"foo $anyvm deny" policy overrides previous lines

[SuzanneSoy]

Qubes OS version:

R4.0 (I installed updates in templates and for dom0 a few days ago and rebooted, but the issue persists)

Affected component(s):

Policy for qubes.Filecopy (I didn't try other policies)

---

Steps to reproduce the behavior:

In dom0, have the following policies for qubes.Filecopy:

less /etc/qubes-rpc/policy/qubes.Filecopy
foo bar allow
foo quux deny
foo $anyvm deny
$anyvm $anyvm ask

In VM foo, run:

qvm-copy example-file
# fails with Request refused

Expected behavior:

The confirmation dialog for qubes.Filecopy should pop up, listing only bar as a possible destination.

Actual behavior:

The qvm-copy example-file operation fails with Request refused

General notes:

If the policy line foo $anyvm deny is commented out, the confirmation dialog pops up as expected. It contains bar and other VMs, but correctly omits quux. The deny mechanism therefore works, but it seems that the foo $anyvm deny line overrides the previous lines.

The documentation at https://www.qubes-os.org/doc/rpc-policy/ and the comments at the top of /etc/qubes-rpc/policy/qubes.Filecopy indicate that lines at the top of the file have precedence over the lines below.

---

Related issues:

[marmarek]

There is no "ask" action before "foo $anyvm deny", so it never gets to the last line when its coming from foo. Here you only allowed call to bar if specified explicitly (like qvm-copy-to-vm bar example-file).

You can specify "ask" action for calls without specific target (the one qvm-copy uses) with this rule:

foo $default ask

(of course before foo $anyvm deny)

[SuzanneSoy]

Thanks, the following works with qvm-copy-to-vm (no prompt) and qvm-copy (with prompt):

less /etc/qubes-rpc/policy/qubes.Filecopy
foo $default ask
foo bar allow
foo $anyvm deny
$anyvm $anyvm ask

The following works for qvm-copy-to-vm and qvm-copy (both with prompt):

less /etc/qubes-rpc/policy/qubes.Filecopy
foo $default ask
foo bar ask
foo $anyvm deny
$anyvm $anyvm ask

The documentation didn't mention the points you explained, I'll send a PR for https://github.com/QubesOS/qubes-doc/blob/master/configuration/rpc-policy.md a bit later :) .