Persistent qrexec policy daemon

[DemiMarie]

Qubes OS version:

R4.0

Affected component(s):

qubes-core-admin

---

Steps to reproduce the behavior:

1. Run qvm-ls
2. Note the time it takes

Expected behavior:

qvm-ls is fast

Actual behavior:

qvm-ls is slow

General notes:

The problem seems to be that every qrexec call starts a new Python process. I propose that this be replaced by a persistent daemon. The daemon will listen on a Unix domain socket and maintain an in-memory cache of all qrexec policy files. inotify will be used to notify the daemon when these change. Additionally, whenever the machine is awake, the daemon will reload its configuration every minute or so, to ensure that it stays up-to-date.

---

Related issues:

[marmarek]

Do you mean qvm-ls in dom0 or in some VM (with appropriate permissons for qrexec calls)? In case of dom0, it already use local socket and qrexec policy is not involved at all. But in case of VM, your diagnosis is correct.

Generally:

• the idea you propose is good (with slightly different details about updating the info), this is what we plan to implement when time allows
• this is a duplicate of Qubes 4 Admin API is way too inefficient #3293 (comment), lets move the discussion there

[andrewdavidwong]

Duplicate of #3293

[DemiMarie]

I actually have the problem when making the calls from dom0. They are still slow.

…

On Sun, Apr 29, 2018, 6:43 PM Marek Marczykowski-Górecki < ***@***.***> wrote: Do you mean qvm-ls in dom0 or in some VM (with appropriate permissons for qrexec calls)? In case of dom0, it already use local socket and qrexec policy is not involved at all. But in case of VM, your diagnosis is correct. Generally: - the idea you propose is good (with slightly different details about updating the info), this is what we plan to implement when time allows - this is a duplicate of #3293 (comment) <#3293 (comment)>, lets move the discussion there — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#3868 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AGGWB0tYIToD3q5YLVAb26OJCLy78T26ks5ttkIRgaJpZM4Tr9Jl> .

[marmarek]

Ok, but in case of dom0, qrexec policy is not involved at all.