Add prohibit-start to Qube Settings GUI.

Author: alimirjamali

qubesmanager/qube_manager.py

@@ -198,7 +198,7 @@ def helpEvent(self, event, view, option, index):
                 QToolTip.showText(event.globalPos(),
                     self.tr(
                         "The qube is prohibited from starting\n"
-                        "See `qvm-features` manual for more information"
+                        "Prohibition rationale is available in qube settings -> Advanced tab"
                     ),
                     view
                 )

qubesmanager/settings.py

@@ -951,6 +951,17 @@ def __init_advanced_tab__(self):
             self.run_in_debug_mode.setVisible(False)
             self.run_in_debug_mode.setEnabled(False)
 
+        rationale = utils.get_feature(self.vm, "prohibit-start", "")
+        self.prohibit_start_rationale.setText(rationale)
+        self.prohibit_start_rationale.setVisible(bool(rationale))
+        self.prohibit_start_rationale.textEdited.connect(
+            lambda x: self.prohibit_start_checkbox.setChecked(bool(x))
+        )
+        self.prohibit_start_checkbox.setChecked(bool(rationale))
+        self.prohibit_start_checkbox.stateChanged.connect(
+            lambda x: self.prohibit_start_rationale.setVisible(bool(x))
+        )
+
         utils.initialize_widget(
             widget=self.allow_fullscreen,
             choices=[
@@ -1070,6 +1081,17 @@ def __apply_advanced_tab__(self):
         except qubesadmin.exc.QubesException as ex:
             msg.append(str(ex))
 
+        rationale = self.vm.features.get("prohibit-start", "")
+        if (self.prohibit_start_checkbox.isChecked() != bool(rationale)) or (
+            bool(rationale)
+            and self.prohibit_start_rationale.text() != rationale
+        ):
+            rationale = self.prohibit_start_rationale.text()
+            if bool(rationale) and self.prohibit_start_checkbox.isChecked():
+                self.vm.features["prohibit-start"] = rationale
+            else:
+                del self.vm.features["prohibit-start"]
+
         if self.allow_fullscreen_initial !=\
                 self.allow_fullscreen.currentIndex():
             try:

qubesmanager/tests/test_vm_settings.py

@@ -907,6 +907,40 @@ def test_212_boot_from_device(mock_boot, mock_start, settings_fixture):
     mock_start.assert_called_with(['--cdrom', mock.ANY, vm.name])
 
 
+@check_errors
+@pytest.mark.parametrize("settings_fixture", TEST_VMS, indirect=True)
+def test_213_prohibit_start(settings_fixture):
+    settings_window, page, vm_name = settings_fixture
+    vm = settings_window.qubesapp.domains[vm_name]
+
+    r = vm.features.get("prohibit-start", "")
+    assert settings_window.prohibit_start_checkbox.isChecked() == bool(r)
+    assert settings_window.prohibit_start_rationale.text() == r
+
+    settings_window.prohibit_start_checkbox.setChecked(not bool(r))
+
+    if bool(r):
+        settings_window.prohibit_start_rationale.setText("")
+        expected_call = (
+            vm.name,
+            "admin.vm.feature.Remove",
+            "prohibit-start",
+            None,
+        )
+    else:
+        settings_window.prohibit_start_rationale.setText("RATIONALE")
+        expected_call = (
+            vm.name,
+            "admin.vm.feature.Set",
+            "prohibit-start",
+            "RATIONALE".encode(),
+        )
+
+    assert expected_call not in settings_window.qubesapp.actual_calls
+    settings_window.qubesapp.expected_calls[expected_call] = b"0\x00"
+    settings_window.accept()
+
+
 # FIREWALL TAB
 
 @check_errors

ui/settingsdlg.ui

@@ -742,14 +742,32 @@ border-width: 1px;</string>
               <property name="topMargin">
                <number>15</number>
               </property>
-              <item row="2" column="0">
+              <item row="2" column="0" colspan="2">
+               <layout class="QHBoxLayout" name="horizontalLayout_prohibit_start">
+                <item>
+                 <widget class="QCheckBox" name="prohibit_start_checkbox">
+                  <property name="text">
+                   <string>Prohibit start</string>
+                  </property>
+                 </widget>
+                </item>
+                <item>
+                 <widget class="QLineEdit" name="prohibit_start_rationale">
+                  <property name="placeholderText">
+                   <string>Start prohibition rationale (mandatory)</string>
+                  </property>
+                 </widget>
+                </item>
+               </layout>
+              </item>
+              <item row="3" column="0">
                <widget class="QCheckBox" name="provides_network_checkbox">
                 <property name="text">
                  <string>Provides network</string>
                 </property>
                </widget>
               </item>
-              <item row="3" column="0">
+              <item row="4" column="0">
                <widget class="QCheckBox" name="dvm_template_checkbox">
                 <property name="toolTip">
                  <string>&lt;html&gt;&lt;head/&gt;&lt;body&gt;&lt;p&gt;Allows using this qube as a template for disposables. Disposables will inherit the qube's state (configuration, installed programs, etc.), but their state will not persist between restarts. &lt;/p&gt;&lt;p&gt;Setting this option will cause this qube to be listed as an option in the &amp;quot;Default disposable template&amp;quot; list for all other qubes.&lt;/p&gt;&lt;p&gt;Only AppVMs and StandaloneVMs could be turned in to Disposable Templates&lt;/p&gt;&lt;/body&gt;&lt;/html&gt;</string>