Tor Browser Error in Whonix 18 AppVM: User Home Folder Permission Issue

Qubes-Whonix
1

I recently ran the Whonix 18 Workstation template update and created a new AppVM. However, when running Tor Browser on the new AppVM, I encountered an error:

ERROR: User home folder permission issue? Failed to run the following command: cp --verbose --recursive --no-clobber /var/cache/tb-binary/.cache /home/user/

The recommended fix was to run the following commands in QTerminal:

sudo chown --recursive "user":"user" "/home/user"

However, this did not resolve the issue. I also tried running the Tor Browser Downloader in the AppVM, but it turned out that Tor Browser wasn’t downloaded:

Currently installed version: None installed. (Folder /home/user/.tb/tor-browser does not exist.)

Has anyone else encountered this issue?

1 Like
2

Did you restore Tor Browser from backup?

Which boot mode are you using? User session?

Did you previously use Tor Browser in Qubes-Whonix in other App Qubes without issues?

Output of this command? Expected: No output.

Note: Above command requires awareness of sysmaint - System Maintenance User - did you use that before?

cp --verbose --recursive --no-clobber /var/cache/tb-binary/.cache /home/user/

Try running this command manually. Alternative, perhaps simpler, run on the command line:

torbrowser

That will internally run the same command and you can see the output.

You could also investigate using chmod-calc.

chmod-calc /var/cache/tb-binary/
chmod-calc /var/cache/tb-binary/.cache
chmod-calc /var/cache/tb-binary/.cache/tb
chmod-calc ~/.cache/tb
chmod-calc ~/.tb

And post the output here. That would help to figure out where Linux file permissions are wrong.

Tor Browser doesn’t exist in that folder indeed unless torbrowser is installed started and copied from from /var/cache/tb-binary/.tb to ~/.tb by the torbrowser (package: tb-starter) (by Whonix developers) script. Copying should be automatic by running torbrowser and shouldn’t be required to be done manually by users.

Related documentation:

1 Like
3

Did you restore Tor Browser from backup?

Unfortunately, I didn’t make a backup before updating the Whonix 18 Workstation template.

Which boot mode are you using? User session?

User session.

Did you previously use Tor Browser in Qubes-Whonix in other App Qubes without issues?

Yes, the template was updated today. Previously, everything I made in the AppVM is working as expected.

Output of this command? Expected: No output.

Output running in User session:

zsh: permission denied: sudo
zsh: exit 126 sudo chown --recursive “user”:“user” “/home/user”

The output running in sysmaint is successful, but then when switching back to the User session, I’m still experiencing the same error as before user home folder permission issue.

cp --verbose --recursive --no-clobber /var/cache/tb-binary/.cache /home/user/

Running in sysmaint:

cp: cannot stat ‘/home/user/.cache’: Permission denied
zsh: exit 1 cp --verbose --recursive --no-clobber /var/cache/tb-binary/.cache /home/user/

In user session:

cp: cannot access ‘/var/cache/tb-binary/.cache/tb/temp’: Permission denied
‘/var/cache/tb-binary/.cache/tb/RecommendedTBBVersions’ → ‘/home/user/.cache/tb/RecommendedTBBVersions’
cp: cannot open ‘/var/cache/tb-binary/.cache/tb/RecommendedTBBVersions’ for reading: Permission denied
zsh: exit 1 cp --verbose --recursive --no-clobber /var/cache/tb-binary/.cache /home/user/

Running torbrowser & chmod-calc outputs:

[workstation user ~]% torbrowser
cp: cannot access ‘/var/cache/tb-binary/.cache/tb/temp’: Permission denied
‘/var/cache/tb-binary/.cache/tb/RecommendedTBBVersions’ → ‘/home/user/.cache/tb/RecommendedTBBVersions’
cp: cannot open ‘/var/cache/tb-binary/.cache/tb/RecommendedTBBVersions’ for reading: Permission denied
DEBUG START:
ls -la /home/user
total 136
drwx------. 15 user user 4096 Feb 1 16:44 .
drwxr-xr-x 4 root root 4096 Feb 1 16:38 ..
-rw-r–r–. 1 user user 220 Jul 30 2025 .bash_logout
-rw-r–r–. 1 user user 3526 Jul 30 2025 .bashrc
drwx------ 5 user user 4096 Feb 1 16:38 .cache
drwxr-xr-x. 8 user user 4096 Feb 1 16:39 .config
drwxr-x— 2 user user 4096 Feb 1 16:38 Desktop
drwxr-x— 2 user user 4096 Feb 1 16:38 Documents
drwxr-xr-x. 2 user user 4096 Feb 1 13:51 Downloads
drwx------. 2 user user 4096 Feb 1 13:51 .gnupg
-rw------- 1 user user 128 Feb 1 16:42 .histfile
drwxr-xr-x. 4 user user 4096 Feb 1 16:38 .local
drwxr-x— 2 user user 4096 Feb 1 16:38 Music
drwxr-xr-x. 2 user user 4096 Feb 1 13:51 Pictures
-rw-r–r–. 1 user user 807 Jul 30 2025 .profile
drwxr-x— 2 user user 4096 Feb 1 16:38 Public
drwxr-x— 2 user user 4096 Feb 1 16:38 Templates
drwxr-x— 2 user user 4096 Feb 1 16:38 Videos
drwxr-xr-x. 2 user user 4096 Feb 1 13:51 .xchat2
-rw------- 1 user user 4111 Feb 1 16:44 .xsession-errors
-rw-rw---- 1 user user 51038 Feb 1 16:38 .zcompdump
-rw-r–r–. 1 user user 0 Oct 21 2015 .zshrc
ls -la /home/user/.cache
total 20
drwx------ 5 user user 4096 Feb 1 16:38 .
drwx------. 15 user user 4096 Feb 1 16:44 ..
drwx------ 2 user user 4096 Feb 1 16:38 mesa_shader_cache
drwx------ 52 user user 4096 Feb 1 16:38 mesa_shader_cache_db
drwxrwx— 5 user user 4096 Feb 1 16:38 tb
ls -la /home/user/.cache/tb
total 32
drwxrwx— 5 user user 4096 Feb 1 16:38 .
drwx------ 5 user user 4096 Feb 1 16:38 ..
drwxrwx— 2 user user 4096 Feb 1 16:38 files
drwxrwx— 3 user user 4096 Feb 1 16:38 gpgtmpdir
-rw-rw---- 1 user user 29 Feb 1 16:38 last_used_gpg_bash_lib_output_signed_on_date
-rw-rw---- 1 user user 11 Feb 1 16:38 last_used_gpg_bash_lib_output_signed_on_unixtime
-rw-r----- 1 user user 7 Feb 1 16:38 tbb_version_last_downloaded_save_file
drwxrwx— 2 user user 4096 Feb 1 16:38 temp
ls -la /home/user/.cache/tb/temp
total 8
drwxrwx— 2 user user 4096 Feb 1 16:38 .
drwxrwx— 5 user user 4096 Feb 1 16:38 ..
ls -la /home/user/.cache/tb/files
total 20
drwxrwx— 2 user user 4096 Feb 1 16:38 .
drwxrwx— 5 user user 4096 Feb 1 16:38 ..
-rw-r----- 1 user user 833 Feb 1 16:38 tor-browser-linux-x86_64-15.0.3.tar.xz.asc
-rw-r----- 1 user user 833 Feb 1 16:38 tor-browser-linux-x86_64-15.0.4.tar.xz.asc
-rw-rw---- 1 user user 833 Feb 1 16:38 tor-browser-linux-x86_64-15.0.5.tar.xz.asc
ls -la /home/user/.cache/tb/tbb_version_last_downloaded_save_file
-rw-r----- 1 user user 7 Feb 1 16:38 /home/user/.cache/tb/tbb_version_last_downloaded_save_file
DEBUG END
[ERROR] [torbrowser] User home folder permission issue?

Failed to run the following command:

cp --verbose --recursive --no-clobber /var/cache/tb-binary/.cache /home/user/

Tip: If something does not work, do not arbitrarily try to use sudo / root without indication that this would be appropriate.
That only risks messing up user home folder permissions. See:
Safely Use Root Commands

To fix this, you could try: Start Menu → System → QTerminal

sudo chown --recursive “user”:“user” “/home/user”
Then try starting Tor Browser again.

To debug this, you could try to start Tor Browser Starter (by Whonix developers) from command line in:
Tor Browser Essentials .

See also Tor Browser Starter (by Whonix developers) Permission Issues:
Tor Browser Essentials
zsh: exit 1 torbrowser
[workstation user ~]% chmod-calc /var/cache/tb-binary/
chmod-calc /var/cache/tb-binary/.cache
chmod-calc /var/cache/tb-binary/.cache/tb
chmod-calc ~/.cache/tb
chmod-calc ~/.tb
Permissions for: ‘/var/cache/tb-binary/’
Type: Directory
Owner: sysmaint
Group: sysmaint
Octal Permissions: 775
File Size: 4096 bytes
Link Count: 4
Hidden File: No
ACLs: none
Extended Attributes: none
Capabilities: None
Immutable (chattr +i): No

Symlink: No

Parent Folder Symlink: No

Category Read Write Execute
Owner Yes Yes Yes
Group Yes Yes Yes
Public Yes No Yes

Special Attributes:
SUID: Not Set
SGID: Not Set
Sticky Bit: Not Set
Permissions for: ‘/var/cache/tb-binary/.cache’
Type: Directory
Owner: sysmaint
Group: sysmaint
Octal Permissions: 775
File Size: 4096 bytes
Link Count: 3
Hidden File: Yes
ACLs: none
Extended Attributes: none
Capabilities: None
Immutable (chattr +i): No

Symlink: No

Parent Folder Symlink: No

Category Read Write Execute
Owner Yes Yes Yes
Group Yes Yes Yes
Public Yes No Yes

Special Attributes:
SUID: Not Set
SGID: Not Set
Sticky Bit: Not Set
Permissions for: ‘/var/cache/tb-binary/.cache/tb’
Type: Directory
Owner: sysmaint
Group: sysmaint
Octal Permissions: 775
File Size: 4096 bytes
Link Count: 5
Hidden File: No
ACLs: none
Extended Attributes: none
Capabilities: None
Immutable (chattr +i): No

Symlink: No

Parent Folder Symlink: No

Category Read Write Execute
Owner Yes Yes Yes
Group Yes Yes Yes
Public Yes No Yes

Special Attributes:
SUID: Not Set
SGID: Not Set
Sticky Bit: Not Set
Permissions for: ‘/home/user/.cache/tb’
Type: Directory
Owner: user
Group: user
Octal Permissions: 770
File Size: 4096 bytes
Link Count: 5
Hidden File: No
ACLs: none
Extended Attributes: none
Capabilities: None
Immutable (chattr +i): No

Symlink: No

Parent Folder Symlink: No

Category Read Write Execute
Owner Yes Yes Yes
Group Yes Yes Yes
Public No No No

Special Attributes:
SUID: Not Set
SGID: Not Set
Sticky Bit: Not Set
Error: File ‘/home/user/.tb’ not found.

Sorry, I’m not sure how to reply properly to your quotes. I’ll look that up.

2 Likes
4

No need to backup the Template for this purpose here.

What what this about: Some users only backup Tor Browser (such as to USB), then manually restore, copy it back into a VM, and mess up file permissions in the process. This doesn’t seem to have happen here so that’s not applicable. Was just part of the debugging process.

I forgot to mention. This command is supposed to be run in user session.

(sysmaint cannot access Linux user account “user” home folder without sudo and using sudo would make the files owned as root, which can be fixed by running sudo chown --recursive “user”:“user” “/home/user” but that’s besides the point. sysmaint is also only a “normal” user account that has sudo access.

But never mind…

It seems we introduced a new bug due to adding sandboxing to tb-updater when run inside Qubes Template that we didn’t catch during testing. (Even now, I cannot reproduce this.)

You could help test this fix this by running the following commands in sysmaint mode:

sudo chown --recursive -- root:root "/var/cache/tb-binary"
sudo chmod --recursive og+rX -- "/var/cache/tb-binary"
sudo chmod --recursive u+rwX -- "/var/cache/tb-binary"

This is planned to be fixed in tb-updater as soon as possible.

2 Likes
5

Tested the command by running it in a cloned workstation 18 template (sysmaint) and created a new appVM based on it. It works and can open the Tor Browser without any errors.

2 Likes
6

Thank you for testing!

A fix has been pushed to all repositories just now.

(Also another less severe bug has been fixed: Fix detection of previously downloaded version · Kicksecure/tb-updater@ccc1eab · GitHub)

2 Likes