onion-grater-merger should support different hosts

nyxnor · October 20, 2022, 7:17pm

I didn’t test yet but it appears hosts are not being included

Whonix/onion-grater/blob/master/usr/lib/onion-grater#L64


      
          #   with `*` matching anything. While this matcher always works for binaries,
          #   it only works for scripts with an enabled AppArmor profile (not
          #   necessarily enforced, complain mode is good enough).
          #
          # * `users`: a list of strings, each describing the user of the
          #   client with `*` matching anything.
          #
          # For remote (non-local) clients, the following qualifiers are
          # relevant:
          #
          # * hosts: a list of strings, each describing the IPv4 address
          #   of the client with `*` matching anything.
          #
          # A filter can serve both local and remote clients by having
          # qualifiers of both types.
          #
          # `commands` (optional) is a list where each item is a dictionary with
          # the obligatory `pattern` key, which is a regular expression that is
          # matched against the full argument part of the command. The default
          # behavior is to just proxy the line through if matched, but it can be
          # altered with these keys:

github.com

Whonix/onion-grater/blob/master/usr/lib/onion-grater-merger#L23


      
          ## Creates <code>/etc/onion-grater.d/30_autogenerated.yml</code>.
          ##
          ## Only known use so far is by Whonix.
          #### meta end
          
          
import glob
          import yaml
          import os
          
          
# Override elements
          no_merge_elements = ['suppress','match-hosts']
          # Override elements with fixed value
          fixed_value_elements = {'match-exe-paths':'*','match-users':'*'}
          
          
def merge_yml(final_obj, parsing_obj):
             # Inputs - 2 dictionaries/list from YML/YAML file
             # "parsing_obj" is parsed and merged into "final_obj" and returned back
             if isinstance(final_obj,dict) and isinstance(parsing_obj,dict):
                for k,v in parsing_obj.items():
                   if k not in final_obj:
                      final_obj[k] = v

This would favor Multiple Workstations and each one receiving a different set of rules of the controller set by onion-grater.

Requires onion-grater-merger support.