Problem: I have a command that runs qvm-firewall -r <qube> for all running qubes. It shows any qubes disconnected from the internet via having no netvm as having one ‘accept’ rule which, while fine from a security standpoint, is bad from a UI standpoint because a user glancing at the output has no indication that this qube actually does not connect to the internet.
Expected behavior: It should show an indication of some sort for qubes not currently connected to the internet and should have a way of showing that this qube is disconnected.
Current behavior: User cannot tell how all qubes connect via qvm-firewall, as qubes without a NetVM look like unrestricted qubes.
Proposed solutions: show warning that qube is disconnected, add flag to show rules instead (preferred), output nothing (undesirable), change firewall to deny all when disconnected for UI purposes (also undesirable), some other combination of the above