Uses tags for RPC grants denoting Client privileges #299
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 2 commits
July 24, 2019 10:43
We use a tag rather than a hardcoded AppVM name to support flexibility configuration. In the main, this is useful to developers, so that the `sd-dev` AppVM can be tagged with `sd-client`, and thereby make calls as though it were `sd-svs`. The Salt logic does not create `sd-dev`, it's up to the developer to configure that machine. Includes corresponding config test updates to validate the RPC policy changes. There are no functional changes to sd-svs grants, merely the possibility that other VMs can be manually granted similar capability. Includes docs, recommending that developers add the new `sd-client` tag to the dev VM manually, if working on the Client code.
We're folding the mimetype handlers and profile settings into the "securedrop-client" debian package, so removing the corresponding Salt config tasks here. The pyqt dependencies are already include in the securedrop-client control file, so we don't need to redeclare them here. Updates config tests to validate file contents, still, but without direct file comparison, since the files have been removed from this repo.
Merged
2 tasks
sssoleileraaa
approved these changes
Jul 25, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Updates the Qubes RPC policy definitions to use a tag
sd-clientrather than hardcoded VM namesd-svs, in order to accommodate dev envs on Qubes for working on the SecureDrop Client. Related issues:Testing
make clone && make clean && make allmake testpasses without errorsqvm-tags sd-dev add sd-clientsd-devto open Client submissions in DispVMs