How to get QREXEC_* environment variables in systemd service?

1choice · June 4, 2023, 12:48pm

I want to run:
/usr/lib/qubes/qrexec-client-vm --filter-escape-chars-stderr -- myVM user.Test /usr/lib/qubes/qfile-unpacker
Using systemd service but it fails because qfile-unpacker need to get QREXEC_REMOTE_DOMAIN environment variable to work:

github.com

QubesOS/qubes-core-agent-linux/blob/master/qubes-rpc/qfile-unpacker.c#L61


      
          if (argc >= 3) {
              errno = 0;
              uid = strtol(argv[1], NULL, 10);
              if (errno)
                  gui_fatal("Invalid user ID argument");
              home_dir = prepare_creds_return_dir(uid);
              incoming_dir = argv[2];
          } else {
              uid = getuid();
              home_dir = prepare_creds_return_dir(uid);
              remote_domain = getenv("QREXEC_REMOTE_DOMAIN");
              if (!remote_domain) {
                  gui_fatal("Cannot get remote domain name");
              }
          
          
    if (asprintf(&incoming_dir_root, "%s/%s", home_dir, INCOMING_DIR_NAME) < 0) {
                  gui_fatal("Error allocating memory");
              }
              mkdir(incoming_dir_root, 0700);
              if (asprintf(&incoming_dir, "%s/%s", incoming_dir_root, remote_domain) < 0)
                  gui_fatal("Error allocating memory");

And it seems that the QREXEC_* environment variables are somehow set from dom0 for started app in VM (passed with qrexec call?) and they are missing if the process is not started from qrexec.
Is there a way to somehow get these environment variables in systemd service?

1choice · June 4, 2023, 12:54pm

Right now I manually set the variable and it works:
Environment=QREXEC_REMOTE_DOMAIN=dom0
But it’s not a proper way because correct QREXEC_REMOTE_DOMAIN value may be changed in the future.

1choice · June 6, 2023, 6:35pm

QREXEC_REMOTE_DOMAIN is used by qfile-unpacker only to set the directory name in QubesIncoming to which the files will be copied so the value of QREXEC_REMOTE_DOMAIN is not that important in this case.