Qubes-Whonix Development / Qubes Integration

Patrick · February 9, 2022, 11:18am

Qubes-Whonix 16 for Qubes R4.1

opened 05:06PM - 10 Sep 21 UTC

closed 11:31AM - 16 Feb 22 UTC

T: enhancement P: critical C: Whonix

Maintainer for Qubes-Whonix here. Qubes-Whonix `16` for Qubes `R4.1` is not y…et supported by me. (And Qubes-Whonix `15` won't ever be since Qubes-Whonix `16` release for Qubes `R4.0` is very close. -> https://github.com/QubesOS/qubes-issues/issues/6891) Some discussion here: * https://github.com/QubesOS/qubes-issues/issues/6597#issuecomment-839799243 * https://github.com/QubesOS/qubes-issues/issues/6597#issuecomment-839923299 No rush, however please let me know when a Qubes `R4.1` signed ISO installer release (alpha, beta, stable) become available or any estimated release dates. Once that's done I need to sort out my personal Qubes hardware support issues. I might update this post later. This ticket can be a placeholder, a general ticket usable as link to explain the current status to users, used for discussion... Related: * #6597 * #6891

Patrick · February 10, 2022, 9:22pm

github.com/QubesOS/qubes-issues

"Denied: whonix.SdwdateStatus" error message after DispVM has halted

opened 01:49PM - 26 Oct 21 UTC

mmeeyyaa

T: bug C: core ux C: Whonix P: default diagnosed

### Qubes OS release 4.1.0-rc1 ### Brief summary Error message after clos…ing Tor Browser running in a DispVM. ### Steps to reproduce 1. Start Tor Browser in a DispVM whonix-ws-16. 2. Close Tor Browser. 3. Error message is displayed. (note no other applications are running in the qube) Hardware: CPU: Ryzen 4700u ### Expected behavior Notification of: Qube dispxxxx has halted. ### Actual behavior ![Issue1](https://user-images.githubusercontent.com/93199124/138890050-8774be94-a594-44ea-9378-421590bd8af1.png)

github.com/QubesOS/qubes-issues

qubes-core-admin-addon-whonix sdwdate-gui qrexec service should use autostart=no

opened 03:38PM - 31 Dec 21 UTC

closed 12:36AM - 15 Feb 22 UTC

adrelanos

T: bug C: core C: Whonix P: default r4.1-dom0-stable diagnosed pr submitted

* https://github.com/QubesOS/qubes-core-admin-addon-whonix/blob/master/qubes-rpc…-policy/whonix.GatewayCommand.policy * https://github.com/QubesOS/qubes-core-admin-addon-whonix/blob/master/qubes-rpc-policy/whonix.NewStatus.policy * https://github.com/QubesOS/qubes-core-admin-addon-whonix/blob/master/qubes-rpc-policy/whonix.SdwdateStatus.policy To test, I would just have to append `,autostart=no`, right? I.e. `allow` -> `allow,autostart=no` ? related: https://github.com/QubesOS/qubes-issues/issues/5952

Patrick · February 12, 2022, 9:56am

github.com/QubesOS/qubes-issues

`/etc/qubes/suspend-post.d/qvm-sync-clock.sh` should not run in Qubes-Whonix after suspend-post

opened 09:56AM - 12 Feb 22 UTC

closed 01:58AM - 18 Feb 22 UTC

adrelanos

T: bug C: core C: Whonix P: default r4.1-buster-stable r4.1-bullseye-stable diagnosed pr submitted r4.1-fc32-stable r4.1-fc33-stable r4.1-fc34-stable r4.1-centos-stream8-stable r4.1-fc35-stable r4.1-bookworm-stable

https://github.com/QubesOS/qubes-core-agent-linux/blob/master/qubes-rpc/suspend-…post.d/qvm-sync-clock.sh shouldn't run in Whonix because Whonix uses sdwdate instead. qvm-sync-clock.service systemd unit does not run in Whonix as expected due to a systemd configuration file drop-in. Problem is that /etc/qubes/suspend-post.d/qvm-sync-clock.sh runs independently of the qvm-sync-clock.service systemd unit configuration. Would it be acceptable for /etc/qubes/suspend-post.d/qvm-sync-clock.sh to run `systemctl --no-pager restart qubes-sync-time.service` instead? If yes, I'd add a pull request. If not, I'd add a more cumber some solution, that is config-package-dev hide /etc/qubes/suspend-post.d/qvm-sync-clock.sh.

Patrick · February 14, 2022, 12:06pm

github.com/QubesOS/qubes-issues

qrexec-policy-daemon ignores `notify=no` parameter if action/parameter is `allow autostart=no` / `allow autostart=no notify=no` broken

opened 11:40AM - 14 Feb 22 UTC

closed 03:28AM - 18 Feb 22 UTC

adrelanos

T: bug C: core P: default r4.1-buster-stable r4.1-bullseye-stable r4.1-dom0-stable diagnosed pr submitted r4.1-fc32-stable r4.1-fc33-stable r4.1-fc34-stable r4.1-centos-stream8-stable r4.1-fc35-stable r4.1-bookworm-stable

example: whonix.SdwdateStatus * @tag:anon-gateway @tag:anon-vm all…ow autostart=no notify=no `notify=no` is ignored. Originally discovered here (with more context): https://github.com/QubesOS/qubes-issues/issues/7013#issuecomment-1038972745 Confirmed by @marmarek: https://github.com/QubesOS/qubes-issues/issues/7013#issuecomment-1038977459 For tracking / github labels: * `qrexec-policy-daemon` issue. * Caused by Whonix: no. * Affects Whonix: yes.

Patrick · February 15, 2022, 2:25pm

Patrick · February 15, 2022, 4:33pm

Patrick · February 15, 2022, 4:33pm

Patrick · February 16, 2022, 8:47pm

github.com/QubesOS/qubes-issues

remove qubes-core-agent dependency on initscripts

opened 06:53PM - 29 Jun 19 UTC

closed 08:12PM - 16 Feb 22 UTC

adrelanos

T: bug C: core C: templates P: default

During adding more hardening to security-misc package, during looking at `sudo l…ynis audit system` I found file `/etc/init.d/rc`. dpkg -S /etc/init.d/rc > `sysv-rc: /etc/init.d/rc` Tried to get rid of it by doing `sudo apt-get purge sysv-rc` but this would install `openrc`, another init system which we are not using. So tried the following. sudo apt-get purge sysv-rc openrc > The following packages will be REMOVED: > initscripts* openrc* qubes-core-agent* qubes-core-agent-network-manager* qubes-core-agent-networking* qubes-gui-agent* > qubes-input-proxy-sender* qubes-usb-proxy* qubes-vm-dependencies* qubes-vm-recommended* Root cause: qubes-core-agent-linux [debian/control](https://github.com/QubesOS/qubes-core-agent-linux/blob/master/debian/control) `Depends:` on `initscripts`. Is this actually needed or just legacy? (Non-Qubes-Whonix does not depend on `initscripts` by the way without adverse effects.)

Patrick · February 16, 2022, 8:47pm

github.com/QubesOS/qubes-issues

Switching qube to Whonix template fails to add `anon-vm` qvm-tag, resulting in `sys-whonix: denied: denied by policy`

opened 08:46PM - 16 Feb 22 UTC

adrelanos

T: bug C: core C: Whonix P: default needs diagnosis

1. create a VM "test-delete" (or any other name) based on Debian template using …Qubes VM Manager (QVMM) 2. run `qvm-tags test-delete` output: ``` audiovm-dom0 created-by-dom0 guivm-dom0 ``` 3. switch template for VM "test-delete" from Debian to `whonix-ws-16` 4. re-run `qvm-tags test-delete` actual output: ``` audiovm-dom0 created-by-dom0 guivm-dom0 ``` expected output: Same as for `qvm-tags anon-whonix`. ``` anon-vm audiovm-dom0 created-by-dom0 guivm-dom0 ``` 5. optionally start the "test-delete" VM (result is same as above) symptom: Qubes dom0 qrexec denied notification. > dom0 qrexec-policy-daemon[2698]: qrexec: whonix.NewStatus+status: test-delete -> sys-whonix: denied: denied by policy /etc/qubes/policy.d/80-whonix.policy:8 This might be an issue in: * https://github.com/QubesOS/qubes-core-admin-addon-whonix * https://github.com/QubesOS/qubes-core-admin-addon-whonix/blob/master/qubeswhonix/__init__.py Did https://github.com/QubesOS/qubes-core-admin-addon-whonix/blob/master/qubeswhonix/__init__.py#L93-L101 break in Qubes R4.1?

Patrick · February 17, 2022, 11:07am

github.com/QubesOS/qubes-issues

qvm-template - strange interaction with dnf

opened 03:43PM - 08 Feb 22 UTC

closed 02:47AM - 01 Mar 22 UTC

unman

T: bug C: templates P: default r4.1-dom0-stable diagnosed pr submitted

[How to file a helpful issue](https://www.qubes-os.org/doc/issue-tracking/) ###… Qubes OS release 4.1 clean install and fully updated. ### Brief summary qvm-template has strange and confusing interaction with standard dnf tool in dom0. ### Steps to reproduce These are not steps, but separate use cases: 1. Enable qubes-templates-itl-testing repository in /etc/yum.repos.d/qubes-templates.repo 2. Install template with dnf install. 3. Install template with qvm-template tool. ### Expected behavior The output of qvm-template will be consistent with dnf configuration, and vice versa ### Actual behavior In Case 1: `qvm-template list` only shows available templates from qubes-templates-itl, although that repository is enabled. After #7170, it is possible to view the contents of qubes-templates-itl-testing , but this must be explicitly specified as an option to qvm-template. Case 2: Templates installed with dnf do not appear in the output of `qvm-template`. Case 3: Templates installed with qvm-template do not appear in the output of `dnf list installed`. All of these are unexpected and confusing.

Patrick · February 17, 2022, 11:08am

github.com/QubesOS/qubes-issues

Switching qube to Whonix template fails to add `anon-vm` qvm-tag, resulting in `sys-whonix: denied: denied by policy`

opened 08:46PM - 16 Feb 22 UTC

adrelanos

T: bug C: core C: Whonix P: default needs diagnosis

1. create a VM "test-delete" (or any other name) based on Debian template using …Qubes VM Manager (QVMM) 2. run `qvm-tags test-delete` output: ``` audiovm-dom0 created-by-dom0 guivm-dom0 ``` 3. switch template for VM "test-delete" from Debian to `whonix-ws-16` 4. re-run `qvm-tags test-delete` actual output: ``` audiovm-dom0 created-by-dom0 guivm-dom0 ``` expected output: Same as for `qvm-tags anon-whonix`. ``` anon-vm audiovm-dom0 created-by-dom0 guivm-dom0 ``` 5. optionally start the "test-delete" VM (result is same as above) symptom: Qubes dom0 qrexec denied notification. > dom0 qrexec-policy-daemon[2698]: qrexec: whonix.NewStatus+status: test-delete -> sys-whonix: denied: denied by policy /etc/qubes/policy.d/80-whonix.policy:8 This might be an issue in: * https://github.com/QubesOS/qubes-core-admin-addon-whonix * https://github.com/QubesOS/qubes-core-admin-addon-whonix/blob/master/qubeswhonix/__init__.py Did https://github.com/QubesOS/qubes-core-admin-addon-whonix/blob/master/qubeswhonix/__init__.py#L93-L101 break in Qubes R4.1?

Patrick · February 17, 2022, 11:08am

github.com/QubesOS/qubes-issues

Qubes lag / frozen during template installation / throttle disk I/O of dom0 during Qubes template installation

opened 01:09PM - 14 Feb 22 UTC

adrelanos

T: enhancement C: templates P: default

### The problem you're addressing (if any) During template installation, Qube…s become unusable due to high disk I/O ### The solution you'd like Throttle disk I/O of dom0 during Qubes template installation. ### The value to a user, and who that user might be Not seemingly have the impression of a frozen or laggy system, ability to keep multi-tasking during template installation. ### Comments This is most likely not a hardware issue. It's related to how much resources are assigned to dom0 disk I/O versus VMs.

Patrick · February 17, 2022, 1:11pm

github.com/QubesOS/qubes-posts

Comment by adrelanos to Announcement: Updating via direct commands no longer recommended

QubesOS:master ← QubesOS:update-commands

There's nothing wrong with qubes-dom0-update, apt or dnf per definition, right? … The only idea is that users who don't use qubesctl would miss out on some extra fixes applied by qubesctl? Due to https://github.com/QubesOS/qubes-issues/issues/6585 I'd suggest meanwhile to tell users: > Until https://github.com/QubesOS/qubes-issues/issues/6585 is fixed, two commands are required to update. > Use of qubes-dom0-update, apt or dnf is OK but by itself insufficient. > qubesctl should be run after running running qubes-dom0-update, apt or dnf. https://www.qubes-os.org/doc/how-to-update/ should be edited beforehand. What do you think?

Patrick · February 18, 2022, 5:21pm

github.com/QubesOS/updates-status

core-admin-addon-whonix v4.1.1 (r4.1)

opened 03:30AM - 18 Feb 22 UTC

closed 02:54PM - 16 Mar 22 UTC

qubesos-bot

r4.1-dom0-stable

Update of core-admin-addon-whonix to v4.1.1 for Qubes r4.1, see comments below f…or details. Built from: https://github.com/QubesOS/qubes-core-admin-addon-whonix/commit/6569ade6737d422690b2c15c2510b3bc2c5551b9 [Changes since previous version](https://github.com/QubesOS/qubes-core-admin-addon-whonix/compare/v4.0.2...v4.1.1): QubesOS/qubes-core-admin-addon-whonix@6569ade version 4.1.1 QubesOS/qubes-core-admin-addon-whonix@bb93a3e Merge remote-tracking branch 'origin/pr/14' QubesOS/qubes-core-admin-addon-whonix@0a74587 indent style fix QubesOS/qubes-core-admin-addon-whonix@7bbe355 restrict qrexec `whonix.GatewayCommand` QubesOS/qubes-core-admin-addon-whonix@9ea1779 remove hardcoded qrexec entries for better readability QubesOS/qubes-core-admin-addon-whonix@cbe60a1 refined qrexec policy error handling QubesOS/qubes-core-admin-addon-whonix@a7797aa allow empty argument only for `whonix.SdwdateStatus` qrexec call QubesOS/qubes-core-admin-addon-whonix@d238125 fixed shutdown of App Qube (`anon-whonix`) denied message QubesOS/qubes-core-admin-addon-whonix@d006367 version 4.1.0 QubesOS/qubes-core-admin-addon-whonix@887328e fix "Denied: whonix.SdwdateStatus" error message after DispVM has halted QubesOS/qubes-core-admin-addon-whonix@71ffd29 port to new policy format QubesOS/qubes-core-admin-addon-whonix@e96408c add `autostart=no` to qrexec policy QubesOS/qubes-core-admin-addon-whonix@97f242c spec: add BR make QubesOS/qubes-core-admin-addon-whonix@f5c3be1 gitlab-ci: move pylint earlier QubesOS/qubes-core-admin-addon-whonix@aa70328 Add .gitlab-ci.yml QubesOS/qubes-core-admin-addon-whonix@dbd239b Update travis QubesOS/qubes-core-admin-addon-whonix@fffefc6 travis: switch to bionic Referenced issues: QubesOS/qubes-issues#7169 QubesOS/qubes-issues#4613 QubesOS/qubes-issues#7013 QubesOS/qubes-issues#6982 If you're release manager, you can issue GPG-inline signed command: * `Upload core-admin-addon-whonix 6569ade6737d422690b2c15c2510b3bc2c5551b9 r4.1 current repo` (available 7 days from now) * `Upload core-admin-addon-whonix 6569ade6737d422690b2c15c2510b3bc2c5551b9 r4.1 current (dists) repo`, you can choose subset of distributions, like `vm-fc24 vm-fc25` (available 7 days from now) * `Upload core-admin-addon-whonix 6569ade6737d422690b2c15c2510b3bc2c5551b9 r4.1 security-testing repo` Above commands will work only if packages in current-testing repository were built from given commit (i.e. no new version superseded it).

Patrick · February 18, 2022, 5:22pm

github.com/QubesOS/updates-status

qubes-template-whonix-gw-16 4.0.6-202202171443 (r4.1)

opened 02:42PM - 17 Feb 22 UTC

closed 05:31PM - 25 Feb 22 UTC

qubesos-bot

r4.1-stable

Template whonix-gw-16 4.0.6-202202171443 for Qubes r4.1, see comments below for …details. If you're release manager, you can issue GPG-inline signed command (depending on template): * `Upload linux-template-builder 4.0.6-202202171443 r4.1 templates-itl vm-whonix-gateway-16 repo` (available 7 days from now) * `Upload linux-template-builder 4.0.6-202202171443 r4.1 templates-community vm-whonix-gateway-16 repo` (available 7 days from now) Above commands will work only if package in testing repository isn't superseded by newer version.

github.com/QubesOS/updates-status

qubes-template-whonix-ws-16 4.0.6-202202171443 (r4.1)

opened 03:18PM - 17 Feb 22 UTC

closed 05:31PM - 25 Feb 22 UTC

qubesos-bot

r4.1-stable

Template whonix-ws-16 4.0.6-202202171443 for Qubes r4.1, see comments below for …details. If you're release manager, you can issue GPG-inline signed command (depending on template): * `Upload linux-template-builder 4.0.6-202202171443 r4.1 templates-itl vm-whonix-workstation-16 repo` (available 7 days from now) * `Upload linux-template-builder 4.0.6-202202171443 r4.1 templates-community vm-whonix-workstation-16 repo` (available 7 days from now) Above commands will work only if package in testing repository isn't superseded by newer version.

Patrick · February 18, 2022, 6:15pm

github.com/QubesOS/qubes-issues

`qvm-template purge whonix-gw-16` results in `ERROR: The dummy qube does not provide network`

opened 06:14PM - 18 Feb 22 UTC

adrelanos

T: bug C: core P: default needs diagnosis

qvm-template purge whonix-gw-16 ``` This will completely remove the selected… VM(s)... whonix-gw-16 sys-whonix test-delete anon-whonix dom0-updatevm whonix-ws-16-dvm Are you sure? [y/N] Y This will completely remove the selected VM(s)... whonix-gw-16 sys-whonix test-delete anon-whonix dom0-updatevm whonix-ws-16-dvm Are you sure? [y/N] Y This will completely remove the selected VM(s)... whonix-gw-16 sys-whonix test-delete anon-whonix dom0-updatevm whonix-ws-16-dvm Are you sure? [y/N] Y Property 'template' of 'sys-whonix' set to 'dummy'. Property 'template' of 'test-delete' set to 'dummy'. Global property 'updatevm' set to ''. ERROR: The dummy qube does not provide network ``` (No, I didn't create a quote `dummy` at this time. This might be internally used by Qubes tools.) For issue tracking purposes: This is an issue with dom0 `qvm-template` command and not caused by Whonix templates. Background: I intended to document the new `qvm-template` command with it's highly useful `purge` subcommand on https://www.whonix.org/wiki/Qubes/Uninstall

Patrick · February 18, 2022, 6:47pm

github.com/QubesOS/qubes-issues

qvm-template shows confusing error message `ERROR: [Errno 2] No such file or directory: '/etc/qubes-rpc/qubes.TemplateSearch'` if dom0 UpdateVM is set to `none`

opened 06:47PM - 18 Feb 22 UTC

adrelanos

T: bug C: core P: default needs diagnosis

### Qubes OS release R4.1 ### Brief summary Running qvm-template withou…t a Qubes dom0 UpdateVM set shows a confusing error message. ### Steps to reproduce 1. set dom0 update VM to none 2. qvm-template --verbose --enablerepo=qubes-templates-community-testing install whonix-gw-16 whonix-ws-16 ### Expected behavior A useful error message. ### Actual behavior Confusing error message. > ERROR: [Errno 2] No such file or directory: '/etc/qubes-rpc/qubes.TemplateSearch'

Patrick · February 25, 2022, 5:30pm

Qubes-Whonix stable Templates point release. Same as Whonix 16.0.4.2 - for VirtualBox - Point Release!.

qubes-template-whonix-ws-16 4.0.6-202202171443 (r4.1) · Issue #2820 · QubesOS/updates-status · GitHub
qubes-template-whonix-gw-16 4.0.6-202202171443 (r4.1) · Issue #2819 · QubesOS/updates-status · GitHub

Patrick · February 28, 2022, 11:34pm

Patrick · February 28, 2022, 11:48pm

Place for build template commands · Issue #566 · QubesOS/updates-status · GitHub
Place for build template commands · Issue #566 · QubesOS/updates-status · GitHub