33 lines
1012 B
Bash
33 lines
1012 B
Bash
#!/bin/bash
|
|
# Run in dom0 to allow the "nostr" qube to call n_signer without a Qubes popup.
|
|
|
|
set -euo pipefail
|
|
|
|
POLICY_FILE="/etc/qubes/policy.d/40-nsigner.policy"
|
|
SIGNER_QUBE="nostr_signer"
|
|
CALLER_QUBE="nostr"
|
|
SIGNER_TAG="nsigner-signer"
|
|
|
|
echo "Installing n_signer qrexec policy..."
|
|
sudo mkdir -p /etc/qubes/policy.d
|
|
sudo tee "$POLICY_FILE" >/dev/null <<EOF
|
|
# Qubes OS qrexec policy for nsigner
|
|
qubes.NsignerRpc * ai @tag:${SIGNER_TAG} allow target=${SIGNER_QUBE}
|
|
qubes.NsignerRpc * ${CALLER_QUBE} @tag:${SIGNER_TAG} allow target=${SIGNER_QUBE}
|
|
qubes.NsignerRpc * @anyvm @tag:${SIGNER_TAG} ask default_target=${SIGNER_QUBE}
|
|
qubes.NsignerRpc * @anyvm @anyvm deny
|
|
EOF
|
|
sudo chmod 0644 "$POLICY_FILE"
|
|
|
|
echo "Tagging ${SIGNER_QUBE} as ${SIGNER_TAG}..."
|
|
qvm-tags "$SIGNER_QUBE" add "$SIGNER_TAG"
|
|
|
|
echo
|
|
echo "Installed policy:"
|
|
sudo cat "$POLICY_FILE"
|
|
echo
|
|
echo "Tags on ${SIGNER_QUBE}:"
|
|
qvm-tags "$SIGNER_QUBE" list
|
|
echo
|
|
echo "Done. Calls from ${CALLER_QUBE} to ${SIGNER_QUBE} are now allowed without a Qubes popup."
|