sdwdate-gui for Qubes. Testers wanted (developers welcome)

Development
13

https://github.com/QubesOS/qubes-core-admin-addon-whonix/pull/2

14

Was merged! :slight_smile:

15

sdwdate-gui[qubes] in VirtualBox.

Ref: http://forums.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/t/kdesudo-error-popup-window-sdwdate-gui/5642/22?u=troubadour

This is whonix-firewall not coming up. sdwdate-gui creates /usr/lib/qubes/notify-shutdown

In whonix-gateway-firewall line 135, we have:

   if [ -d "/usr/lib/qubes" ]; then
      [ -n "$qubes_vm_type" ] || qubes_vm_type="$(qubesdb-read /qubes-vm-type)"

Command qubesdb-read is unknown in VirtualBox, crashing whonix-firewall.

Recommended dependency tor-control-panel was accidentally removed. Will amend.

1 Like
16

Oh, what a bug. Another reason to solve Provide a cannoncial way to detect Qubes · Issue #1963 · QubesOS/qubes-issues · GitHub to prevent such very difficult to foreseeable issues.
I’ll think about replacing if [ -d "/usr/lib/qubes" ]; then with something better.

17

It could be if [ -d "/var/lib/qubes" ];. Seems less prone to be created.

By the way, we are using if [ -d "/usr/lib/qubes" ] in start-maybe, which is most likely why sdwdate-gui does not start in VirtualBox. That is the next debugging step.

1 Like
18

I think this is best

if command -v "qubesdb-read" >/dev/null 2>&1 ; then
19

Yes. Just read https://github.com/QubesOS/qubes-issues/issues/1963. This looks more robust.

1 Like
20

https://github.com/Whonix/Whonix/commit/01bee1d5540578fe45611176a6592f1562746ac8

21

Not sure if this is the best place to post, but I’ve been experiencing an issue with sdw-date gui widget on Qubes 4.2 using Whonix 17 for the last couple of days where no running workstation vm will show up in the sdw-date widget, only sys-whonix.

Is this the result of a planned change? I think it started happening after the last big Whonix 17 update (I think I’m on the testing repo). Should I be worried about this?

I’ve also been dealing with the problem described in the Qubes github issue #8672 (I can’t post links) regarding the gui widget.

Edit: just noticed this topic was 5 years old…my bad.

22

No.

Valid Compromise Indicators versus Invalid Compromise Indicators

23

Okay, but it seems that this is still relevant to the security of Qubes-Whonix, as it’s now not obvious if sdwdate has completed the synchronization for the workstation.

IIUC the new issue tracker is basically this forum; should I open a new topic for this issue, as it’s distinct from the one already reported to the qubes-os github?

24

No additional reports required.

25

This is probably fixed with this commit:

(Whonix is based on Kicksecure.)

This fix is now in all Whonix 17 repositories.

(This was fixed using “Instant Package Migration” (link).)

1 Like
26

Confirmed fixed by the update on my end, thank you!

27

It seems that update had some negative side effects (could also have been the prior update): when sdwdate fails to complete for a workstation, I wait for it to complete on the gateway and after that (as I’ve done many times in the past) use the widget to “Restart sdwdate” on that workstation qube; this used to work in the past, but now I’m getting the following error:
whonix_error

In my policy files I see:

/etc/qubes/policy.d/80-whonix.policy:whonix.GatewayCommand +restart @tag:anon-gateway @tag:anon-vm      allow  autostart=no
/etc/qubes/policy.d/80-whonix.policy:whonix.GatewayCommand +stop    @tag:anon-gateway @tag:anon-vm      allow  autostart=no
/etc/qubes/policy.d/80-whonix.policy:whonix.GatewayCommand +showlog @tag:anon-gateway @tag:anon-vm      allow  autostart=no

The tags on the gateway and workstation check out, so it seems that the argument restart is expected, but the actual argument given is _restart_.

In fact, changing that policy (first quoted line) to have a _restart_ argument instead of restart will get rid of the error message, but it still won’t restart sdwdate on the workstation.

1 Like
28

Fixed in all Whonix 17 repositories.

1 Like
29
30

sdwdate-qui-qubes is currently complex. It has a two way communication through multiple qrexec calls. A better design was discussed in ⚓ T930 whonix.SdwdateStatus service starts VMs that were killed but is unlikely to get implemented without a contributors.

31

I am wondering if I could request a few Qubes github issues re-title to make these easier to locate? @adw

Something like this.

If that is OK I might have a second round of ticket rename requests. I want to group them all together to perhaps sketch a new design. But it won’t be that many sdwdate-gui ticket so don’t worry.

32

Yes, of course! :slight_smile:

Looks like the issue opener already fixed this one before I had a chance. :slight_smile:

Done. Thanks for letting me know!

Of course, please feel free. No worries.

2 Likes