesVM | str | None, str] | None = None,
327+
current_value: str | None = None,
328328
):
329329

330330
if additional_options:

0 commit comments

Comments
 (0)