Make sending service descriptor to socket qrexec service opt-out

[marmarek]

How to file a helpful issue

The problem you're addressing (if any)

Currently, when making a some existing service available via qrexec, one needs to make a wrapper - either make a socket service that strips the initial part (connection metadata) and then passthrough data to the actual service. Or make an executable service that connects to a socket and then passthrough the data (this is how many services are done now, using socat).

The solution you'd like

• Add new skip-service-descriptor=1 option support to qrexec-agent to RPC config (/etc/qubes/rpc-config/*) - when set, qrexec should skip sending service descriptor and go for the actual data directly.
• Do the same in qrexec-daemon
• Add tests
• Update documentation. Preferably, document it in qubes-doc too (currently it's documented only in a /etc/qubes/rpc-config/README)

The value to a user, and who that user might be

Ease using qrexec to connect existing services.

[ben-grande]

Update documentation. Preferably, document it in qubes-doc too (currently it's documented only in a /etc/qubes/rpc-config/README)

I can document this in rpc-config/README, as it seems very outdated.

But just to know if I got everything right:

Format:

• Key and value must be separated by an = (equal sign), they may also be separated by spaces or tabs between the equal sign. e.g key=value, key = value;
• Boolean values accept 0, 1, true and false;
• String values must be enclosed by ' (single quotes), e.g. 'str'.

Keys:

• user (str/int) can be a literal name or UID;
• wait-for-session (bool);
• skip-service-descriptor (bool).

[ben-grande]

I am not sure if user was changed to force-user. Is this correct?

[DemiMarie]

Update documentation. Preferably, document it in qubes-doc too (currently it's documented only in a /etc/qubes/rpc-config/README)

I can document this in rpc-config/README, as it seems very outdated.

It is, want to make a PR?

But just to know if I got everything right:

Format:

• Key and value must be separated by an = (equal sign), they may also be separated by spaces or tabs between the equal sign. e.g key=value, key = value;

Correct.

• Boolean values accept 0, 1, true and false;

Booleans are true and false. wait-for-session accepts 0 and 1 for backwards compatibility.

• String values must be enclosed by ' (single quotes), e.g. 'str'.

Keys:

• user (str/int) can be a literal name or UID

Only names are supported. UIDs should be supported, but I’m not sure how to get them to work with PAM. Also, this is named force-user.

• wait-for-session (bool);

Correct. It can also be 0 or 1 (but not any other integer) for compatibility.

• skip-service-descriptor (bool).

Correct. If this is true (default is false), then force-user is invalid and the service must be a socket (not executable).

[ben-grande]

Update documentation. Preferably, document it in qubes-doc too (currently it's documented only in a /etc/qubes/rpc-config/README)

I can document this in rpc-config/README, as it seems very outdated.

It is, want to make a PR?

Yes, I want to help.