add qvm-service support to onion-grater systemd service file

[phabricator-migrator]

Information

ID: 884
PHID: PHID-TASK-ltx2vikg4wjp5jkfcaju
Author: nusenu
Status at Migration Time: wontfix
Priority at Migration Time: Normal

Description

Please add support for qvm-service subsustem to onion-grater. The goal of this ticket is to allow users to disable onion-grater via qvm-service for a specific deployed whonix-gw-14 AppVM via the qvm-service command.

This is usually implemented via a line like the following in the systemd service file:

ConditionPathExists=/var/run/qubes-service/onion-grater

rationale:

feature suggestion: introducing support for a minimal/hardened mode (SocksPort only)

Hi, Qubes-Whonix Gateway currently has a single mode of operations which aims to cover many different use-cases and applications and as such exposes a lot of services/ports to the AppVMs behind it: onion-grater tiny-proxy DNSPort TransPort many SocksPorts and has a rather long list of iptables rules. I’d suggest to introduce a “minimal” mode that provides everything needed for an application that just needs access to a single SocksPort with IsolateDestAddr (no DNSPort, no tiny-proxy, no oni…

related:
T879

Comments

---

Patrick

2019-04-06 18:44:19 UTC

Reducing the number of lingering, unrealistic tickets, therefore closing.

This either needs source code contributions is is realistically never going to happen.