Is catfish the new default in the Qubes Domain open file manager quick widget for whonix?

Patrick · April 8, 2026, 10:21am

There’s indeed a new security feature which might be causing that. It’s not yet documented, will be documenetd soon. Meanwhile you can find the draft documentation which is probably “approximately correct” here:

github.com/Kicksecure/security-misc

Document File Manager D-Bus shim security feature

master ← assisted-by-ai:claude/build-fm-shim-backend-SMfJx

opened 10:19AM - 08 Apr 26 UTC

assisted-by-ai

+32 -0

## Summary This change adds documentation for the File Manager D-Bus shim, a …new security feature that intercepts and controls D-Bus access to the file manager. ## Changes - Added comprehensive documentation section explaining the File Manager D-Bus shim functionality - Documented the two-component architecture: - C backend that intercepts `org.freedesktop.FileManager1` D-Bus method calls with hardening flags (`_FORTIFY_SOURCE=3`, PIE, RELRO, CFI) - Python/PyQt5 frontend that validates URIs, resolves symlinks, and presents user confirmation dialogs - Documented security features including URI validation (local `file://` only), rejection of Unicode/control characters, path existence verification, and symlink resolution - Listed relevant source files and configuration locations for reference ## Details The documentation explains how the shim prevents applications from silently opening directories via D-Bus by requiring explicit user confirmation. It addresses PCManFM-Qt D-Bus handling issues while providing an additional control layer for users. The backend runs as a systemd user service that automatically starts on login. https://claude.ai/code/session_01RHBTARXyvjzrgxyCX6ntnA

marcos-morar · April 8, 2026, 10:43am

But it’s not working as expected.

First, the default file manager in the file associations is pcmanfm-qt, but when I click “Open,” it opens Catfish instead.

Second, in Signal Messenger (and I’m sure the same will be the case in other similar applications), the link does nothing and doesn’t open the dialogue.

If the dialogue is required as a new security procedure, it should be displayed everywhere, not just in browsers.

Secondly, it should open the default file manager defined in the file associations.

Anyway, is there a workaround for now?

arraybolt3 · April 8, 2026, 7:20pm

You’re running into a case of a fix still being in progress. The shim you see is supposed to be the workaround for no file manager opening or for Catfish showing up, but it ran into another issue that (surprise!) results in Catfish showing up. (Environment variables in the systemd user manager are not what they should be.) That other issue exists in Qubes OS upstream and is something we’re still working on fixing.

marcos-morar · April 8, 2026, 9:13pm

If the whole thing is still broken and under development, why was the update pushed to the main repository instead of staying in the testing repository until it actually works?

arraybolt3 · April 8, 2026, 10:07pm

It isn’t broken on non-Qubes-Whonix, and it fixes a possible security hole on both Qubes-Whonix and non-Qubes-Whonix. (I think in this instance it was pushed to the stable repo despite the Qubes-Whonix issue due to an oversight, though on Qubes-Whonix it doesn’t make the situation much worse than it was previously.)

As a temporary workaround while we’re getting a fix upstreamed:

After launching a Whonix-Workstation VM, open a terminal.
Run dbus-update-activation-environment --systemd --all && systemctl --user restart fm-shim.service in the terminal.
The “Open in folder” button in Tor Browser and other apps should now open pcmanfm-qt as expected, until the VM is rebooted.

We’ll update this thread once an upstream PR is filed to fix this.

arraybolt3 · April 8, 2026, 10:31pm

Filed some time ago but I forgot to link it here:

github.com/QubesOS/qubes-issues

systemd's user manager's environment does not match up with the user session's environment, causing incorrect behavior in some situations

opened 04:04AM - 10 Mar 26 UTC

ArrayBolt3

C: templates P: default needs diagnosis affects-4.3

[How to file a helpful issue](https://www.qubes-os.org/doc/issue-tracking/) ###… Qubes OS release R4.3 ### Brief summary This is basically the sequel to https://github.com/QubesOS/qubes-issues/issues/10299. When fixing the above bug report, we successfully made it so that the environment variables systemd's user manager sees are sync'd into the user session, without clobbering anything. However, there is not yet anything that syncs the user session's variables back into the systemd user manager. This means that anything that depends on systemd's user manager's environment variables may behave differently than the user expects. Case in point, I recently wrote a shim for the `org.freedesktop.FileManager1` D-Bus interface, to work around [this mess](https://forums.whonix.org/t/is-catfish-the-new-default-in-the-qubes-domain-open-file-manager-quick-widget-for-whonix/20233/22). It consists of a backend that listens for D-Bus method calls, and a frontend that allows the user to permit or deny a folder open operation and that launches the default file manager when requested. In order to ensure that the shim starts up before the qube launches any applications requested by the user, it is currently installed as a user service in systemd. This means it inherits systemd's user manager's environment.<sup>1</sup> When a method call is received, it launches the frontend, and if the user permits the folder open operation, the default file manager is opened... ...except it's not. systemd's user manager's `XDG_DATA_DIRS` doesn't include `/usr/share/usability-misc/xdg-override/` in it, and so the config file that sets the default file manager to PCManFM-Qt is missed. As a result, the default file manager appears to be Catfish instead, and that's what ultimately gets launched, which is not at all what the user expects. <sup>1: Well, kinda anyway. Because [graphical-session.target doesn't work](https://github.com/QubesOS/qubes-issues/issues/9576), it is possible the shim backend will start before X.org starts, so in reality the shim has code in it that fetches the systemd user manager's current environment before launching the shim frontend, and then feeds that environment into the frontend.</sup> ### Steps to reproduce 1. Launch QTerminal in a Kicksecure 18 AppVM. 2. Run `systemctl --user show-environment | grep -i XDG_DATA_DIRS`. ### Expected behavior `XDG_DATA_DIRS` should contain `/usr/share/usability-misc/xdg-override/`. ### Actual behavior `XDG_DATA_DIRS` does not contain `/usr/share/usability-misc/xdg-override/`. ### Additional information There is a utility for fixing this exact issue, `dbus-update-activation-environment` (specifically with the `--systemd` and `--all` options), which I believe is preinstalled on many if not all official VM templates for Qubes. If this was run by something in the user session during startup, it would likely fix this issue. I originally suggested [something like this](https://github.com/QubesOS/qubes-gui-agent-linux/commit/e4c68aaf51a64c8b33e47123f42f1669001fe752) to fix the earlier environment variable bug linked above, but [it was rejected](https://github.com/QubesOS/qubes-gui-agent-linux/pull/246#issuecomment-3369522903) due to the fact that it would clobber environment variables from `/etc/environment.d`. Now that variables are synced from systemd into the user session, maybe we can get away with using `dbus-update-activation-environment --systemd --all` at some point *after* the variables are synced by `qubes-gui-runuser`? We're syncing them in one direction already, I think we just need to sync them the other way too. This *might* be related to https://github.com/QubesOS/qubes-issues/issues/10644, although that may be far-fetched since I don't *think* systemd's user manager is in charge of launching applications when using debian-13-xfce...

marcos-morar · April 9, 2026, 5:21am

Showing this error:

[workstation user ~]% dbus-update-activation-environment --systemd --all && systemctl --user restart fm-shim.service
Job for fm-shim.service failed because a timeout was exceeded.
See “systemctl --user status fm-shim.service” and “journalctl --user -xeu fm-shim.service” for details.
zsh: exit 1     systemctl --user restart fm-shim.service

[workstation user ~]% systemctl --user status fm-shim.service
● fm-shim.service - org.freedesktop.FileManager1 handler
     Loaded: loaded (/usr/lib/systemd/user/fm-shim.service; enabled; preset: en>
     Active: activating (start) since Wed 2026-04-08 22:21:35 UTC; 33s ago
        Job: 428
 Invocation: a0e298e4fd634cc6bd45e4371f4a9ce1
   Main PID: 3036 (fm-shim-backend)
     Status: "Running, security issue detected"
      Tasks: 1 (limit: 7680)
     Memory: 308K (peak: 1.7M)
        CPU: 7ms
     CGroup: /user.slice/user-1000.slice/user@1000.service/app.slice/fm-shim.se>
             └─3036 /usr/bin/fm-shim-backend

Apr 08 22:21:35 host systemd[1325]: Failed to start fm-shim.service - org.freed>
Apr 08 22:21:35 host systemd[1325]: fm-shim.service: Scheduled restart job, res>
Apr 08 22:21:35 host systemd[1325]: Starting fm-shim.service - org.freedesktop.>
Apr 08 22:21:35 host fm-shim-backend[3036]: fm-shim-backend: Requested 'org.fre>
Apr 08 22:21:35 host fm-shim-backend[3036]: fm-shim-backend: This may be a secu>
lines 1-18/18 (END)...skipping...
● fm-shim.service - org.freedesktop.FileManager1 handler                                                                                                                                                          
     Loaded: loaded (/usr/lib/systemd/user/fm-shim.service; enabled; preset: enabled)                                                                                                                             
     Active: activating (start) since Wed 2026-04-08 22:21:35 UTC; 33s ago                                                                                                                                        
        Job: 428                                                                                                                                                                                                  
 Invocation: a0e298e4fd634cc6bd45e4371f4a9ce1                                                                                                                                                                     
   Main PID: 3036 (fm-shim-backend)                                                                                                                                                                               
     Status: "Running, security issue detected"                                                                                                                                                                   
      Tasks: 1 (limit: 7680)                                                                                                                                                                                      
     Memory: 308K (peak: 1.7M)                                                                                                                                                                                    
        CPU: 7ms                                                                                                                                                                                                  
     CGroup: /user.slice/user-1000.slice/user@1000.service/app.slice/fm-shim.service                                                                                                                              
             └─3036 /usr/bin/fm-shim-backend                                                                                                                                                                      
                                                                                                                                                                                                                  
Apr 08 22:21:35 host systemd[1325]: Failed to start fm-shim.service - org.freedesktop.FileManager1 handler.                                                                                                       
Apr 08 22:21:35 host systemd[1325]: fm-shim.service: Scheduled restart job, restart counter is at 1.                                                                                                              
Apr 08 22:21:35 host systemd[1325]: Starting fm-shim.service - org.freedesktop.FileManager1 handler...                                                                                                            
Apr 08 22:21:35 host fm-shim-backend[3036]: fm-shim-backend: Requested 'org.freedesktop.FileManager1' name from D-Bus, but was placed in queue.                                                                   
Apr 08 22:21:35 host fm-shim-backend[3036]: fm-shim-backend: This may be a security risk! Please report this bug!  

[workstation user ~]% journalctl --user -xeu fm-shim.service
░░ A start job for unit UNIT has finished with a failure.
░░ 
░░ The job identifier is 407 and the job result is failed.
Apr 08 22:21:35 host systemd[1325]: fm-shim.service: Scheduled restart job, restart counter is at 1.
░░ Subject: Automatic restarting of a unit has been scheduled
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░ 
░░ Automatic restarting of the unit UNIT has been scheduled, as the result for
░░ the configured Restart= setting for the unit.
Apr 08 22:21:35 host systemd[1325]: Starting fm-shim.service - org.freedesktop.FileManager1 handler...
░░ Subject: A start job for unit UNIT has begun execution
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░ 
░░ A start job for unit UNIT has begun execution.
░░ 
░░ The job identifier is 428.
Apr 08 22:21:35 host fm-shim-backend[3036]: fm-shim-backend: Requested 'org.freedesktop.FileManager1' name from D-Bus, but was placed in queue.
Apr 08 22:21:35 host fm-shim-backend[3036]: fm-shim-backend: This may be a security risk! Please report this bug!
Apr 08 22:23:05 host systemd[1325]: fm-shim.service: start operation timed out. Terminating.
Apr 08 22:23:05 host systemd[1325]: fm-shim.service: Failed with result 'timeout'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░ 
░░ The unit UNIT has entered the 'failed' state with result 'timeout'.
Apr 08 22:23:05 host systemd[1325]: Failed to start fm-shim.service - org.freedesktop.FileManager1 handler.
░░ Subject: A start job for unit UNIT has failed
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░ 
░░ A start job for unit UNIT has finished with a failure.
░░ 
░░ The job identifier is 428 and the job result is failed.
Apr 08 22:23:06 host systemd[1325]: fm-shim.service: Scheduled restart job, restart counter is at 2.
░░ Subject: Automatic restarting of a unit has been scheduled
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░ 
░░ Automatic restarting of the unit UNIT has been scheduled, as the result for
░░ the configured Restart= setting for the unit.
Apr 08 22:23:06 host systemd[1325]: Starting fm-shim.service - org.freedesktop.FileManager1 handler...
░░ Subject: A start job for unit UNIT has begun execution
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░ 
░░ A start job for unit UNIT has begun execution.
░░ 
░░ The job identifier is 449.
Apr 08 22:23:06 host fm-shim-backend[3137]: fm-shim-backend: Requested 'org.freedesktop.FileManager1' name from D-Bus, but was placed in queue.
Apr 08 22:23:06 host fm-shim-backend[3137]: fm-shim-backend: This may be a security risk! Please report this bug!
lines 55-106/106 (END)

lars-qubes · April 9, 2026, 7:28pm

Same here! Reproducable.

arraybolt3 · April 10, 2026, 1:43am

You have pcmanfm-qt (or something else that grabs the necessary D-Bus interface) open. Close it, then try again.

marcos-morar · April 10, 2026, 8:04am

It’s working for browsers, but the “Show in Folder” link in Signal Messenger still does nothing even after this.

arraybolt3 · April 10, 2026, 6:14pm

That would mean that Signal isn’t using the D-Bus interface most likely, or is using it wrongly. Could you dump the backend logs with journalctl --user --boot -u fm-shim.service and share the logs here? (Preferably noting if any new log lines pop up after attempting to use the button in Signal.)

marcos-morar · April 10, 2026, 6:21pm

This is the message after clicking “Open in Folder” in Signal:

Apr 10 18:20:01 host fm-shim-backend[13868]: ERROR: All provided URIs were invalid!

arraybolt3 · April 10, 2026, 9:54pm

Hmm. Looks like I need to add some better logging then to actually say what URIs were passed. I wonder if it’s passing /path/to/file rather than file:///path/to/file…

arraybolt3 · April 12, 2026, 6:03pm

github.com/QubesOS/qubes-gui-agent-linux

Sync environment variables from the user session into systemd and dbus

main ← ArrayBolt3:arraybolt3/env-sync-2

opened 06:02PM - 12 Apr 26 UTC

ArrayBolt3

+4 -0

We're already syncing environment variables from the systemd user manager into t…he user session, but some variables may be set in the user session that aren't in the user manager or dbus-daemon by default. This interferes with applications that are launched by the user manager or dbus-daemon, such as Ptyxis and Kicksecure's fm-shim system. Sync environment variables from the user session into the systemd user manager and dbus-daemon to fix this. Fixes: https://github.com/QubesOS/qubes-issues/issues/10759 Fixes: https://github.com/QubesOS/qubes-issues/issues/10712 (Note that I haven't finished testing if this fixes the Ptyxis terminal issue, but it seems like it should. I'll report back once I've tested that.)