sd-devices should not need to open in disposables

[deeplow]

Description

Even though sd-devices has default_dispvm set to None, it can still open files in disposables due to qrexec policy:

qubes.OpenInVM  * sd-devices @dispvm:sd-viewer allow

From what I can see, this behavior was originally introduced here without much explanation. It should not have many negative consequences other than extra resource consumption potential. But if it does not fit a purpose, it should not exist.

Steps to Reproduce

SDW 1.0.0

Open terminal in sd-devices and open a file in disposable qvm-open-in-dvm

Expected Behavior

Not allowed.

Actual Behavior

Disposable opened.

[legoktm]

Given that USB devices with source material are attached to sd-devices, if someone clicks on a file on a USB, what do we want to happen? It seems reasonable to me that source material is always opened in sd-viewer and not something else.

[deeplow]

I had not considered that use-case. Is viewing files on sd-devices something we want to encourage / support? I generally see sd-devices more as an outflow. But maybe there is the case that someone wants to check if they really exported the right file. I guess at this point this is a UX question more than anything else.

If this is something we do not intend (and generally don't expect users to be taking advantage of this "feature"), my suggestion would be to just not open the files anywhere instead of opening in sd-viewer. However, if it's already being used, we should have this use-case explicit in the docs / code.

[legoktm]

I personally don't think of it as a genuine use case, but more like, given that users have the technical ability to open source material in this VM, if they do so accidentally or purposefully, would we rather have it open in sd-devices or sd-viewer?

[deeplow]

I get your point 🙂. But if we have the possibility to simply make it not open at all with the same mechanism we use to open in a disposable (via a .desktop file that simply runs true, for example), wouldn't it be a better option not to open at all compared to opening in sd-viewer? I don't think we're gain more control by opening in a disposable, especially if the mime handling selection is the same.