Add the feature to prohibit starting a qube

Qube Manager part of preventing qubes with `prohibit-start` from being
started. Showing special status icon and disabling start and related
buttons.

Supplements: QubesOS/qubes-issues#9622

qubesmanager/qube_manager.py

@@ -103,13 +103,16 @@ def __init__(self):
                 "Halted" : QIcon(":/blank")
                 }
         self.outdatedIcons = {
+                "blocked" : QIcon(":/ban"),
                 "update" : QIcon(":/updateable"),
                 "outdated" : QIcon(":/outdated"),
                 "to-be-outdated" : QIcon(":/outdated"),
                 "eol": QIcon(':/warning'),
                 "skipped": QIcon(':/skipped')
                 }
         self.outdatedTooltips = {
+                "blocked" : self.tr(
+                    "The qube is prohibited from being started"),
                 "update" : self.tr("Updates available"),
                 "outdated" : self.tr(
                     "The qube must be restarted for recent changes in "
@@ -239,6 +242,12 @@ def update_power_state(self):
 
         self.state['outdated'] = ""
         try:
+            if manager_utils.get_feature(
+                    self.vm, 'prohibit-start', False):
+                # Special case where being outdated, eol & skipped is irrelevant
+                self.state['outdated'] = 'blocked'
+                return
+
             if manager_utils.is_running(self.vm, False):
                 if hasattr(self.vm, 'template') and \
                         manager_utils.is_running(self.vm.template, False):
@@ -253,6 +262,9 @@ def update_power_state(self):
 
             if self.vm.klass in {'TemplateVM', 'StandaloneVM'}:
                 if manager_utils.get_feature(
+                        self.vm, 'prohibit-start', False):
+                    self.state['outdated'] = 'blocked'
+                elif manager_utils.get_feature(
                         self.vm, 'skip-update', False):
                     self.state['outdated'] = 'skipped'
                 elif manager_utils.get_feature(
@@ -879,6 +891,10 @@ def __init__(self, qt_app, qubes_app, dispatcher, _parent=None):
                                self.on_domain_updates_available)
         dispatcher.add_handler('domain-feature-delete:skip-update',
                                self.on_domain_updates_available)
+        dispatcher.add_handler('domain-feature-set:prohibit-start',
+                               self.on_domain_updates_available)
+        dispatcher.add_handler('domain-feature-delete:prohibit-start',
+                               self.on_domain_updates_available)
 
         self.installEventFilter(self)
 
@@ -1125,6 +1141,9 @@ def check_updates(self, info=None):
         try:
             if info.vm.klass in {'TemplateVM', 'StandaloneVM'}:
                 if manager_utils.get_feature(
+                        info.vm, 'prohibit-start', False):
+                    info.state['outdated'] = 'blocked'
+                elif manager_utils.get_feature(
                         info.vm, 'skip-update', False):
                     info.state['outdated'] = 'skipped'
                 elif manager_utils.get_feature(
@@ -1352,6 +1371,17 @@ def table_selection_changed(self):
             if not vm.updateable and vm.klass != 'AdminVM':
                 self.action_updatevm.setEnabled(False)
 
+            if vm.vm.features.get('prohibit-start', False):
+                self.action_open_console.setEnabled(False)
+                self.action_resumevm.setEnabled(False)
+                self.action_startvm_tools_install.setEnabled(False)
+                self.action_pausevm.setEnabled(False)
+                self.action_restartvm.setEnabled(False)
+                self.action_killvm.setEnabled(False)
+                self.action_shutdownvm.setEnabled(False)
+                self.action_updatevm.setEnabled(False)
+                self.action_run_command_in_vm.setEnabled(False)
+
         self.update_template_menu()
         self.update_network_menu()
 

resources.qrc

@@ -3,6 +3,7 @@
     <file alias="add">icons/add.svg</file>
     <file alias="apps">icons/apps.svg</file>
     <file alias="backup">icons/backup.svg</file>
+    <file alias="ban">icons/ban.svg</file>
     <file alias="blank">icons/blank.svg</file>
     <file alias="checked">icons/checked.svg</file>
     <file alias="checkmark">icons/checkmark.svg</file>