qubes-core-admin-linux/system-config/00-qubes-ignore-devices.rules

# do not edit this file, it will be overwritten on update

ACTION!="remove", SUBSYSTEM=="block", KERNEL=="loop*", ATTR{loop/backing_file}=="*/appvms/*/*.img*|*/vm-templates/*/*.img*", ENV{DM_UDEV_DISABLE_DISK_RULES_FLAG}="1", ENV{UDEV_DISABLE_PERSISTENT_STORAGE_RULES_FLAG}="1"
ACTION!="remove", SUBSYSTEM=="block", KERNEL=="xvd*", ENV{DM_UDEV_DISABLE_DISK_RULES_FLAG}="1", ENV{UDEV_DISABLE_PERSISTENT_STORAGE_RULES_FLAG}="1"
# ENV{DM_NAME} not available yet
# Template VM disks
ACTION!="remove", SUBSYSTEM=="block", ATTR{dm/name}=="snapshot-*", ENV{DM_UDEV_DISABLE_DISK_RULES_FLAG}="1"
ACTION!="remove", SUBSYSTEM=="block", ATTR{dm/name}=="origin-*", ENV{DM_UDEV_DISABLE_DISK_RULES_FLAG}="1"
# kpartx used for creating empty volatile.img, udevd tries to access the device
# and prevent kpartx from removing them
ACTION!="remove", SUBSYSTEM=="block", ATTR{dm/name}=="loop*p*", ENV{DM_UDEV_DISABLE_DISK_RULES_FLAG}="1"
udev: prevent VM disks content from being accessed by dom0 processes To not expose dom0 processes like blkid for attacks from VM (e.g. by placing malicious filesystem header in private.img). 2014-06-11 00:41:20 +00:00			`# do not edit this file, it will be overwritten on update`

Don't let udev parse 'file' driver .img anywhere 2018-01-18 18:43:40 +00:00			`ACTION!="remove", SUBSYSTEM=="block", KERNEL=="loop", ATTR{loop/backing_file}=="/appvms//.img\|/vm-templates//.img*", ENV{DM_UDEV_DISABLE_DISK_RULES_FLAG}="1", ENV{UDEV_DISABLE_PERSISTENT_STORAGE_RULES_FLAG}="1"`
udev: don't exclude loop devices pointing outside of /var/lib/qubes Generally list loop devices in qvm-block, but exclude only those pointing at files in /var/lib/qubes (VM disk images). Fixes QubesOS/qubes-issues#3084 2017-09-12 02:22:25 +00:00			`ACTION!="remove", SUBSYSTEM=="block", KERNEL=="xvd*", ENV{DM_UDEV_DISABLE_DISK_RULES_FLAG}="1", ENV{UDEV_DISABLE_PERSISTENT_STORAGE_RULES_FLAG}="1"`
udev: prevent VM disks content from being accessed by dom0 processes To not expose dom0 processes like blkid for attacks from VM (e.g. by placing malicious filesystem header in private.img). 2014-06-11 00:41:20 +00:00			`# ENV{DM_NAME} not available yet`
udev: prevent race with kpartx -d udevd calls (internal) blkid, which opens the device, so kpartx -d cannot remove it. 2015-02-01 03:05:05 +00:00			`# Template VM disks`
udev: prevent VM disks content from being accessed by dom0 processes To not expose dom0 processes like blkid for attacks from VM (e.g. by placing malicious filesystem header in private.img). 2014-06-11 00:41:20 +00:00			`ACTION!="remove", SUBSYSTEM=="block", ATTR{dm/name}=="snapshot-*", ENV{DM_UDEV_DISABLE_DISK_RULES_FLAG}="1"`
udev: prevent dom0 processes from accessing templates root image 2014-07-04 02:28:50 +00:00			`ACTION!="remove", SUBSYSTEM=="block", ATTR{dm/name}=="origin-*", ENV{DM_UDEV_DISABLE_DISK_RULES_FLAG}="1"`
udev: prevent race with kpartx -d udevd calls (internal) blkid, which opens the device, so kpartx -d cannot remove it. 2015-02-01 03:05:05 +00:00			`# kpartx used for creating empty volatile.img, udevd tries to access the device`
			`# and prevent kpartx from removing them`
			`ACTION!="remove", SUBSYSTEM=="block", ATTR{dm/name}=="loopp", ENV{DM_UDEV_DISABLE_DISK_RULES_FLAG}="1"`