QubesOS in Emacs Org Mode: Link to files of other qubes

Surprisingly, qubes does not ship with a qrexec service with which qube A can instruct qube B to open one of qube B's files. qvm-open-in-vm does something slightly different: It enables you to copy a file from qube A to qube B and then open it in qube B.

qvm-open-in-vm also allows opening a URL in the target qube. My initial thought was: "Great, I can just pass a file:// URL to qvm-open-in-vm (for example, file:///home/user/Documents/article.pdf) and that should lead to the target qube opening the corresponding file". This almost works, but qvm-open-in-vm restricts the types of URLs that can be used with it, and file:// URLs aren't one of them. So, we need to copy and slightly modify the service.

First, in my template qube, I created a copy of /etc/qubes-rpc/qubes.OpenURL to /etc/qubes-rpc/my.OpenURL. The original lists three different allowed URL schemes (http://, https://, ftp://). These simply needed to be extended with the additional file:// scheme. The result looks like this.

#!/usr/bin/sh

read -r url

case "$url" in
    http://*|\
    https://*|\
    ftp://*|\
    file://*)
        exec qubes-open "$url"
        ;;
    *)
        echo "Invalid URL" >&2
        exit 1
        ;;
esac

Next, still in my template qube, I created a copy of /usr/bin/qvm-open-in-vm to /usr/bin/my-open-in-vm. In that program, I simply needed to replace every occurrence of qubes.OpenURL with my.OpenURL and every occurrence of qvm-open-in-vm with my-open-in-vm.

Finally, I created a policy file in dom0, at /etc/qubes-rpc/policy/my.OpenURL. Mine looks like this.

personal work allow
@anyvm @anyvm ask

This means that my personal qube is automatically allowed to call the service on my work qube. Any qube can ask for permission to call the service on any other qube.

After shutting down your template qube and restarting your qubes that depend on it, you can test the service by running

$ my-open-in-vm targetvm file:///path/to/file

in a qube of your choice.

The following qrexec service returns a list of possible auto completions for a given path. It consists of the following parts.

/etc/qubes-rpc/my.Ls:

#!/bin/bash

read args
output="$(ls -d -p $args*)"
status="$?"
echo "$status"
echo "$output"

/usr/bin/my-ls-client:

#!/bin/bash

echo $@
read status
if [ "$status" -ne 0 ]; then
    exit $status
else
    exec cat >&$SAVED_FD_1
fi

/usr/bin/my-ls:

#!/bin/bash

qube="$1"
args=${@:2}

qrexec-client-vm "$qube" my.Ls /usr/bin/my-ls-client $args

You can test the service by running

$ my-ls targetvm /path/to/compl

in a qube of your choice. Don't forget that you need to create a qrexec policy in dom0, as described in the previous section.