Tor Browser Downloader not opening / working in whonix-workstation-18 TemplateVM. How to fix?

Qubes-Whonix
1

When I go to “Qubes Menu –> Qube Icon –> Templates –> whonix-workstation-18” and then click on “Tor Browser Downloader (AnonDist)”, the Tor Browser Downloader (tb-updater) doesn’t open up and check for Tor-Browser updates like it’s supposed to.

To try and fix this, I have reinstalled it using “System Maintenance Panel –> Manage Software”, search box “tb-updater”, Action “Reinstall”, “Run”. It successfully reinstalls, however, theTor Browser Downloader app still doesn’t open up when clicking on the Application in the Templates App Menu. How can i debug and fix this?

2

This is intended behavior. Templates are not able to directly access the Internet by default in Qubes OS as a security measure, so running Tor Browser in a template is likely to be useless. When run in a template, Tor Browser Downloader will update a copy of Tor Browser that is inherited by newly created AppVMs.

See:

3

so running Tor Browser in a template is likely to be useless.

But I’m not trying to run Tor Browser in a template. I’m trying to update Tor Browser in a Template using the Tor Browser Downloader app, so that my corresponding AppQubes and disposables automatically have the latest version of Tor Browser installed. The issue is not with Tor Browser in a whonix template, it is with Tor-Browser Downloader in a whonix template.

Now that that’s clarified, I believe this is a bug in whonix-workstation-18 TemplateVM, that blocks Tor-Browser Downloader from working in a whonix Template if the sysmaintuser has a password for their account. I solved my own problem and have provided the solution in the Qubes forums here, if you want to read more, or if you are also having this issue, and need to fix it.

4

Check this:

5

Looked at your edits above, I get it now. update-torbrowser uses sudo to execute a self-sandboxing mechanism for the updater, so when a user password is set on sysmaint, the updater either hangs waiting for a password, or fails because it can’t read the password from stdin.

A sudoers exception could probably be used to work around this. I’ll look into it.

1 Like