Hi there, so I was using Whonix KVM on my older laptop with Ubuntu as host and it was working fine, however I moved to a different laptop now, Ubuntu host again, I copied over my older VM and reconfigured everything as I had in the previous laptop but this time the Gateway connects, I tested the Tor Connection, apt update, systemcheck, everything works fine but when it comes to the Workstation, it sdwdate gives an error, “onion-time-pre-script detected a known permanent (until the user fixes it) error status. Consider running systemcheck for more information.
Systemcheck first of all gives Tort Control Port could not be reached, Attempt 1 of 5 and 5 of 5 and then tells me to make sure Gateway is running, to run systemcheck on Gateway etc.
I have the old laptop right here, I have tried to dumpxml from there so that it takes exactly the same settings, no luck, re-extracted from the tar archive and set everything up, no luck yet again. Made sure the gateway, workstation and host are on the same timezone as well
Did you remember to set up the Whonix-Internal and Whonix-External networks properly? This sounds a lot like your Whonix-Internal network isn’t set up right.
Yes, as far as I know, I did, I even used the fresh Whonix_internal_network.xml from the archive just in case I messed up the old xml file, I did virsh net-undefine, net-destroy, restarted my host and then defined the network again.
Anyone with any ideas as to check what could be going wrong here?
I have these laptop side by side, same everything, I have VPN on host, same network configuration files, on one system it works, fails on the other one, Gateway on both system have access to tor but Workstation does not work on the one of the machines, I have at this point tried everything I could possibly think of.
Thats not an error can be seen from our side, this is something you are doing wrong somewhere, but i need to check:
So on the new laptop you started fresh installation of GW and WS and only copied the data (files,images..)? or you moved the entire old VMs to the new laptop?
I had initially moved the entire VMs, but just to test out if I had done it wrong, I downloaded fresh files and repeated the steps from the guide here but same result, Gateway seems to be connected to tor but the workstation does not work at all
I had already downloaded the 18.1.4.2 and tried to replicate the steps, used the xml files that came inside the archive, but I will give these xml files a try and see what happens.
Well the new xml files return a multitude of issues that I do not unfortunately have the time to get into, apparmor keeps denying passt every time I try to run the VM itself, I did some digging around and then resorted to AI assisted troubleshooting and it kept coming back to change the network xml settings to nat instead of using passt as armor keeps denying it.
I can share the error here if you’d like to analyze it further
Error starting domain: internal error: Child process (passt --one-off --socket /run/libvirt/qemu/passt/17-Whonix-Gateway-net0.socket --pid /run/libvirt/qemu/passt/17-Whonix-Gateway-net0-passt.pid) unexpected fatal signal 11
Traceback (most recent call last):
File “/usr/share/virt-manager/virtManager/asyncjob.py”, line 67, in cb_wrapper
callback(asyncjob, *args, **kwargs)
~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^
File “/usr/share/virt-manager/virtManager/asyncjob.py”, line 101, in tmpcb
callback(*args, **kwargs)
~~~~~~~~^^^^^^^^^^^^^^^^^
File “/usr/share/virt-manager/virtManager/object/libvirtobject.py”, line 57, in newfn
ret = fn(self, *args, **kwargs)
File “/usr/share/virt-manager/virtManager/object/domain.py”, line 1446, in startup
self._backend.create()
~~~~~~~~~~~~~~~~~~~~^^
File “/usr/lib/python3/dist-packages/libvirt.py”, line 1395, in create
raise libvirtError(‘virDomainCreate() failed’)
libvirt.libvirtError: internal error: Child process (passt --one-off --socket /run/libvirt/qemu/passt/17-Whonix-Gateway-net0.socket --pid /run/libvirt/qemu/passt/17-Whonix-Gateway-net0-passt.pid) unexpected fatal signal 11
vmx – Intel VT-x, virtualization support enabled in BIOS.
svm – AMD SVM,virtualization enabled in BIOS.
grep -c -E '(vmx|svm)' /proc/cpuinfo
# should return > 0
or
cpu-checker: It is a package that includes the kvm-ok tool, used to verify whether your CPU and system support virtualisation with KVM.
sudo apt install cpu-checker -y
kvm-ok
About Permissions:
Groups depend on debian/ubuntu versions. I usually do it:
1. Add user to the group:
sudo adduser $USER libvirt
2. Set permissions to libvirt:
sudoedit /etc/libvirt/libvirtd.conf
unix_sock_group = "libvirt"
unix_sock_rw_perms = "0770"
3. Set permissions to qemu:
sudoedit /etc/libvirt/qemu.conf
group = "libvirt"
user = "<user_name>"
4. Restart service:
systemctl restart libvirtd.service
virt-manager
I was trying to tweak with the app armor settings however, when I run passt via command line or use it that way it works fine, but when libvirtd calls it suddenly apparmor decides to deny it. I tried to adjust it but could not get around to do so.
For a moment I thought about just using whonix with virtualbox but all my other VMs are in KVM so I won’t be able to use them when using virtualbox so this has been just some painstaking work at this point honestly.
Last time I tried Whonix KVM on Ubuntu 26.04, it just worked. I had to install virt-manager, then log out and log back in, then follow the instructions on the wiki, had no issues. That was with the qemu:///system installation though, I haven’t tried the qemu:///session installation yet.
I can confirm that aa-status reports passt apparmor profile as loaded and in enforce mode on Debian and is working fine. I recommend disabling it on your host temporarily and reporting the issue to your distro maintainers to update their apparmor profiles package to a working version. Svirt doesn’t currently isolate VMs from each other with qemu session anyhow