qubes-core-admin-addon-whonix / qvm-features-request whonix-ws=1 / add anon-vm tag to whonix-ws-based VMs

phabricator-migrator · February 19, 2024, 5:40pm

Information

ID: 791
PHID: PHID-TASK-o2chtmcovuiqtexiv3ux
Author: Patrick
Status at Migration Time: resolved
Priority at Migration Time: Normal

Description

Quote https://github.com/QubesOS/qubes-core-admin-addon-whonix:

/etc/qubes/post-install.d (with .sh extension), with just one call:
qvm-features-request whonix-ws=1

inquiry:

github.com/QubesOS/qubes-issues

Qubes-Whonix 14 SaltStack state files required

opened 07:17AM - 30 Mar 18 UTC

closed 03:37PM - 15 Jul 18 UTC

adrelanos

P: major T: task C: mgmt C: Whonix

I am not sure it was a good idea to go for versioned (suffixing `-14`) Whonix te…mplate names. * We now have the issue that [salt uses](https://github.com/QubesOS/qubes-mgmt-salt-dom0-virtual-machines/blob/master/qvm/anon-whonix.sls) non-versioned hardcoded values. * However, [instructions for testing newly built Qubes-Whonix 14 templates] need to refer to the versioned template names. * Qubes-Whonix manual setup got to complicated that we now advice users to use salt for it. (#3447) So telling users to do that manually is not an option either. Perhaps we should revert this for the next template release and go back to non-versioned template names? Do you see a better solution for this?

add anon-vm tag to whonix-ws-based VMs

github.com/QubesOS/qubes-issues

whonix-ws-based VMs lack the anon-vm tag

opened 10:55PM - 16 Feb 18 UTC

closed 12:01PM - 24 Jul 18 UTC

mirrorway

T: bug privacy C: Whonix

#### Qubes OS version:  R4.0rc4 #### Affected TemplateVMs:  whonix-ws --- ### Steps to reproduce the behavior: 1. Create Qubes VM 2. set template := whonix-ws 3. set networking := sys-whonix ### Expected behavior: VM ready for anonymous use. ### Actual behavior: 1. if default_dispvm is fedora-26-dvm (this is the default, right?), then you can launch a clearnet browser from that anonymous VM using qvm-open-in-dvm, exposing your IP address. 2. VM lacks the anon-vm tag, perhaps it should have this like anon-whonix? The tag appears to be used to block time syncing. ### General notes: Maybe whonix-ws should also have anon-vm tag too, and any VM's based on it should inherit it. #### Related issues:

TODO (release critical blocker):

github.com/QubesOS/qubes-issues

qubes-core-agent /etc/qubes/post-install.d mechanism / qvm-features-request broken

opened 05:20AM - 03 Jun 18 UTC

closed 11:43PM - 13 Jun 18 UTC

adrelanos

T: bug C: core P: blocker r3.2-jessie-stable r3.2-stretch-stable r3.2-fc25-stable r4.0-jessie-stable r4.0-stretch-stable r4.0-centos7-stable r4.0-fc26-stable r3.2-fc26-stable r3.2-buster-stable r4.0-buster-stable r3.2-centos7-stable r3.2-fc27-stable r3.2-fc28-stable r4.0-fc27-stable r4.0-fc28-stable

### Qubes OS version: R4 ### Affected component(s): all templates ### S…teps to reproduce the behavior: Upgrade qubes core agent. When qubesdb is being upgraded (i.e. not running) and at the same time https://github.com/QubesOS/qubes-core-agent-linux/blob/master/qubes-rpc/qubes.PostInstall is processing a ` /etc/qubes/post-install.d/` trigger, ### Expected behavior: Functional. ### Actual behavior: For example `qvm-features-request whonix-ws=1` won't work, because qubesdb not running. Other things from https://github.com/QubesOS/qubes-core-agent-linux/tree/master/post-install.d will also not work. ``` Leaving 'diversion of /etc/init/tty.conf to /etc/init/tty.conf.qubes-disabled by qubes-core-agent' Leaving 'diversion of /etc/init/serial.conf to /etc/init/serial.conf.qubes-orig by qubes-core-agent' No such key 'auto-update-type' in schema 'org.gnome.settings-daemon.plugins.updates' as specified in override file '/usr/share/glib-2.0/schemas/20_org.gnome.settings-daemon.plugins.updates.qubes.gschema.override'; ignoring override for this key. Failed connect to local daemon Traceback (most recent call last): File "/usr/bin/qvm-features-request", line 81, in <module> sys.exit(main()) File "/usr/bin/qvm-features-request", line 70, in main qdb = qubesdb.QubesDB() qubesdb.Error: (2, 'No such file or directory') Traceback (most recent call last): File "/usr/bin/qvm-features-request", line 81, in <module> sys.exit(main()) File "/usr/bin/qvm-features-request", line 70, in main qdb = qubesdb.QubesDB() qubesdb.Error: (2, 'No such file or directory') Traceback (most recent call last): File "/usr/bin/qvm-features-request", line 81, in <module> sys.exit(main()) File "/usr/bin/qvm-features-request", line 70, in main qdb = qubesdb.QubesDB() qubesdb.Error: (2, 'No such file or directory') Traceback (most recent call last): File "/usr/bin/qvm-features-request", line 81, in <module> sys.exit(main()) File "/usr/bin/qvm-features-request", line 70, in main qdb = qubesdb.QubesDB() qubesdb.Error: (2, 'No such file or directory') Setting up qubes-core-agent-networking (4.0.28-1+deb8u1) ... ``` ### General notes: I think the current /etc/qubes/post-install.d implementation is fragile. ### Related issues: Affects Whonix `anon-vm` tag implementation. https://www.whonix.org/wiki/Dev/Qubes#anon-vm_tag https://github.com/QubesOS/qubes-issues/issues/3765 https://github.com/QubesOS/qubes-issues/issues/3595

qubes-core-admin-addon-whonix / qvm-features-request whonix-ws=1 / add anon-vm tag to whonix-ws-based VMs

Information

Description

Comments