Notify users on clipboard paste denied by policies #165
Conversation
OpenQA test summaryComplete test suite and dependencies: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2025070405-4.3&flavor=pull-requests Test run included the following:
New failures, excluding unstableCompared to: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2025061004-4.3&flavor=update
Failed tests15 failures
Fixed failuresCompared to: https://openqa.qubes-os.org/tests/142375#dependencies 11 fixed
Unstable testsPerformance TestsPerformance degradation:5 performance degradations
Remaining performance tests:67 tests
|
gui-daemon/xside.c
Outdated
| return 1; | ||
| } | ||
| if (!evaluate_clipboard_policy(g)) { | ||
| show_message(g, "ERROR", "Pasting to this qube is denied by policies", NOTIFY_EXPIRES_DEFAULT); |
There was a problem hiding this comment.
It isn't necessarily about "pasting to this qube", it's also about from where the clipboard is. So, maybe include the source name in the message too?
Alternatively, make qrexec notify the user, as it's done for normal services. It's mostly about this line: https://github.com/QubesOS/qubes-core-qrexec/blob/main/qrexec/tools/qrexec_policy_exec.py#L405.
While theoretically enabling notifications for all "just_evaluate" (denied) calls is not a good idea, in practice that "just_evaluate" mode is currently used only for clipboard operations, so maybe it's still one-line change?
There was a problem hiding this comment.
It isn't necessarily about "pasting to this qube", it's also about from where the clipboard is. So, maybe include the source name in the message too?
This is done
While theoretically enabling notifications for all "just_evaluate" (denied) calls is not a good idea, in practice that "just_evaluate" mode is currently used only for clipboard operations, so maybe it's still one-line change?
Maybe in future, it might be necessary to just_evaluate for other operations? So lets do not burn options?
alimirjamali
force-pushed
the
issue-9978-paste-deny
branch
from
486cf80 to
15d9ed0
Compare
|
@marmarek Something is confusing. I have: and it is still possible to paste clipboard from |
|
3 participants
resolves: QubesOS/qubes-issues#9978