Whonix upgrade fails after interruption

Qubes-Whonix
1

I started uprading Whonix using the salt command, but the process was
interrupted.

On retrying, it fails, unable to create the whonix WS VM due to
“permission denied”. From journalctl:
Oct 08 11:24:35 dom0 qubesd[2098]: permission denied for call b’admin.vm.Create.AppVM’+b’whonix-ws-16’ (b’dom0’ → b’dom0’) with payload of 31 bytes

(see below for the salt output)

When I run the qvm-create command from the salt output manually, it also
fails, because the whonix-ws-16 template doesn’t exist:
$ qvm-create --verbose whonix-ws-16-dvm --class=AppVM --template=whonix-ws-16 --label=red
2021-10-08 11:33:54,499 [MainProcess qvm_create.main:177] app: Error creating VM: Got empty response from qubesd. See journalctl in dom0 for details.

I assume all this is related to the failed previous attempt.

How do I reset the state so that I can successfully do the upgrade?

[user@dom0 ~]$ sudo qubesctl state.sls qvm.anon-whonix

[WARNING ] /var/cache/salt/minion/extmods/states/ext_state_qvm.py:146: DeprecationWarning: BaseException.message has been deprecated as of Python 2.6
status = Status(retcode=1, result=False, stderr=err.message + ‘\n’)

[ERROR ] ====== [‘features’] ======
Virtual Machine does not exist!

====== [‘tags’] ======
[SKIP] Skipping due to previous failure!
[ERROR ] ====== [‘present’] ======
====== stderr ======
/usr/bin/qvm-create whonix-ws-16-dvm --class=AppVM --template=whonix-ws-16 --label=red
app: Error creating VM: Got empty response from qubesd. See journalctl in dom0 for details.

====== [‘prefs’] ======
Virtual Machine does not exist!

====== [‘features’] ======
[SKIP] Skipping due to previous failure!

====== [‘tags’] ======
[SKIP] Skipping due to previous failure!
local:

ID: template-whonix-ws-16
Function: pkg.installed
Name: qubes-template-whonix-ws-16
Result: True
Comment: Package qubes-template-whonix-ws-16 is already installed
Started: 11:24:14.138294
Duration: 5796.629 ms
Changes:

ID: whonix-ws-tag
Function: qvm.vm
Name: whonix-ws-16
Result: False
Comment: ====== [‘features’] ======
Virtual Machine does not exist!

====== [‘tags’] ======
[SKIP] Skipping due to previous failure!
Started: 11:24:19.979281
Duration: 271.503 ms
Changes:

ID: whonix-ws-update-policy
Function: file.prepend
Name: /etc/qubes-rpc/policy/qubes.UpdatesProxy
Result: True
Comment: File /etc/qubes-rpc/policy/qubes.UpdatesProxy is in correct state
Started: 11:24:20.261980
Duration: 14.769 ms
Changes:

ID: whonix-get-date-policy
Function: file.prepend
Name: /etc/qubes-rpc/policy/qubes.GetDate
Result: True
Comment: File /etc/qubes-rpc/policy/qubes.GetDate is in correct state
Started: 11:24:20.277092
Duration: 12.533 ms
Changes:

ID: template-whonix-gw-16
Function: pkg.installed
Name: qubes-template-whonix-gw-16
Result: True
Comment: Package qubes-template-whonix-gw-16 is already installed
Started: 11:24:20.289981
Duration: 1.316 ms
Changes:

ID: whonix-gw-tag
Function: qvm.vm
Name: whonix-gw-16
Result: True
Comment: ====== [‘features’] ======
[SKIP] Feature already in desired state: ENABLE ‘whonix-gw’ = Enabled

====== [‘tags’] ======
[SKIP] All requested tags already set: created-by-dom0,whonix-updatevm
Started: 11:24:20.291708
Duration: 4714.395 ms
Changes:

ID: whonix-gw-update-policy
Function: file.prepend
Name: /etc/qubes-rpc/policy/qubes.UpdatesProxy
Result: True
Comment: File /etc/qubes-rpc/policy/qubes.UpdatesProxy is in correct state
Started: 11:24:25.006518
Duration: 7.468 ms
Changes:

ID: sys-net
Function: qvm.exists
Result: True
Comment: /usr/bin/qvm-check sys-net None
Started: 11:24:25.014322
Duration: 2048.565 ms
Changes:

ID: sys-firewall
Function: qvm.exists
Result: True
Comment: /usr/bin/qvm-check sys-firewall None
Started: 11:24:27.065077
Duration: 1868.662 ms
Changes:

ID: sys-whonix
Function: qvm.exists
Result: True
Comment: /usr/bin/qvm-check sys-whonix None
Started: 11:24:28.935733
Duration: 1744.59 ms
Changes:

ID: whonix-ws-16-dvm
Function: qvm.vm
Result: False
Comment: ====== [‘present’] ======
====== stderr ======
/usr/bin/qvm-create whonix-ws-16-dvm --class=AppVM --template=whonix-ws-16 --label=red
app: Error creating VM: Got empty response from qubesd. See journalctl in dom0 for details.

====== [‘prefs’] ======
Virtual Machine does not exist!

====== [‘features’] ======
[SKIP] Skipping due to previous failure!

====== [‘tags’] ======
[SKIP] Skipping due to previous failure!
Started: 11:24:30.750482
Duration: 5255.361 ms
Changes:

ID: qvm-appmenus --update whonix-ws-16-dvm
Function: cmd.run
Result: False
Comment: One or more requisite failed: qvm.whonix-ws-dvm.whonix-ws-16-dvm
Changes:

ID: anon-whonix
Function: qvm.exists
Result: True
Comment: /usr/bin/qvm-check anon-whonix None
Started: 11:24:36.008428
Duration: 1999.772 ms
Changes:

Summary for local

Succeeded: 10
Failed: 3

Total states run: 13
Total run time: 23.736 s
DOM0 configuration failed, not continuing

2

Did you update dom0 beforehand?

You can install before using salt as per How-to: Install Qubes-Whonix

This would be a Qubes, not a Whonix issue. → What to post in this Qubes-Whonix forum and what not.

At very least the error message isn’t great. Please check Issues · QubesOS/qubes-issues · GitHub and report a bug if none open yet.

When reporting at Issues · QubesOS/qubes-issues · GitHub you’d probably be asked to provide it so I’d post it upfront.

3

Did you update dom0 beforehand?

Yes, however the template installation step fails:

$ sudo qubes-dom0-update --enablerepo=qubes-templates-community qubes-template-whonix-gw-16 qubes-template-whonix-ws-16
Using sys-whonix as UpdateVM to download updates for Dom0; this may take some time...
qubes-templates-community/metalink                          | 2.8 kB  00:00
qubes-templates-community                                   | 3.0 kB  00:00
qubes-templates-community/primary_db                        | 5.1 kB  00:00
No Match for argument qubes-template-whonix-gw-16
No Match for argument qubes-template-whonix-ws-16
Nothing to download

You can install before using salt

Yes, that’s what I’m doing, and the salt command given there (sudo qubesctl state.sls qvm.anon-whonix) is failing.

When reporting at [link] you’d probably be asked to provide it so I’d post it upfront.

Yes, that’s why I already included the journalctl error in my original
post, here:

4

This is a Qubes issue. Whonix doesn’t maintain the Qubes repository or qubes-dom0-update.

That could happen if the package is already in “some sort of installed”. To check that’s not the case of having any packages already installed, see:

dom0:

dnf list | grep qubes-template-whonix

As mentioned, that belongs to Qubes issues. I cannot resolve it here, highly unlikely being resolved here, has a chance of getting resolved at qubes-issues.

There’s no output of journalctl as far as I can see. Even if there was, I cannot work on that.

5

This is a Qubes issue. Whonix doesn’t maintain the Qubes repository or qubes-dom0-update.

Whonix does maintain the installation instructions which I’m following
:slight_smile:

That could happen if the package is already in “some sort of installed”. To check that’s not the case of having any packages already
installed, see:

dom0:

dnf list | grep qubes-template-whonix

It looks like “some sort of installed” is correct. Uninstalling it also
fails, probably because there is no whonix-ws-16 template:


# dnf list | grep qubes-template-whonix
qubes-template-whonix-gw-15.noarch     4.0.6-202103292247     @qubes-dom0-cached
qubes-template-whonix-gw-16.noarch     4.0.6-202109211111     @qubes-dom0-cached
qubes-template-whonix-ws-15.noarch     4.0.6-202103292247     @qubes-dom0-cached
qubes-template-whonix-ws-16.noarch     4.0.6-202109211111     @System

# dnf remove qubes-template-whonix-ws-16
[...]

usage: qvm-template-postprocess [--verbose] [--quiet] [--help] [--really]
                                [--skip-start] [--keep-source]
                                {post-install,pre-remove} name dir
qvm-template-postprocess: error: No Qube with this name exists
error: %preun(qubes-template-whonix-ws-16-4.0.6-202109211111.noarch) scriptlet failed, exit status 2
Error in PREUN scriptlet in rpm package qubes-template-whonix-ws-16
Error in PREUN scriptlet in rpm package qubes-template-whonix-ws-16
qubes-template-whonix-ws-16-4.0.6-202109211111.noarch was supposed to be removed but is not!
  Verifying   : qubes-template-whonix-ws-16-4.0.6-202109211111.noarch                           1/1

Removed:
  qubes-template-whonix-ws-16.noarch 4.0.6-202109211111

Complete!
6

I also haven’t been able to work out where the %preun script is located, else I would try editing it to remove the part where it tries to remove the (not present) whonix-ws-16 template.

7

Possible solution:
sudo rpm -e --nopreun qubes-template-whonix-ws-16

9

That appears to have fixed it. The salt command now works:
sudo qubesctl state.sls qvm.anon-whonix