4.0rc1 qubesdb-write -c watch doesn't support recursive watching

[3hhh]

Whilst implementing a custom qubes firewall for #3051 I noticed that qubesdb-write -c watch cannot detect changes to any subnodes of /qubes-firewall inside a proxyVM, but only to single subnodes as described in https://www.qubes-os.org/doc/vm-interface/:

/qubes-firewall/SOURCE_IP - base tree under which rules are placed. All rules there should be applied to filter traffic coming from SOURCE_IP. This can be either IPv4 or IPv6 address. Dom0 will do an empty write to this top level entry after finishing rules update, so VM can setup a watch here to trigger rules reload.

This is rather inconvenient as all changes to the firewall in 3.2 could be detected by watching the single /qubes-iptables node.

So for now users can stick to the 3.2 solution, but once this is removed from 4.0, they'll have to do some polling of all rules at specific intervals.

Feature Request: Adding an option to watch recursively might solve this once and for all. If this is not considered to have sufficient performance, updating a single key for all firewall changes should also be fine.

[marmarek]

Add trailing slash to watch the whole subtree:

qubesdb-watch /qubes-firewall/

Note that you'll need to check what path was modified, since it will catch also every individual rule modification. See here:
https://github.com/QubesOS/qubes-core-agent-linux/blob/0fabc54aad63512165357cf0b0997d19c84d210c/qubesagent/firewall.py#L133-L152

[marmarek]

Add trailing slash to watch the whole subtree:

qubesdb-watch /qubes-firewall/

Note that you'll need to check what path was modified, since it will catch also every individual rule modification. See here:
https://github.com/QubesOS/qubes-core-agent-linux/blob/0fabc54aad63512165357cf0b0997d19c84d210c/qubesagent/firewall.py#L133-L152

[3hhh]

Thanks for the clarification and hint!

Just tested it and yes, you were of course correct!

[3hhh]

Thanks for the clarification and hint!

Just tested it and yes, you were of course correct!