Hi,
I created 30-user.policy file in /etc/qubes/policy.d/ with the following:
qubes.OpenInVM * personal @dispvm allow
*** Also tried Personal - same results
And was expecting to open any file within the default personal VM in disposable VM, but it opens up within the personal.
What am I doing wrong, please?
*** I use 4.1.2 version
Does this help:
If you’re using the GUI file manager in personal, you have to right-click on the file and select “[View/Edit] In DisposableVM.” If you simply double-click on the file, it’ll still open in personal.
Not really.
This is the default. I’m talking about something else.
Sorry, I don’t understand what you mean.
I mean that by default there’s an option to open a file in a disposable VM via the GUI and that I want to manage it via the RPC policies instead of the previously suggested mimeapps and desktop entry files within each and every appVM.
The RPC policies are rules to tell Qubes OS what is allowed or not.
They are not behaviours.
To open all files in disposable, you have to use the desktop files.
This is how linux works.
That doesn’t add up with this tutorial: https://github.com/Qubes-Community/Contents/blob/master/docs/common-tasks/opening-urls-in-vms.md
Or am I getting it wrong?
It does.
“They are not behaviours.” was maybe not the right terms.
The RPC policies don’t say what to do, but how to do it and what is allowed or not.
From the link:
Qubes RPC policies control which RPC services are allowed between qubes.
You define your rules (Sample RPC user policy)
You configre how application handle theirs files (Configuring application handlers)
Yeah, the RPC policies cannot single-handedly do what you want. That is not their function or purpose. Rather, they control what is allowed or permitted to occur between different qubes. For example, your rule makes it so that the personal qube is now authorized to open files in a disposable, but that does not mean that it will happen automatically. As an analogy, getting a driver’s license means you are now authorized to drive, but you still need access to a car, and you still have to operate the vehicle.
But what’s the point in these “examples” of RPC policies in the link above if without any of them, by default, I can launch personal VM and edit a file in disposable VM? This doesn’t add up at all.
What doesn’t add up?
It states clearly on that page:
The policies control what the qrexec calls can do - you have to have
some mechanism for generating those qrexec calls. qvm-open-in-vm is
such a mechanism, and there is a default policy predefined for
in /etc/qubes/policy.d/90-default.policy .
The examples show how you can control the qrexec action in different
ways, overriding the default.
Does that make things clear?
You could think of a completely new qrexec service:
First you define the new service.
Then you have to set policy for it.