Remove internal qubes from being target of ask

For: QubesOS/qubes-issues#1512

Author: ben-grande

qrexec/policy/parser.py

@@ -1875,6 +1875,14 @@ def collect_targets_for_ask(self, request):
         if source_uuid in targets:
             targets.remove(source_uuid)
 
+        for unwanted_target in targets.copy():
+            if unwanted_target.startswith("@dispvm:"):
+                unwanted_target_name = unwanted_target[len("@dispvm:") :]
+            else:
+                unwanted_target_name = unwanted_target
+            if info[unwanted_target_name].get("internal", False):
+                targets.remove(unwanted_target)
+
         return targets
 
 

qrexec/tests/policy_parser.py

@@ -87,6 +87,24 @@
             "power_state": "Halted",
             "uuid": "f3e538bd-4427-4697-bed7-45ef3270df21",
         },
+        "default-mgmt-dvm": {
+            "internal": True,
+            "tags": [],
+            "type": "AppVM",
+            "default_dispvm": "default-dvm",
+            "template_for_dispvms": True,
+            "power_state": "Halted",
+            "uuid": "f3e538bd-4427-4697-bed7-45ef3270df22",
+        },
+        "internal-vm": {
+            "internal": True,
+            "tags": [],
+            "type": "AppVM",
+            "default_dispvm": "default-dvm",
+            "template_for_dispvms": False,
+            "power_state": "Halted",
+            "uuid": "f3e538bd-4427-4697-bed7-45ef3270df23",
+        },
         "test-invalid-dvm": {
             "tags": ["tag1", "tag2"],
             "type": "AppVM",
@@ -326,9 +344,12 @@ def test_021_Target_expand(self):
             [
                 "@dispvm",
                 "@dispvm:default-dvm",
+                "@dispvm:default-mgmt-dvm",
                 "@dispvm:test-vm3",
                 "@dispvm:test-vm4",
                 "default-dvm",
+                "default-mgmt-dvm",
+                "internal-vm",
                 "test-invalid-dvm",
                 "test-no-dvm",
                 "test-relayvm1",
@@ -355,9 +376,12 @@ def test_021_Target_expand(self):
                 "@adminvm",
                 "@dispvm",
                 "@dispvm:default-dvm",
+                "@dispvm:default-mgmt-dvm",
                 "@dispvm:test-vm3",
                 "@dispvm:test-vm4",
                 "default-dvm",
+                "default-mgmt-dvm",
+                "internal-vm",
                 "test-invalid-dvm",
                 "test-no-dvm",
                 "test-relayvm1",
@@ -381,17 +405,19 @@ def test_021_Target_expand(self):
         self.assertCountEqual(
             parser.Target("@type:AppVM").expand(system_info=self.system_info),
             [
+                "default-dvm",
+                "default-mgmt-dvm",
+                "internal-vm",
+                "test-invalid-dvm",
+                "test-no-dvm",
+                "test-relayvm1",
                 "test-vm1",
                 "test-vm2",
                 "test-vm3",
                 "test-vm4",
-                "default-dvm",
-                "test2-vm1",
                 "test2-relayvm1",
                 "test2-relayvm2",
-                "test-invalid-dvm",
-                "test-no-dvm",
-                "test-relayvm1",
+                "test2-vm1",
             ],
         )
         self.assertCountEqual(