Page MenuHomePhabricator

prevent qubes-updates-proxy.service from possibly modifying Whonix's firewall
Closed, ResolvedPublic

Description


Do you think the following seems like a sound solution?

/lib/systemd/system/qubes-updates-proxy.service.d/40_qubes-whonix.conf
## This file is part of Whonix.
## Copyright (C) 2012 - 2015 Patrick Schleizer <adrelanos@riseup.net>
## See the file COPYING for copying conditions.

[Service]

## Clear the 'ExecStartPre' list.
## Prevent loading firewall rules: ExecStartPre=/usr/lib/qubes/iptables-updates-proxy start
ExecStartPre=

## Clear the 'ExecStopPost' list.
## Prevent removing firewall rules: ExecStopPost=/usr/lib/qubes/iptables-updates-proxy stop
ExecStopPost=

## XXX: Workaround.
## Re-adding a required 'ExecStartPre' item.
## Required until, qubes-core-agent 3.1.3 hits stable and everyone
## upgraded, i.e. until /usr/lib/tmpfiles.d/qubes-core-agent-linux.conf
## is in place.
## https://github.com/QubesOS/qubes-issues/issues/1401
ExecStartPre=/usr/bin/install -d --owner tinyproxy --group tinyproxy /var/run/tinyproxy

Alternatively, I was wondering if I rather should produce a pull request against QubesOS either,

  • a) split qubes-updates-proxy into qubes-updates-proxy and qubes-updates-proxy-iptables or,
  • b) allow iptables-updates-proxy to be turned of by /etc/qubes/settings.d

What do you think?

Details

Impact
High

Event Timeline

Patrick raised the priority of this task from to Normal.
Patrick updated the task description. (Show Details)
Patrick set Impact to High.
Patrick added subscribers: Patrick, marmarek, nrgaway.
Patrick changed the task status from Open to Review.Nov 12 2015, 3:58 PM

Implemented the above /lib/systemd/system/qubes-updates-proxy.service.d/40_qubes-whonix.conf solution for now...

prevent qubes-updates-proxy.service from possibly modifying Whonix's firewall:
https://github.com/Whonix/qubes-whonix/commit/d386885db0e666f4011f892e2be8c2049de3b077

...until/if there is a better solution suggested.

I think the current solution (overriding 'ExecStartPre' and 'ExecStopPost') is ok. Do you include those firewall rules in Whonix firewall? Without such redirection, VMs will not be able to connect to the updates proxy.

Patrick claimed this task.
In T427#7103, @marmarek wrote:

Do you include those firewall rules in Whonix firewall?

Yes. Qubes specific rules:
https://github.com/Whonix/whonix-gw-firewall/blob/c30ad852911856051f43205f822446cc2a032fec/usr/bin/whonix_firewall#L285-L310

(Tested and working.)