GUID: display message to the user if one of the VERIFY macro fails

[joanna]

... rather than silently exit()ing the guid.

Include as much info about the situation that casued this (window name, which VERIFY macro failed, what where the actual values), as possible.

[marmarek]

The only sensible information available for VERIFY is VM name, especially not every message is about specific window (eg clipboard copy). Anyway trusting any value (eg window XID, to get window name from Xorg) in message _detected as malicious_ isn't good idea.
Of course failed condition will be included in message.

[marmarek]

​http://git.qubes-os.org/?p=marmarek/gui.git;a=commit;h=3350efa82c5f4a423596d95f4f80237f7c73ee52

[joanna]

This doesn't work!

handle_configure_from_vm, local 0x2e00010 remote 0x18000ec, 421/3851, was 421/900, ovr=1, xy 1179/-3637, was 0/0
sh: -c: line 0: syntax error near unexpected token `('
sh: -c: line 0: `kdialog --yesnocancel 'VMapp "rflab" has sent invalid message, it shouldn't normally happend. Condition: (int) untrusted_conf.y >= -g->root_height && (int) untrusted_conf.y <= 2 * g->root_height. Do you want to terminate this VM immediately? "No" will terminate only GUI daemon, cancel will just ignore this message''
release_all_mapped_mfns running

[joanna]

Now (2.0.4) I can see the dialog window, but... it's essentially useless, as I cannot cancel it, because immediately after I click Cancel, a new window appears asking about the same...

Besides, the message in the dialogue box should be:

The domain $(vmname) attempted to perform an invalid or suspicious GUI request. This might be a sign that the domain has been compromised and is attempting to compromise the GUI daemon (Dom0 domain). In rare cases, however, it might be possible that a legitimate application trigger such condition (check the guid logs for more information).

Click "Terminate" to terminate this domain immediately, or "Ignore" to ignore this condition check and allow the GUI request to proceed, or "Ignore All" to ignore all further checks for this condition.

Buttons:
1) Terminate (default)
2) Ignore
3) Ignore All

[marmarek]

"Ignore All" isn't trivial to implement. Should I do it at price of some complexity in security sensitive code?

PS Cancel action already fixed, but not pushed yet.

[joanna]

Ok, let's skip the Ignore All button for now. Let's see how this will work out after we remove this one "stupid" check...

[marmarek]

​http://git.qubes-os.org/?p=marmarek/gui.git;a=commit;h=d815d24c4f5301244f0a629816b418350d5cedbe

[joanna]

Hehe, still doesn't work:

Verify failed: (int) untrusted_shmcmd->width < 4096 && (int) untrusted_shmcmd->height < 3072
kdialog: Unknown option '-label'.
kdialog: Use --help to get a list of available command line options.
Problems executing kdialog ?

[marmarek]

Ah, we have to old version of kdialog in dom0, which doesn't support button label changing (in opposite to version provided by FC14, which supports it).
So we have two generic options (marked default choice): Yes/*No* or *Continue*/Cancel.
Which option use?

[joanna]

I think Continue/Cancel? is more descriptive, than Yes/No? (of course, nobody will read the text in dialog, right? ;)

[marmarek]

It has continue as default option... of course it will be the user fault if it choose "continue" for really malicious operation.

[joanna]

:/ Can we set "Cancel" as default?

[marmarek]

Not in this version of kdialog...

BTW I've just found that kdialog supports "do not ask again" feature, which can be easily used here (instead of "Ignore All" button). Check:

kdialog --dontagain qubes-guid-vmname:verify-condition --warningyesno "text" 

If user checks "do not again option", future kdialog calls (with the same ID passed to --dontagain option) silently respond with saved choice.

[marmarek]

So maybe we should use Yes/No? version (which has "No" as default) with question like "Do you allow this VM to continue running?" or sth like this?

[joanna]

Aha, co "NO", can be set as a default, but "Cancel" not? Well, ok then.

[marmarek]

There are hardcoded defaults for each dialog type (at lest in this version of kdialog)...

[marmarek]

​http://git.qubes-os.org/gitweb/?p=marmarek/gui.git;a=commit;h=178849c85c39f65b80225f23f4d4a83b709caefe

And "dont ask again" feature:
​http://git.qubes-os.org/gitweb/?p=marmarek/gui.git;a=commit;h=b4fddf1660e320128b9052b4db6d6977ff196c2a