Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Restrict outbound qubes-rpc policies for sd-workstation VMs #387

Merged
merged 1 commit into from Jan 2, 2020
Merged

Restrict outbound qubes-rpc policies for sd-workstation VMs #387

merged 1 commit into from Jan 2, 2020

Conversation

emkll
Copy link
Contributor

@emkll emkll commented Dec 20, 2019

Closes #212
Marking as draft until #310 is merged, and this branch rebased.

Test plan

  • make all, completes without error
  • make test, all tests pass
  • Client is functional, export (printer + usb) is functional

@emkll emkll added this to Ready for Review in SecureDrop Team Board Dec 20, 2019
@emkll emkll moved this from Ready for Review to In Development in SecureDrop Team Board Dec 20, 2019
@emkll
Add deny-by-default rule for outbound qvm-rpc policies
a146260 
Provides defense-in-depth and reduces attack surface, should an attacker gain code execution in a VM.
In the future, we should explicitly approve inter-vm rpc calls.
@emkll emkll marked this pull request as ready for review December 23, 2019 15:13
@emkll emkll moved this from In Development to Ready for Review in SecureDrop Team Board Dec 23, 2019
@kushaldas kushaldas self-requested a review January 2, 2020 04:46
@kushaldas kushaldas self-assigned this Jan 2, 2020
kushaldas
kushaldas approved these changes Jan 2, 2020
View reviewed changes
Copy link
Contributor

@kushaldas kushaldas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested based on the test plan.

  • make all, completes without error
  • make test, all tests pass
  • Client is functional, export (printer + usb) is functional

This works as expected and the policy changes look good.

@kushaldas kushaldas merged commit ea443bd into master Jan 2, 2020
SecureDrop Team Board automation moved this from Ready for Review to Done Jan 2, 2020
This was referenced Jan 2, 2020
Closed
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kushaldas kushaldas kushaldas approved these changes

Assignees

@kushaldas kushaldas

Labels
None yet
Projects
No open projects
SecureDrop Team Board
Done
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Further restrict qubes-rpc policies
2 participants
@emkll @kushaldas