Default DispVM Bug

Qubes-Whonix
1

When I create an AppVM with whonix-ws-16 as the TemplateVM then the AppVM has its default DispVM set to whonix-ws-16-dvm. If I then clone whonix-ws-16 and use the clone as the TemplateVM, the AppVM does not have its default DispVM set to whonix-ws-16-dvm.
I don’t have time to play around with my system too much but in my case the default DispVM is being set to none (which happens to be my default global setting).

What concerns me most about this is that it implies cloning a TemplateVM is not creating a perfect replica. What else in the system could possibly be impacted by this I wonder?

2

Please rephrase all the above text. I think you are calling a TemplateVM ambiguously for TemplateVMs and for AppVMs that are Templates for disposables.

When I create an AppVM with whonix-ws-16 as the TemplateVM then the AppVM has its default DispVM set to whonix-ws-16-dvm

Especifically When I create an AppVM … as the TemplateVM.

If I then clone whonix-ws-16 and use the clone as the TemplateVM, the AppVM does not have its default DispVM set to whonix-ws-16-dvm.
I don’t have time to play around with my system too much but in my case the default DispVM is being set to none (which happens to be my default global setting).

Well, because it is based on a different template? Why would it use the previous one as base?

What concerns me most about this is that it implies cloning a TemplateVM is not creating a perfect replica. What else in the system could possibly be impacted by this I wonder?

This question is Qubes specific, not Qubes-Whonix.

Anyway, new templates acquire the default DispVM and it can’t possibly have a AppVM that is a Template for Disposables that the AppVM is based on the TemplateVM, if the TemplateVM was just cloned.

You see the logic? The child AppVM does not exist yet because the parent TemplateVM was just born.

So yes, you have to manually set the disposable to another one if you want.

Also TemplateVMs normally do not use a a DispVM that is on the field default_dispvm when you run qvm-prefs whonix-ws-16 default_dispvm. For updates, the TemplateVMs use the disposable that is set by management_dispvm, so qvm-prefs whonix-ws-16 management_dispvm. Of course you can open the template default disposable with qvm-open-in-dvm, buy you most probably will never use that.

Summary, the only setting I believe is not cloned as you expected is the default_dispvm, but it assumes safe value using the Global disp vm.

3

There is no need to rephrase, my understanding is correct.

When I create an AppVM with whonix-ws-16 as the TemplateVM.

This means that I have an AppVM whose template is whonix-ws-16.

When I create an AppVM and set the template to whonix-ws-16 then the “Default DispVM” off the AppVM is whonix-ws-16-dvm.

When I create an AppVM and set the template to a clone of whonix-ws-16 then the “Default DispVM” of the AppVM is None.

The behavior I would expect is that a cloned template should inherit whatever property it is that results in AppVMs that are created from it having their “Default DispVM” set.

Or perhaps this behavior is not influenced by a property of the template and is some script running in dom0? This doesn’t change my expectation.

4

This is purely up to Qubes. Qubes VM Manager (QVMM) is developed by Qubes. Default DispVM is a Qubes dom0 setting.

Could you please check if Qubes has related issues about this yet?

If not, I recommend to make an argument that is unspecific to Whonix (a general Qubes issues). This increases chances that this bug isn’t confused as a Qubes-Whonix issue and stalling. That this might be specifically important in case of Qubes-Whonix could be mentioned at the end of the ticket.

6

qvm-create --template whonix-ws-16 --class AppVM --label red whonix-ws-16-dvm-custom

qvm-prefs whonix-ws-16-dvm-custom netvm “sys-whonix”

qvm-prefs whonix-ws-16-dvm-custom default_dispvm “whonix-ws-16-dvm-custom”

qvm-prefs whonix-ws-16-dvm-custom template_for_dispvms True

7

If you were to clone the Qubes it prob kept the default_dispvm of the old template so that’s why i threw it in there. If its a disposable template you want that to match the same name.