Appmenus for starting DispVM explicitly

[marmarek]

Reported by joanna on 12 Jun 2012 10:08 UTC
A separate menu group called "Disposable VM" should allow user to easily start some common applications (Firefox, Terminal?, something else?) from menu.

E.g. a user who cannot decide in which VM a given website should be opened would click on Disposable VM -> Firefox, enter the address, do something there, and then close the Firefox.

Migrated-From: https://wiki.qubes-os.org/ticket/594

[marmarek]

Comment by marmarek on 21 Jun 2012 18:18 UTC
DispVM inherit some properties after calling VM (namely: label, window decorations, firewall). So what properties should have VM called from dom0? Perhaps inherit after DispVM template (*-dvm VM)?

Also which appmenus should be created? IMHO the user should have a choice... We can unhide *-dvm VM, mark it with some special icon and allow some actions - like setting label, firewall, appmenus, but block others - like rename, start, remove (perhaps new class QubesDispTemplateVM based on QubesAppVM?)

Currently to start new DispVM from dom0 it is possible with:

echo firefox  | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell <srcvm> user

but this can be integrated to qvm-run, just to use the same appmenus templates (which have qvm-run cmdline already filled).

[marmarek]

Comment by marmarek on 21 Jun 2012 18:18 UTC
DispVM inherit some properties after calling VM (namely: label, window decorations, firewall). So what properties should have VM called from dom0? Perhaps inherit after DispVM template (*-dvm VM)?

Also which appmenus should be created? IMHO the user should have a choice... We can unhide *-dvm VM, mark it with some special icon and allow some actions - like setting label, firewall, appmenus, but block others - like rename, start, remove (perhaps new class QubesDispTemplateVM based on QubesAppVM?)

Currently to start new DispVM from dom0 it is possible with:

echo firefox  | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell <srcvm> user

but this can be integrated to qvm-run, just to use the same appmenus templates (which have qvm-run cmdline already filled).

[marmarek]

Comment by joanna on 21 Jun 2012 23:33 UTC
From the user's point of view, it makes no sense to set different labels for different instances of DispVMs launched this way (i.e. from the Start Menu). It also makes no sense to limit the networking in any way, and it also makes no sense to use any other app besides a Web Browser. Ok, ok, perhaps the user might wish to use something different than Firefox, but I think we can, at least for now, safely make the following assumptions for the DispVM launched from the start menu:

1. The label is RED
2. The networking is "ALLOW ALL"
3. The list of applications is: Firefox

[marmarek]

Comment by joanna on 21 Jun 2012 23:33 UTC
From the user's point of view, it makes no sense to set different labels for different instances of DispVMs launched this way (i.e. from the Start Menu). It also makes no sense to limit the networking in any way, and it also makes no sense to use any other app besides a Web Browser. Ok, ok, perhaps the user might wish to use something different than Firefox, but I think we can, at least for now, safely make the following assumptions for the DispVM launched from the start menu:

1. The label is RED
2. The networking is "ALLOW ALL"
3. The list of applications is: Firefox

[marmarek]

Comment by joanna on 21 Jun 2012 23:34 UTC
... because for all more "special" uses of DispVM, the user would just launched them from within one of his/her AppVMs...

[marmarek]

Comment by joanna on 21 Jun 2012 23:34 UTC
... because for all more "special" uses of DispVM, the user would just launched them from within one of his/her AppVMs...

[marmarek]

Comment by joanna on 21 Jun 2012 23:48 UTC
Additional explanation: a web browser is the only app that makes sense to be used without any state to be allowed to be preserved, and which consumes untrusted input.

[marmarek]

Comment by joanna on 21 Jun 2012 23:48 UTC
Additional explanation: a web browser is the only app that makes sense to be used without any state to be allowed to be preserved, and which consumes untrusted input.

[marmarek]

Modified by marmarek on 24 Jun 2012 11:24 UTC

[marmarek]

Modified by marmarek on 24 Jun 2012 11:24 UTC

[marmarek]

Modified by marmarek on 24 Jun 2012 12:10 UTC

[marmarek]

Modified by marmarek on 24 Jun 2012 12:10 UTC

[marmarek]

Comment by marmarek on 24 Jun 2012 12:13 UTC
Finally done as hardcoded, one appmenu for firefox. The proper solution will involve creating new VM class (TemplateDispVM) so won't do before 1.0 to not mess things up.

[marmarek]

Comment by marmarek on 24 Jun 2012 12:13 UTC
Finally done as hardcoded, one appmenu for firefox. The proper solution will involve creating new VM class (TemplateDispVM) so won't do before 1.0 to not mess things up.

[marmarek]

Comment by marmarek on 26 Jun 2012 02:05 UTC
http://git.qubes-os.org/gitweb/?p=marmarek/core.git;a=commit;h=2e7d5cc178acd8656fc7242370ab257bb105cf4d

[marmarek]

Comment by marmarek on 26 Jun 2012 02:05 UTC
http://git.qubes-os.org/gitweb/?p=marmarek/core.git;a=commit;h=2e7d5cc178acd8656fc7242370ab257bb105cf4d