qubes-core-admin-linux/system-config/00-qubes-ignore-devices.rules

# do not edit this file, it will be overwritten on update

ACTION!="remove", SUBSYSTEM=="block", KERNEL=="loop*|xvd*", ENV{DM_UDEV_DISABLE_DISK_RULES_FLAG}="1", ENV{UDEV_DISABLE_PERSISTENT_STORAGE_RULES_FLAG}="1"
# ENV{DM_NAME} not available yet
# Template VM disks
ACTION!="remove", SUBSYSTEM=="block", ATTR{dm/name}=="snapshot-*", ENV{DM_UDEV_DISABLE_DISK_RULES_FLAG}="1"
ACTION!="remove", SUBSYSTEM=="block", ATTR{dm/name}=="origin-*", ENV{DM_UDEV_DISABLE_DISK_RULES_FLAG}="1"
# kpartx used for creating empty volatile.img, udevd tries to access the device
# and prevent kpartx from removing them
ACTION!="remove", SUBSYSTEM=="block", ATTR{dm/name}=="loop*p*", ENV{DM_UDEV_DISABLE_DISK_RULES_FLAG}="1"
udev: prevent VM disks content from being accessed by dom0 processes To not expose dom0 processes like blkid for attacks from VM (e.g. by placing malicious filesystem header in private.img). 2014-06-11 00:41:20 +00:00			`# do not edit this file, it will be overwritten on update`

Get rid of forked f23 60-persistent-storage.rules Use UDEV_DISABLE_PERSISTENT_STORAGE_RULES_FLAG instead, which is available since systemd 231. - Do not merge to branches where dom0 is older than Fedora 25 - 2017-05-18 01:39:09 +00:00			`ACTION!="remove", SUBSYSTEM=="block", KERNEL=="loop\|xvd", ENV{DM_UDEV_DISABLE_DISK_RULES_FLAG}="1", ENV{UDEV_DISABLE_PERSISTENT_STORAGE_RULES_FLAG}="1"`
udev: prevent VM disks content from being accessed by dom0 processes To not expose dom0 processes like blkid for attacks from VM (e.g. by placing malicious filesystem header in private.img). 2014-06-11 00:41:20 +00:00			`# ENV{DM_NAME} not available yet`
udev: prevent race with kpartx -d udevd calls (internal) blkid, which opens the device, so kpartx -d cannot remove it. 2015-02-01 03:05:05 +00:00			`# Template VM disks`
udev: prevent VM disks content from being accessed by dom0 processes To not expose dom0 processes like blkid for attacks from VM (e.g. by placing malicious filesystem header in private.img). 2014-06-11 00:41:20 +00:00			`ACTION!="remove", SUBSYSTEM=="block", ATTR{dm/name}=="snapshot-*", ENV{DM_UDEV_DISABLE_DISK_RULES_FLAG}="1"`
udev: prevent dom0 processes from accessing templates root image 2014-07-04 02:28:50 +00:00			`ACTION!="remove", SUBSYSTEM=="block", ATTR{dm/name}=="origin-*", ENV{DM_UDEV_DISABLE_DISK_RULES_FLAG}="1"`
udev: prevent race with kpartx -d udevd calls (internal) blkid, which opens the device, so kpartx -d cannot remove it. 2015-02-01 03:05:05 +00:00			`# kpartx used for creating empty volatile.img, udevd tries to access the device`
			`# and prevent kpartx from removing them`
			`ACTION!="remove", SUBSYSTEM=="block", ATTR{dm/name}=="loopp", ENV{DM_UDEV_DISABLE_DISK_RULES_FLAG}="1"`