After reinstallation: Secretly activated root?

Ionixx · July 20, 2026, 10:00pm

Hello,

I have installed a Qubes-Whonix system (Qubes 4.3.1) and a clone of it on my computer and have encountered a strange problem. I can’t determine whether it is related to a compromise or not:

In the Whonix clone and after some time also in the actual Whonix system, a called Disposable-VM closed again after a few seconds, even before the window appeared. A restart did not solve the problem.

As a result, I decided to perform a fresh installation of the original Whonix system and create the clone from it. Now it works again, but I noticed something while analyzing the update logs:

…
Fetching 285 packages [154.34 MiB]
Fetched.
/usr/lib/python3/dist-packages/apt/cache.py:410: Warning: W:Download is performed unsandboxed as root as file ‘/var/cache/apt/archives/partial/dpkg-dev_1.22.22_all.deb’ couldn’t be accessed by user ‘_apt’. - pkgAcquire::Run (13: Permission denied)
res = fetcher.run()
Updating packages.
Preconfiguring packages …

When updating both the Whonix Gateway and the Workstation, the following message appears at the beginning, which has not appeared before: In my assessment, this means that for some reason, root privileges are in effect and “apt” was bypassed during the download. This would make the download potentially unsafe, as the apt sandbox function is missing. What’s the deal with that? During the initial installation of Qubes 4.3, I had disabled the root account.

Thank you very much for the information and opinions on this.

arraybolt3 · July 20, 2026, 11:57pm

This happens to me any time I try to install a package from the local filesystem using sudo apt install ./whatever.deb. My guess is that /var/cache/apt/archives/partial is a place where partially downloaded files are placed, and that the updater had to fetch a file out of that location as part of the update process. I’ve seen that directory on many systems, it’s normal.