Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Automatically update dom0 and VM configs over time #172

Merged
merged 9 commits into from
Oct 31, 2018
Merged

Automatically update dom0 and VM configs over time #172

Changes from 1 commit
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
161918a
Configures automatic updates to VMs via dom0
Oct 19, 2018
99660b5
Writes configs for dom0 via salt
Oct 19, 2018
9a5535f
Adds clarifying comments to the update script
Oct 19, 2018
532a0ae
Expands securedrop-update script
Oct 24, 2018
5e9075c
Tweak securedrop-update script
emkll Oct 25, 2018
b4106c9
Fix flake8
emkll Oct 25, 2018
ded9423
Cleans up notifications in dom0 update logic
Oct 30, 2018
2ee0d93
Tests for apt packages up to date
Oct 30, 2018
4c75e27
Adds dist_upgrade to pkg.upgrade command
Oct 31, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 17 additions & 9 deletions dom0/securedrop-update
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,26 +21,34 @@ function securedrop-update-feedback() {
shift

# Running `notify-send` as root doesn't work, must be normal user.
# Setting 30s expire time (in ms) since it's a long-running cmd.
su user -c "notify-send \
# Setting 60s expire time (in ms) since it's a long-running cmd.
local qubes_user
qubes_user="$(id -nu 1000)"
su "$qubes_user" -c "notify-send \
--app-name 'SecureDrop Workstation' \
--icon /usr/share/securedrop/icons/sd-logo.png \
--expire-time 30000 \
'$msg'"
--expire-time 60000 \
'SecureDrop: $msg'"
}

# `qubesctl pkg.upgrade` will automatically update dom0 packages, as well,
# but we *first* want the freshest RPMs from dom0, *then* we'll want to
# update the VMs themselves.
securedrop-update-feedback "SecureDrop: Updating dom0 configuration..."
sudo qubes-dom0-update -y

securedrop-update-feedback "SecureDrop: Updating application..."
qubesctl --templates \
securedrop-update-feedback "Updating application..."
qubesctl \
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, sorry, I think I wasn't clear. My previous comment was about the ordering only, not which actions are performed. If you want to update templates, you still need --templates. If you want to apply configuration to other vms (non-templates), then you need --all.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That would explain the behavior I'm seeing locally, @marmarek; many thanks for your guidance here!

--max-concurrency "$SECUREDROP_MAX_CONCURRENCY" \
pkg.upgrade refresh=true

emkll marked this conversation as resolved.
Show resolved Hide resolved
securedrop-update-feedback "Updating VM configuration..."
qubesctl \
--max-concurrency "$SECUREDROP_MAX_CONCURRENCY" \
state.highstate

# Here would be a good place for state.highstate, to re-apply the VM configs.
# Let's first make sure the package upgrade logic is stable, we can circle
# back to enforce the Salt configs regularly.

securedrop-update-feedback "SecureDrop: All updates complete!"
securedrop-update-feedback \
"Updates installed. Please reboot the workstation \
to ensure the latest security fixes are applied."