Often systemcheck errors notifications. whonix 18lxqt

Unsupported Platforms
21

Did you edit the systemd unit file and was it fixed? What was the systemd unit file edit?

22 
[workstation user ~/Desktop]% ausyscall 48 
faccessat
[workstation user ~/Desktop]% sudoedit /usr/lib/systemd/system/kloak.service && sudo systemctl daemon-reload && sudo systemctl restart kloak && sudo systemctl --no-pager --full status kloak
sudoedit: /usr/lib/systemd/system/kloak.service unchanged
● kloak.service - kloak anti keystroke deanonymization tool
     Loaded: loaded (/usr/lib/systemd/system/kloak.service; enabled; preset: enabled)
     Active: active (running) since Sat 2026-02-21 08:07:13 UTC; 16ms ago
 Invocation: 9cd070abfc1e433e918d229ea710f92f
       Docs: https://github.com/Whonix/kloak
             man:kloak(8)
    Process: 18934 ExecStartPre=/usr/libexec/kloak/find_wl_compositor (code=exited, status=0/SUCCESS)
   Main PID: 18943 ((kloak))
      Tasks: 1 (limit: 4604)
     Memory: 1.8M (peak: 7.4M)
        CPU: 41ms
     CGroup: /system.slice/kloak.service
             └─18943 "(kloak)"

Feb 21 08:07:13 host systemd[1]: Starting kloak.service - kloak anti keystroke deanonymization tool...
Feb 21 08:07:13 host systemd[1]: Started kloak.service - kloak anti keystroke deanonymization tool.
[workstation user ~/Desktop]%

In the opened file, I’ve inserted faccessat to the end of SystemCallFilter. Here’s that upgraded file. How to check, was it fixed or no?

## Copyright (C) 2016 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

[Unit]
Description=kloak anti keystroke deanonymization tool
Documentation=https://github.com/Whonix/kloak
Documentation=man:kloak(8)
ConditionPathExists=!/run/qubes/this-is-templatevm
After=graphical.target
After=sysmaint-boot.target

[Service]
Type=simple

## This cannot be trivially made work on Qubes!
##
## /dev/input/event0 is not a keyboard device.
##
## ls -la /dev/input/event0
## crw-rw---- 1 root input 13, 64 May  6 08:25 /dev/input/event0
##
## ls -la /dev/input/by-path/platform-pcspkr-event-spkr
## lrwxrwxrwx 1 root root 9 May  6 08:25 /dev/input/by-path/platform-pcspkr-event-spkr -> ../event0
##
## https://github.com/QubesOS/qubes-issues/issues/2558
## https://github.com/QubesOS/qubes-issues/issues/1850
## https://forums.whonix.org/t/current-state-of-kloak/5605/6
##
## For Qubes, see Qubes Event Buffering instead.
## https://www.whonix.org/wiki/Keystroke_and_Mouse_Deanonymization#Qubes_Event_Buffering

## find_wl_compositor.py generates /run/kloak_wl_compositor_data.
ExecStartPre=+-/usr/libexec/kloak/find_wl_compositor
EnvironmentFile=-/run/kloak_wl_compositor_data
ExecStart=/usr/bin/kloak

Restart=always
RestartSec=2s

CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_TTY_CONFIG CAP_SYS_PTRACE

ProtectSystem=strict
#ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
## hardened kernels without CONFIG_USER_NS_UNPRIVILEGED=Y
## need to:
## * disable or comment out the 3 'Private' namespaces below
## $ systemctl edit --full kloak
PrivateTmp=true
#PrivateUsers=true
PrivateNetwork=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
RestrictRealtime=true
RestrictNamespaces=true
SystemCallArchitectures=native
SystemCallFilter=brk open poll close ioctl mmap munmap read pread64 getdents64 socket connect getsockopt epoll_create1 epoll_ctl rt_sigprocmask epoll_wait inotify_init1 access openat fstat prctl sendmsg recvmsg newfstatat unlink ftruncate fcntl timerfd_create statx readlinkat faccessat2 fstatfs inotify_add_watch timerfd_settime madvise sigaltstack faccessat

[Install]
WantedBy=graphical.target
23

sudo systemctl daemon-reload

sudo systemctl restart kloak

sudo systemctl status kloak

(Will be added to documentation in the near future.)

24

[workstation user ~/Desktop]% sudo systemctl daemon-reload
[workstation user ~/Desktop]% sudo systemctl restart kloak
[workstation user ~/Desktop]% sudo systemctl status kloak
× kloak.service - kloak anti keystroke deanonymization tool
Loaded: loaded (/usr/lib/systemd/system/kloak.service; enabled; preset: enabled)
Active: failed (Result: core-dump) since Sat 2026-02-21 11:31:52 UTC; 701ms ago
Duration: 25ms
Invocation: c092b1a738cf4699bfcb27c3f03d81c6
Docs: GitHub - Whonix/kloak: anti keystroke deanonymization tool
man:kloak(8)
Process: 18030 ExecStartPre=/usr/libexec/kloak/find_wl_compositor (code=exited, status=0/SUCCESS)
Process: 18032 ExecStart=/usr/bin/kloak (code=dumped, signal=SYS)
Main PID: 18032 (code=dumped, signal=SYS)

Feb 21 11:31:52 host systemd[1]: kloak.service: Scheduled restart job, restart counter is at 2.
Feb 21 11:31:52 host systemd[1]: kloak.service: Start request repeated too quickly.
Feb 21 11:31:52 host systemd[1]: kloak.service: Failed with result ‘core-dump’.
Feb 21 11:31:52 host systemd[1]: Failed to start kloak.service - kloak anti keystroke deanonymization tool.
zsh: exit 3 sudo systemctl status kloak
[workstation user ~/Desktop]%

25

Rinse and repeat. Either the wrong syscall has been adding (wrong architecture) or additional syscalls are required.

1 Like
26

systemd-repart failing in QEMU is totally normal — that service tries to repartition your root disk and VMs just cant do that. Noisy but probably not whats actually breaking things. The kloak service being stuck activating seems more worth investigating.

27

VMs can repartition their own root disks, the same way physical OS installations can.

1 Like