From b5e395d385be935d45531f6d2b64f3a999581653 Mon Sep 17 00:00:00 2001 From: Joanna Rutkowska Date: Tue, 6 Apr 2010 00:25:37 +0200 Subject: [PATCH] Initial public commit. (c) 2010 Invisible Things Lab Authors: ========= Joanna Rutkowska Rafal Wojtczuk --- .gitignore | 0 README | 39 ++++ TODO | 0 add_3rd_party_software.sh | 2 + appmenus/convert_app2template.sh | 26 +++ appmenus/convert_app2template_for_netvm.sh | 17 ++ appmenus/convert_apptemplate2vm.sh | 13 ++ appmenus/convert_dirtemplate2vm.sh | 11 ++ appmenus/qubes-netvm.directory.template | 5 + appmenus/qubes-templatevm.directory.template | 5 + appmenus/qubes-vm.directory.template | 5 + build_netvm_rpm | 9 + build_template_rpm | 9 + clean_images/.gitignore | 1 + create_apps_for_netvm.sh | 15 ++ create_apps_for_templatevm.sh | 15 ++ create_apps_templates.sh | 14 ++ create_apps_templates_for_netvm.sh | 14 ++ mnt/.gitignore | 0 mount_root.sh | 42 +++++ netvm.spec | 108 +++++++++++ netvm/apps.orig/konsole.desktop | 173 +++++++++++++++++ netvm/apps.orig/nm-connection-editor.desktop | 107 +++++++++++ .../apps.orig/system-config-firewall.desktop | 114 ++++++++++++ .../apps.orig/system-config-services.desktop | 175 ++++++++++++++++++ netvm/apps.templates/konsole.desktop | 174 +++++++++++++++++ .../nm-connection-editor.desktop | 104 +++++++++++ .../qubes-vm.directory.template | 5 + netvm/apps.templates/show_tray.desktop | 8 + .../system-config-firewall.desktop | 114 ++++++++++++ .../system-config-services.desktop | 175 ++++++++++++++++++ qubeize_image | 68 +++++++ qubeized_images/.gitignore | 1 + rpm/.gitignore | 1 + rpms_to_install_appvm_x64/kernel | 1 + rpms_to_install_appvm_x64/kernel-firmware | 1 + rpms_to_install_appvm_x64/qubes-core-appvm | 1 + rpms_to_install_appvm_x64/qubes-gui-vm | 1 + rpms_to_install_appvm_x64/qubes-vchan-vm | 1 + rpms_to_install_appvm_x64/xen-libs | 1 + .../xen-qubes-vm-essentials | 1 + rpms_to_install_netvm_x64/bridge-utils | 1 + rpms_to_install_netvm_x64/kernel | 1 + rpms_to_install_netvm_x64/kernel-firmware | 1 + rpms_to_install_netvm_x64/qubes-core-netvm | 1 + rpms_to_install_netvm_x64/qubes-gui-vm | 1 + rpms_to_install_netvm_x64/qubes-vchan-vm | 1 + rpms_to_install_netvm_x64/stalonetray | 1 + rpms_to_install_netvm_x64/xen-libs | 1 + .../xen-qubes-vm-essentials | 1 + templates.spec | 126 +++++++++++++ version_appvm | 1 + version_netvm | 1 + vm_conf_files/appvm-template.conf | 23 +++ vm_conf_files/netvm.conf | 21 +++ vm_conf_files/templatevm.conf | 21 +++ vm_initramfs_patches/qubes_cow_setup.sh | 37 ++++ vm_kernels_appvm_x64/.gitignore | 2 + vm_kernels_appvm_x64/initramfs | 1 + vm_kernels_appvm_x64/vmlinuz | 1 + vm_kernels_netvm_x64/.gitignore | 2 + vm_kernels_netvm_x64/initramfs | 1 + vm_kernels_netvm_x64/vmlinuz | 1 + 63 files changed, 1823 insertions(+) create mode 100644 .gitignore create mode 100644 README create mode 100644 TODO create mode 100755 add_3rd_party_software.sh create mode 100755 appmenus/convert_app2template.sh create mode 100755 appmenus/convert_app2template_for_netvm.sh create mode 100755 appmenus/convert_apptemplate2vm.sh create mode 100755 appmenus/convert_dirtemplate2vm.sh create mode 100644 appmenus/qubes-netvm.directory.template create mode 100644 appmenus/qubes-templatevm.directory.template create mode 100644 appmenus/qubes-vm.directory.template create mode 100755 build_netvm_rpm create mode 100755 build_template_rpm create mode 100644 clean_images/.gitignore create mode 100755 create_apps_for_netvm.sh create mode 100755 create_apps_for_templatevm.sh create mode 100755 create_apps_templates.sh create mode 100755 create_apps_templates_for_netvm.sh create mode 100644 mnt/.gitignore create mode 100755 mount_root.sh create mode 100644 netvm.spec create mode 100644 netvm/apps.orig/konsole.desktop create mode 100644 netvm/apps.orig/nm-connection-editor.desktop create mode 100644 netvm/apps.orig/system-config-firewall.desktop create mode 100644 netvm/apps.orig/system-config-services.desktop create mode 100644 netvm/apps.templates/konsole.desktop create mode 100644 netvm/apps.templates/nm-connection-editor.desktop create mode 100644 netvm/apps.templates/qubes-vm.directory.template create mode 100644 netvm/apps.templates/show_tray.desktop create mode 100644 netvm/apps.templates/system-config-firewall.desktop create mode 100644 netvm/apps.templates/system-config-services.desktop create mode 100755 qubeize_image create mode 100644 qubeized_images/.gitignore create mode 100644 rpm/.gitignore create mode 120000 rpms_to_install_appvm_x64/kernel create mode 120000 rpms_to_install_appvm_x64/kernel-firmware create mode 120000 rpms_to_install_appvm_x64/qubes-core-appvm create mode 120000 rpms_to_install_appvm_x64/qubes-gui-vm create mode 120000 rpms_to_install_appvm_x64/qubes-vchan-vm create mode 120000 rpms_to_install_appvm_x64/xen-libs create mode 120000 rpms_to_install_appvm_x64/xen-qubes-vm-essentials create mode 120000 rpms_to_install_netvm_x64/bridge-utils create mode 120000 rpms_to_install_netvm_x64/kernel create mode 120000 rpms_to_install_netvm_x64/kernel-firmware create mode 120000 rpms_to_install_netvm_x64/qubes-core-netvm create mode 120000 rpms_to_install_netvm_x64/qubes-gui-vm create mode 120000 rpms_to_install_netvm_x64/qubes-vchan-vm create mode 120000 rpms_to_install_netvm_x64/stalonetray create mode 120000 rpms_to_install_netvm_x64/xen-libs create mode 120000 rpms_to_install_netvm_x64/xen-qubes-vm-essentials create mode 100644 templates.spec create mode 100644 version_appvm create mode 100644 version_netvm create mode 100644 vm_conf_files/appvm-template.conf create mode 100644 vm_conf_files/netvm.conf create mode 100644 vm_conf_files/templatevm.conf create mode 100755 vm_initramfs_patches/qubes_cow_setup.sh create mode 100644 vm_kernels_appvm_x64/.gitignore create mode 120000 vm_kernels_appvm_x64/initramfs create mode 120000 vm_kernels_appvm_x64/vmlinuz create mode 100644 vm_kernels_netvm_x64/.gitignore create mode 120000 vm_kernels_netvm_x64/initramfs create mode 120000 vm_kernels_netvm_x64/vmlinuz diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..e69de29 diff --git a/README b/README new file mode 100644 index 0000000..e559fea --- /dev/null +++ b/README @@ -0,0 +1,39 @@ +The Template Builder +====================== + +(applies also to the netvm builder) + +1) get a clean image of a Linux install (e.g. by using virt-install) NOTE: We +assume that the image will have a two-partition layout: + +img1 <--- the root fs (/) +img2 <--- the swap + +2) update symlinks in rpms_to_install so that they point to the current version +of rpms to install + +3) Now, you can "qubeize" the image. This must be done as root. E.g.: + +# ./qubeize_image clean_images/some_image.img f12-x64-compact + +4) Make sure the symlinks in vm_kernels point to correct kernel and initramfs +files. + +4a) In order to prepare a patched initramfs file, use the +patch_appvm_initramfs.sh program that is installed as part of +qubes-core-dom0.rpm: + +# /usr/lib/qubes/patch_appvm_initramfs.sh \ + \ + \ + /abs_path/vm-initramfs-patches/qubes_cow_setup.sh + + +4b) Manually adjust the appmenus + +5) Finally, build the Template RPM (do it as normal user, not root), e.g.: + +$./build_rpm + +The resulting rpm is stored in rpm/noarch directory. + diff --git a/TODO b/TODO new file mode 100644 index 0000000..e69de29 diff --git a/add_3rd_party_software.sh b/add_3rd_party_software.sh new file mode 100755 index 0000000..b6873dd --- /dev/null +++ b/add_3rd_party_software.sh @@ -0,0 +1,2 @@ +#!/bin/sh +cp ../rpms_3rd_party/libflashplayer.so mnt/usr/lib64/mozilla/plugins/ diff --git a/appmenus/convert_app2template.sh b/appmenus/convert_app2template.sh new file mode 100755 index 0000000..337b9d0 --- /dev/null +++ b/appmenus/convert_app2template.sh @@ -0,0 +1,26 @@ +#!/bin/sh +SRC=$1 +DSTDIR=$2 +DST=$DSTDIR/$(basename $SRC) + +# Do not copy KDE/GNOME specific apps, e.g. "Home", "Find files", etc +if grep -q OnlyShowIn $SRC ; then + exit 0 +fi + +if ! grep -q ^Name $SRC ; then + echo "WARNING: app $SRC doesn't have Name keyword, skipping..." + exit 0 +fi + +sed -e "s/^\(Name.*\)=\(.*\)/\1=%VMNAME%: \2/" \ + -e "s/^\(GenericName.*\)=\(.*\)/\1=%VMNAME%: \2/" \ + -e "s/^Exec=\(.*\)/Exec=qvm-run -q --tray -a %VMNAME% \'\1\'/" \ + <$SRC | \ + grep -v "^Mime" | \ + grep -v "^Icon" | \ + grep -v "^TryExec" | \ + grep -v "^Startup" >$DST + +echo X-Qubes-VmName=%VMNAME% >> $DST +echo Icon=%VMDIR%/icon.png >> $DST diff --git a/appmenus/convert_app2template_for_netvm.sh b/appmenus/convert_app2template_for_netvm.sh new file mode 100755 index 0000000..113cc3c --- /dev/null +++ b/appmenus/convert_app2template_for_netvm.sh @@ -0,0 +1,17 @@ +#!/bin/sh +SRC=$1 +DSTDIR=$2 +DST=$DSTDIR/$(basename $SRC) + +sed -e "s/^\(Name.*\)=\(.*\)/\1=%VMNAME%: \2/" \ + -e "s/^\(GenericName.*\)=\(.*\)/\1=%VMNAME%: \2/" \ + -e "s/^Exec=\(.*\)/Exec=qvm-run -q --tray -a --user=root %VMNAME% \"\1\"/" \ + <$SRC | \ + grep -v "^Mime" | \ + grep -v "^TryExec" | \ + grep -v "^Startup" >$DST + +#echo "Categories=%VMNAME%" >> $DST + +echo X-Qubes-VmName=%VMNAME% >> $DST +echo Icon=%VMDIR%/icon.png >> $DST diff --git a/appmenus/convert_apptemplate2vm.sh b/appmenus/convert_apptemplate2vm.sh new file mode 100755 index 0000000..b5ab146 --- /dev/null +++ b/appmenus/convert_apptemplate2vm.sh @@ -0,0 +1,13 @@ +#!/bin/sh +SRC=$1 +DSTDIR=$2 +VMNAME=$3 +VMDIR=$4 + +DST=$DSTDIR/$VMNAME-$(basename $SRC) + +sed -e "s/%VMNAME%/$VMNAME/" \ + -e "s %VMDIR% $VMDIR " \ + <$SRC >$DST + + diff --git a/appmenus/convert_dirtemplate2vm.sh b/appmenus/convert_dirtemplate2vm.sh new file mode 100755 index 0000000..9d1972b --- /dev/null +++ b/appmenus/convert_dirtemplate2vm.sh @@ -0,0 +1,11 @@ +#!/bin/sh +SRC=$1 +DST=$2 +VMNAME=$3 +VMDIR=$4 + +sed -e "s/%VMNAME%/$VMNAME/" \ + -e "s %VMDIR% $VMDIR " \ + <$SRC >$DST + + diff --git a/appmenus/qubes-netvm.directory.template b/appmenus/qubes-netvm.directory.template new file mode 100644 index 0000000..2254401 --- /dev/null +++ b/appmenus/qubes-netvm.directory.template @@ -0,0 +1,5 @@ +[Desktop Entry] +Encoding=UTF-8 +Type=Directory +Name=%VMNAME% (NetVM) +Icon=/usr/share/qubes/icons/netvm.png diff --git a/appmenus/qubes-templatevm.directory.template b/appmenus/qubes-templatevm.directory.template new file mode 100644 index 0000000..569613f --- /dev/null +++ b/appmenus/qubes-templatevm.directory.template @@ -0,0 +1,5 @@ +[Desktop Entry] +Encoding=UTF-8 +Type=Directory +Name=%VMNAME% (TemplateVM) +Icon=/usr/share/qubes/icons/template.png diff --git a/appmenus/qubes-vm.directory.template b/appmenus/qubes-vm.directory.template new file mode 100644 index 0000000..890f38d --- /dev/null +++ b/appmenus/qubes-vm.directory.template @@ -0,0 +1,5 @@ +[Desktop Entry] +Encoding=UTF-8 +Type=Directory +Name=%VMNAME% (VM) +Icon=%VMDIR%/icon.png diff --git a/build_netvm_rpm b/build_netvm_rpm new file mode 100755 index 0000000..59e8ba9 --- /dev/null +++ b/build_netvm_rpm @@ -0,0 +1,9 @@ +#!/bin/sh +NAME=$1 + +if [ x$NAME = x ] ; then +echo "usage $0 " +exit +fi + +rpmbuild --sign --target noarch --define "netvm_name $NAME" -bb netvm.spec diff --git a/build_template_rpm b/build_template_rpm new file mode 100755 index 0000000..7936008 --- /dev/null +++ b/build_template_rpm @@ -0,0 +1,9 @@ +#!/bin/sh +NAME=$1 + +if [ x$NAME = x ] ; then +echo "usage $0 " +exit +fi + +rpmbuild --sign --target noarch --define "template_name $NAME" -bb templates.spec diff --git a/clean_images/.gitignore b/clean_images/.gitignore new file mode 100644 index 0000000..72e8ffc --- /dev/null +++ b/clean_images/.gitignore @@ -0,0 +1 @@ +* diff --git a/create_apps_for_netvm.sh b/create_apps_for_netvm.sh new file mode 100755 index 0000000..8e13c22 --- /dev/null +++ b/create_apps_for_netvm.sh @@ -0,0 +1,15 @@ +#!/bin/sh +SRCDIR=$1 +VMNAME=$2 +VMDIR=$3 +APPSDIR=$4 + +if [ $# != 4 ]; then + echo "usage: $0 " + exit +fi +mkdir -p $APPSDIR + +find $SRCDIR -name "*.desktop" -exec appmenus/convert_apptemplate2vm.sh {} $APPSDIR $VMNAME $VMDIR \; + +appmenus/convert_dirtemplate2vm.sh appmenus/qubes-netvm.directory.template $APPSDIR/$VMNAME-vm.directory $VMNAME $VMDIR diff --git a/create_apps_for_templatevm.sh b/create_apps_for_templatevm.sh new file mode 100755 index 0000000..97209d5 --- /dev/null +++ b/create_apps_for_templatevm.sh @@ -0,0 +1,15 @@ +#!/bin/sh +SRCDIR=$1 +VMNAME=$2 +VMDIR=$3 +APPSDIR=$4 + +if [ $# != 4 ]; then + echo "usage: $0 " + exit +fi +mkdir -p $APPSDIR + +find $SRCDIR -name "*.desktop" -exec appmenus/convert_apptemplate2vm.sh {} $APPSDIR $VMNAME $VMDIR \; + +appmenus/convert_dirtemplate2vm.sh appmenus/qubes-templatevm.directory.template $APPSDIR/$VMNAME-vm.directory $VMNAME $VMDIR diff --git a/create_apps_templates.sh b/create_apps_templates.sh new file mode 100755 index 0000000..8ef7f59 --- /dev/null +++ b/create_apps_templates.sh @@ -0,0 +1,14 @@ +#!/bin/sh +APPSORIG=$1 +APPSTMPL=$2 + +if [ $# != 2 ]; then + echo "usage $0 " + exit 0 +fi + +rm -f $APPSTMPL/* +mkdir -p $APPSTMPL +find $APPSORIG -name "*.desktop" -exec appmenus/convert_app2template.sh {} $APPSTMPL \; + +cp appmenus/qubes-vm.directory.template $APPSTMPL diff --git a/create_apps_templates_for_netvm.sh b/create_apps_templates_for_netvm.sh new file mode 100755 index 0000000..22964d9 --- /dev/null +++ b/create_apps_templates_for_netvm.sh @@ -0,0 +1,14 @@ +#!/bin/sh +APPSORIG=$1 +APPSTMPL=$2 + +if [ $# != 2 ]; then + echo "usage $0 " + exit 0 +fi + +#rm -f $APPSTMPL/* +mkdir -p $APPSTMPL +find $APPSORIG -name "*.desktop" -exec appmenus/convert_app2template_for_netvm.sh {} $APPSTMPL \; + +cp appmenus/qubes-vm.directory.template $APPSTMPL diff --git a/mnt/.gitignore b/mnt/.gitignore new file mode 100644 index 0000000..e69de29 diff --git a/mount_root.sh b/mount_root.sh new file mode 100755 index 0000000..e9ffe17 --- /dev/null +++ b/mount_root.sh @@ -0,0 +1,42 @@ +#!/bin/sh +ROOTIMG=$1 + +if [ x$ROOTIMG = x ] ; then +echo "usage: $0 " +exit 0 +fi + +# We assume that the input root.img has the following structure: + +# /dev/sda1 <--- root fs +# /dev/sda2 <--- swap + +# and that the first partition starts at offset 63*512 from the begging of the image file +OFFSET=$((63*512)) + +mkdir -p mnt + +MNTDIR=$(pwd)/mnt + +LOOP=$(/sbin/losetup -f -s -o $OFFSET $ROOTIMG) + +if [ x$LOOP = x ] ; then +echo "Cannot setup loopback device for the $ROOTIMG file -- perhaps a permissions problem?" +exit 1 +fi + +mount $LOOP $MNTDIR || { +echo "Cannot mount $LOOP to $MNTDIR" +/sbin/losetup -d $LOOP +exit 2 +} + +# generate unmount script +BASENAE=$(basename $ROOTIMG) +UNMOUNT_SCRIPT=$(echo unmount_root-$BASENAE.sh) +echo "#!/bin/sh" > $UNMOUNT_SCRIPT +echo "umount $MNTDIR || { echo \"Cannot unmount!\"; exit 1; }" >> $UNMOUNT_SCRIPT +echo "/sbin/losetup -d $LOOP || { echo \"Cannot delete the loop device\"; exit 1; }" >> $UNMOUNT_SCRIPT +echo "rm -f $UNMOUNT_SCRIPT" >> $UNMOUNT_SCRIPT +chmod +x $UNMOUNT_SCRIPT + diff --git a/netvm.spec b/netvm.spec new file mode 100644 index 0000000..c352982 --- /dev/null +++ b/netvm.spec @@ -0,0 +1,108 @@ +# +# This SPEC is for bulding RPM packages that contain complete Qubes NetVM files +# This includes the VM's root image, patched with all qubes rpms, etc +# + +%{!?version: %define version %(cat version_netvm)} + +Name: qubes-servicevm-%{netvm_name} +Version: %{version} +Release: 1 +Summary: Qubes NetVM image for '%{netvm_name}' + +License: GPL +URL: http://www.qubes-os.org +Source: . + +Requires: qubes-core-dom0 xdg-utils + +%define _builddir %(pwd) +%define _rpmdir %(pwd)/rpm +%define dest_dir /var/lib/qubes/servicevms/%{netvm_name} + +%description +Qubes NetVM image for '%{netvm_name}'. + +%build +cd qubeized_images +rm -f %{netvm_name}-root.img.tar +tar --sparse -cf %{netvm_name}-root.img.tar %{netvm_name}-root.img +cd .. +./create_apps_for_netvm.sh netvm/apps.templates/ %{netvm_name} %{dest_dir} qubeized_images/%{netvm_name}-apps + +%install +rm -rf $RPM_BUILD_ROOT +mkdir -p $RPM_BUILD_ROOT/%{dest_dir} +ln qubeized_images/%{netvm_name}-root.img.tar $RPM_BUILD_ROOT/%{dest_dir}/root.img.tar +touch $RPM_BUILD_ROOT/%{dest_dir}/root.img # we will create the real file in %post + +sed -e s/%NETVMNAME%/%{netvm_name}/ < vm_conf_files/netvm.conf >\ + $RPM_BUILD_ROOT/%{dest_dir}/%{netvm_name}.conf + +mkdir -p $RPM_BUILD_ROOT/%{dest_dir}/kernels +cp vm_kernels/vmlinuz $RPM_BUILD_ROOT/%{dest_dir}/kernels/vmlinuz +cp vm_kernels/initramfs $RPM_BUILD_ROOT/%{dest_dir}/kernels/initramfs + +cp vm_initramfs_patches/qubes_cow_setup.sh $RPM_BUILD_ROOT/%{dest_dir}/kernels/qubes_cow_setup.sh + +mkdir -p $RPM_BUILD_ROOT/%{dest_dir}/apps +cp -r qubeized_images/%{netvm_name}-apps/* $RPM_BUILD_ROOT/%{dest_dir}/apps +touch $RPM_BUILD_ROOT/%{dest_dir}/icon.png + +%post +echo "--> Processing the root.img... (this might take a while)" +tar --sparse -xf %{dest_dir}/root.img.tar -C %{dest_dir} +rm -f %{dest_dir}/root.img.tar +mv %{dest_dir}/%{netvm_name}-root.img %{dest_dir}/root.img +chown root.qubes %{dest_dir}/root.img +chmod 0660 %{dest_dir}/root.img + +export XDG_DATA_DIRS=/usr/share/ +if [ "$1" -gt 1 ] ; then + # upgrading already installed template... + echo "--> Removing previous menu shortcuts..." + xdg-desktop-menu uninstall --mode system %{dest_dir}/apps/*.directory %{dest_dir}/apps/*.desktop +fi + +echo "--> Instaling menu shortcuts..." +ln -sf /usr/share/qubes/icons/netvm.png %{dest_dir}/icon.png +xdg-desktop-menu install --mode system %{dest_dir}/apps/*.directory %{dest_dir}/apps/*.desktop + +echo "--> Adding to Qubes DB..." +if [ "$1" = 1 ] ; then + # installing for the first time + qvm-add-netvm %{netvm_name} +else + qvm-remove -q --just-db %{netvm_name} + qvm-add-netvm %{netvm_name} +fi + +%preun +if [ "$1" = 0 ] ; then + # no more packages left + qvm-remove -q --just-db %{netvm_name} + + # we need to have it here, because rpm -U