port whonixcheck and tb-updater to Qubes qrexec based updates proxy

[phabricator-migrator]

Information

ID: 491
PHID: PHID-TASK-ztlujvszddqvfbko5n25
Author: Patrick
Status at Migration Time: resolved
Priority at Migration Time: Normal

Description

Since in Qubes 4.0, TemplateVMs will be non-networked by default:

• #whonixcheck and
• #tb-updater

Need to be ported to qrexec based updates proxy.

Comments

---

Patrick

2016-08-18 23:53:06 UTC

Since the recent batch of whonixcheck commits, the only thing to do is modifying the operating systems updates check.

However, that is not possible to implement this at the moment. I have to see how set NetVM of TemplateVMs to none by default / make TemplateVMs non-networked by default · Issue #1858 · QubesOS/qubes-issues · GitHub will be implemented.

I will recheck this for every release of Whonix.

---

marmarek

2017-09-20 20:43:48 UTC

Since Use appropriate updates proxy if it is qrexec based · Whonix/qubes-whonix@01964e3 · GitHub, other places can simply source /usr/lib/qubes-whonix/utility_function.sh and use PROXY_SERVER variable to get appropriate proxy address.

---

Patrick

2017-10-20 13:27:51 UTC

https://github.com/Whonix/whonixcheck/blob/Whonix13/usr/lib/whonixcheck/check_qubes.bsh

is already using

   source /usr/lib/qubes-whonix/utility_functions.sh

   if [ "$qubes_vm_type" = "NetVM" ] || [ "$qubes_vm_type" = "ProxyVM" ]; then
      PROXY_SERVER="${PROXY_SERVER/10.137.255.254/127.0.0.1}"
   fi

and it works. Just now tested.

Should be good enough?

Related: T723

---

marmarek

2017-10-20 13:33:08 UTC

Is that changing to 127.0.0.1 work on Qubes 3.2? Anyway, yes, it should be good enough for Qubes 4.0.

---

Patrick

2017-10-20 13:42:33 UTC

! In T491#14667, @marmarek wrote:
Is that changing to 127.0.0.1 work on Qubes 3.2?

It’s to make the test work in sys-whonix as well.

Anyway, yes, it should be good enough for Qubes 4.0.

Great!

---

Patrick

2017-10-20 13:43:17 UTC

Here is the fix for tb-updater. Please have a look. Untested. Will test now. If it works, I will backport to Whonix 13 tb-updater.

tb-updater Qubes R4 qrexec based updates proxy compatibility fix · Kicksecure/tb-updater@1ce837d · GitHub

---

Patrick

2017-10-20 13:56:57 UTC

Backported to Whonix 13 tb-updater.

tb-updater Qubes R4 qrexec based updates proxy compatibility fix · Kicksecure/tb-updater@20707be · GitHub

And other fix required.

Skip Tor connectivity check when running inside Qubes TempalteVM, · Kicksecure/tb-updater@e3ac6e2 · GitHub

And while we are at it.

tbb_hardcoded_version="7.0.6" · Kicksecure/tb-updater@229efa8 · GitHub

---

Patrick

2017-10-20 14:02:05 UTC

tb-updater fix for Whonix 14 / master.

Skip Tor connectivity check when running inside Qubes TempalteVM, · Kicksecure/tb-updater@f331f2b · GitHub