Update dom0 about all applications installed, not only desktop files for
them. Update also suppo...

yum actions no longer relevant

* qubesos/pr/87:
tests: check if qubes-firewall-user-script is called
qubes-firewall: call f...

* qubesos/pr/90:
Stop Debian templates from forwarding by default.

* qubesos/pr/91:
bind-dirs.sh: don't fail on empty configuration directory

* qubesos/pr/92:
network: reload DNS only on "up" event from NetworkManager

When VM is set to synchronize the time with the network, to not sync its
time with clockvm.
Besi...

Add After=qubes-sysinit.service to avoid startup condition being
evaluated before initializing q...

Some more actions could be implemented even without --downloadonly
option. Ease doing so.

Qubes...

NetworkManager reports a bunch of events, reloading DNS at each of them
doesn't make sense and i...

nullglob must be active before a glob is used on a potentially empty
directory. Call shopt immed...

QubesOS/qubes-issues#3260

Call it just after creating base chains in iptables/nftables. This allow
the user to modify how ...

It is necessary to blacklist them on (almost?) any hardware, so lets do
this by default.

Fixes ...

On LVM thin provisioning this makes manual template's root fs compacting
not needed anymore.

Fi...

The most common thing to fix S3 sleep is to unload PCI devices drivers
before suspend. Instead o...

Do not use /var/run/qubes for this, as it may be non-root writeable and
someone may want to isol...

The real block-snapshot script is in qubes-core-admin.

qvm-run-vm cannot make a separate qubes.WaitForSession call for a
DispVM. Instead, pass the new ...

This is intended to be used for DispVMs for which only a single RPC call
can be made before they...

GNOME automatically set scaling factor to 2 when HiDPI is detected.
Unfortunately it does it als...

When one use scaling set by gnome tools (gsettings or
gnome-tweak-tool), gsd-xsettings must be r...

Fixes QubesOS/qubes-issues#3449

Returned dbus reference is multi-word string, it was not quoted on
purpose. ShellCheck was wrong...

* qubesos/pr/83:
qrexec: fix infinite loop when multiple services are waiting for GUI

Reported by @ctrlaltdel
Fixes QubesOS/qubes-issues#3433

This include ICMP error messages for allowed traffic.

Fixes QubesOS/qubes-issues#3406

If DNS resolution fails, just block the traffic (for this VM), but don't
crash the whole service...

There was a bug that interpreted '-' as file type. But convert don't
know how to handle '-' file...

* qubesos/pr/79:
make apt-get apt-transport-tor broken in Qubes non-networked TemplateVMs

If fork server is used, proper environment is inherited from the
session. But in other case (lik...

I have been using this with a dbus-less Gentoo template since the original
change, and have test...

fixes https://github.com/QubesOS/qubes-issues/issues/3403

It is more robust, especially handle "# Units below this line will be
re-preset on package upgra...

(cherry picked from commit 51f80d39a1064dd6075ccf6af1d5ba78fba6327c)

qvm-{copy,move} run qvm-{copy,move}-to-vm with $default as the VM
argument. Don't print the depr...

* qubesos/pr/76:
Fix language issues and usability issue

* qubesos/pr/72:
Fix UCA mistake and qvm-actions script
Fix ShellCheck comments
Add debian...

Fixes QubesOS/qubes-issues#3251

It could be used to poison neighbor table...

QubesOS/qubes-issues#718

Chain name in IPv6 cannot be longer than 29 chars, so strip IPv6 prefix
from it.
ICMP on IPv6 is...

If IPv6 is configured in the VM, and it is providing network to others,
apply IPv6 firewall simi...

If dom0 expose IPv6 address settings, configure it on the interface.
Both backend and frontend s...

* qubesos/pr/67:
archlinux fix .service added twice in networking install script
Makefile: i...

It tries to connect to cups every second and doesn't do anything else
when cups is disabled. So ...

Start qubes-firewall (which will add "DROP by default" rule) before
enabling IP forwarding, to n...

* qubesos/pr/74:
Add iptables dep to qubes-core-agent-networking RPM spec

* qubesos/pr/69:
Fix the Archlinux template update proxy to work for HTTPS URLs as well

In some cases it may make sense to enfoce outgoing firewall also on
sys-net. If the service is d...

Let dom0 decide whether it should be enabled or not, regardless of PCI
devices or any other fact...

When qubes-firewall service is started, modify firewall to have "DROP"
policy, so if something g...

Only the Debian package had declared the dependecy. And apparently,
fedora-26-minimal does not i...

Also improve package description and comments.

* qubesos/pr/71:
Fix Ubuntu template builds

4.0 template builds use `<package>.install` files with dh_install. The
differences between Debi...

Fix one of the issue described in the following commit:
https://github.com/QubesOS/qubes-issues/...

Fix redundant presence of NetworkManager dropins both
in qubes-vm-core and qubes-vm-networking
(...

* qubesos/pr/63:
archlinux: restore setup of pam.d/su-l
archlinux: remove python3 dependency...

* qubesos/pr/64:
Disable dnf plugins when downloading dom0 updates in sys-firewall

systemd-timesyncd.service isn't enough, for various reasons:
- it is started too early in the b...

Since the qubes-download-dom0-updates script executes dnf with fakeroot, some dnf plugins like e...

qubes-gui agent calls su-l instead of initializing its own pam
session such as qrexec.
pam.d/su-...

Create an empty [options] dropin by default or pacman will fail
when no dropin is present

The bash/zsh bug should not be present anymore in Qubes 4.0
as discussed in the issue 2888.
(htt...

Locales must be setup properly in the template.

The related bug should have been fixed in issue #2903
(https://github.com/QubesOS/qubes-issues/i...