This time-based error within a fully updated Gateway 11 running under VBox 5. This error causes whonixcheck to fail, and continues to drive me nuts!
Facts:
My 64-Bit VBox 5 Host is/always has been set to UTC.
Running ‘date’ in a fully updated Gateway, correctly shows:
Tue Nov 24 07:49:03 UTC 2015
Yet following every Gateway boot, I see this error DESPITE the Gateway’s Tor working correctly:
ERROR: PVClock Test Result:
Unwanted PVClock kvm-clock tsc acpi_pm detected! This is unsupported by Whonix developers! Whonixcheck aborted!
Using PVClock together with Whonix is recommended against, because PVClock conflicts with Whonix’s TimeSync design [1].
You probably did not follow Whonix’s KVM instructions. [2]
This might endanger your anonymity. Do not proceed unless you know what you are doing.
If you wish to ignore this warning and to continue whonixcheck anyway, you can set
WHONIXCHECK_NO_EXIT_ON_PVCLOCK_DETECTION=“1”
in /etc/whonix.d/30_whonixcheck_default.
Recommended action:
- Shut down.
- Read Whonix documentation. [3]
- Follow Whonix’s KVM instructions. [2]
- Or use Whonix a supported virtualizer.
- Or use Whonix with Physical Isolation. [4]
[1] https://www.whonix.org/wiki/Dev/TimeSync
[2] Whonix for KVM
[3] https://www.whonix.org
[4] Build Documentation: Physical Isolation
Do I need to mention again this is a Gateway 11 error when run under VirtualBox 5, and is UNRELATED to KVM?
Also note that I run many different OSes under VBox 5, and I have never seen another time-based error with any other VBox Guest OS.
You should also be aware, this error does NOT occur immediately following a clean install/reinstall of the Gateway-11.ova file.
The error occurs, and then persists, only following several apt-get updates. Therefore, the solution to this bug, imo, lies in figuring out what changed to impact the time/clocks, and why, during those updates.
Setting and using time should be drop dead simple in linux. What was the original time goal, and why does it appear to have become so complex? Why all the pain/PITA with Whonix’s version of time?
What in the world are you actually delivering in terms of safety by using these flawed time checks? Time is time, all users should be using UTC, period.
Let me know,
CCP
+++++++++++++++++++++++++++++++++++
Is /usr/lib/whonixcheck/check_pvclock the script that is driving the error?
Here is the current content of that script.
$ cat /usr/lib/whonixcheck/check_pvclock
#!/bin/bash
This file is part of Whonix.
Copyright (C) 2012 - 2014 Patrick Schleizer adrelanos@riseup.net
See the file COPYING for copying conditions.
pvclock_unwanted_detected() {
if [ “$WHONIXCHECK_NO_EXIT_ON_PVCLOCK_DETECTION” = “1” ]; then
local MSG=“
PVClock Test Result: Unwanted PVClock detected, but WHONIXCHECK_NO_EXIT_ON_PVCLOCK_DETECTION is set, continuing.
if [ “$verbose” -ge “1” ]; then
$output_x ${output_opts[@]} --messagex --typex “info” --message “$MSG”
$output_cli ${output_opts[@]} --messagecli --typecli “info” --message “$MSG”
fi
return 0
fi
local MSG="
PVClock Test Result:
Unwanted PVClock $available_clocksource detected! This is unsupported by Whonix developers! Whonixcheck aborted!
Using PVClock together with Whonix is recommended against, because PVClock conflicts with Whonix's TimeSync design [1].
You probably did not follow Whonix's KVM instructions. [2]
This might endanger your anonymity. Do not proceed unless you know what you are doing.
If you wish to ignore this warning and to continue whonixcheck anyway, you can set
WHONIXCHECK_NO_EXIT_ON_PVCLOCK_DETECTION=\"1\"/etc/whonix.d/30_whonixcheck_default.
Recommended action:
- Shut down.
- Read Whonix documentation. [3]
- Follow Whonix's KVM instructions. [2]
- Or use Whonix a supported virtualizer.
- Or use Whonix with Physical Isolation. [4]
[1] https://www.whonix.org/wiki/Dev/TimeSync
[2] https://www.whonix.org/wiki/KVM
[3] https://www.whonix.org
[4] https://www.whonix.org/wiki/Physical_Isolation
$output_x ${output_opts[@]} --messagex --typex “error” --message “$MSG”
$output_cli ${output_opts[@]} --messagecli --typecli “error” --message “$MSG”
EXIT_CODE=“1”
cleanup “1”
return 0
}
check_pvclock() {
if [ -f “/var/run/qubes-whonix/qubes.SetDateTime” ]; then
qubes_set_date_time_content=“$(cat “/var/run/qubes-whonix/qubes.SetDateTime”)” || true
local MSG=“
PVClock Result: dom0 is telling us the time.
File /var/run/qubes-whonix/qubes.SetDateTime exists.
Its content is $qubes_set_date_time_content.
This is non-ideal. A known issue. Contributions happily considered. Read more: https://phabricator.whonix.org/T397
if [ “$verbose” -ge “1” ]; then
$output_x ${output_opts[@]} --messagex --typex “info” --message “$MSG”
$output_cli ${output_opts[@]} --messagecli --typecli “info” --message “$MSG”
fi
fi
if [ ! -f “/sys/devices/system/clocksource/clocksource0/current_clocksource” ]; then
local MSG=“
PVClock Result: /sys/devices/system/clocksource/clocksource0/current_clocksource does not exist, ok.
if [ “$verbose” -ge “1” ]; then
$output_x ${output_opts[@]} --messagex --typex “info” --message “$MSG”
$output_cli ${output_opts[@]} --messagecli --typecli “info” --message “$MSG”
fi
return 0
fi
local current_clocksource available_clocksource
current_clocksource=“$(cat “/sys/devices/system/clocksource/clocksource0/current_clocksource”)” || true
available_clocksource=“$(cat “/sys/devices/system/clocksource/clocksource0/available_clocksource”)” || true
if [ “$current_clocksource” = “xen” ]; then
local MSG=“
PVClock Result: /sys/devices/system/clocksource/clocksource0/current_clocksource exist, is $current_clocksource.
This is non-ideal. A known issue. Contributions happily considered. Read more: https://phabricator.whonix.org/T389
if [ “$verbose” -ge “1” ]; then
$output_x ${output_opts[@]} --messagex --typex “info” --message “$MSG”
$output_cli ${output_opts[@]} --messagecli --typecli “info” --message “$MSG”
fi
return 0
fi
if [ “$current_clocksource” = “kvm-clock” ]; then
pvclock_unwanted_detected
return 0
fi
local MSG=“
PVClock Result: /sys/devices/system/clocksource/clocksource0/current_clocksource exist, is $current_clocksource.
if [ “$verbose” -ge “1” ]; then
$output_x ${output_opts[@]} --messagex --typex “info” --message “$MSG”
$output_cli ${output_opts[@]} --messagecli --typecli “info” --message “$MSG”
fi
return 0
}
