Whonix-workstation-17: Cant use sudo "permission denied: sudo" - on brand new template

[EveK818]

I am using Qubes OS, and just installed whonix-workstation-17 from the community templates (Qubes Menu → Qubes Tools → Qubes Template Manager → whonix-workstation-17 → Install → Apply). After installation, I booted up the “whonix-workstation-17 template” and tried to update and upgrade my applications with in xfce terminal:

sudo apt update && sudo apt install myapplication

Here is the output from it:

zsh: permission denied: sudo
zsh: exit 126   sudo su

So it turns out on a freshly installed template, I don’t have permissions to use sudo. sudo su returns the exact same message. I though I might have downloaded a corrupted whonix-workstation-17 image, so I removed it, and then downloaded it again and tried using sudo or sudo su, with the exact same results:

zsh: permission denied: sudo
zsh: exit 126   sudo su

So on a fresh install inside of Qubes, I cannot use sudo in whonix-workstation-17. Why is this happening, and how can I get sudo to work in my whonix-workstation-17?

Please help.

[extraextra]

Use the search function.

Permission denied : sudo

Hello I’m brand new to Whonix, I installed a Ubuntu 24 LTS on my mini pc then added a Virtual Box. The Gateway work and the terminal return something when I do a “sudo -l” but when using this same command on the Workstation I have “permission denied : sudo” (no matter the sudo command) It’s normal? So I can’t install anything with sudo on the Workstation? I can’t even do a “sudo apt update && sudo apt upgrade -y” Thanks for any tips.

[Patrick]

Utilize Search Engines, Documentation and AI

[EveK818]

All I see in the links that’s relative and makes sense is:

The opposite of user-sysmaint-split is Unrestricted Admin Mode, which users can opt in to enable. In case you are wondering how to fix:

permission denied: sudo

So it seems like the answer is (according to the documentation provided in your link) to uninstall user-sysmaint-split to enable “Unrestricted Admin Mode”…

• Qubes R4.2: Open a Qubes Root Console:
dom0 → Terminal → and enter the command:

qvm-run -u root whonix-workstation-17 xfce4-terminal

• In XFCE Terminal of whonix-workstation-17 run:
sudo dummy-dependency user-sysmaint-split

• Install qubes-core-agent-passwordless-root to allow the user account to elevate to root.
sudo apt install qubes-core-agent-passwordless-root

• Shut down the Template.

• Reboot any AppVMs that are based on the Template.

• Done.

My concern is in the Impact of unrestricted admin mode section in the documentation here: Unrestricted Admin Mode

The reason I need sudo is to install Applications, so my follow-up questions would be:

1. Is the above method that I demonstrated CORRECT?And is it the Whonix recommended way of enabling sudo or root to install applications?
2. Why can I not keep user-sysmaint-split mode enabled, and instead just install applications using the root console (qvm-run -u root whonix-workstation-17 xfce4-terminal) for the corresponding qube? Wouldn’t this keep me more secure than uninstalling user-sysmaint-split?
3. Why can I not log into (su - sysmaint) the “sysmaint” user account from the root console, and then install and or update applications from there? Thus again, keeping the security of the sysmaint user and user-sysmaint-split application? Wouldn’t this keep me more secure than uninstalling user-sysmaint-split?

Please help with real responses instead of posting links to confusing documentation.

[Patrick]

@EveK818

Is the above method that I demonstrated CORRECT?And is it the Whonix recommended way of enabling sudo or root

If you want sudo/root, then it’s the recommended way.

@EveK818

Why can I not keep user-sysmaint-split mode enabled, and instead just install applications using the root console (qvm-run -u root whonix-workstation-17 xfce4-terminal) for the corresponding qube?

You can do that.

@EveK818

Wouldn’t this keep me more secure than uninstalling user-sysmaint-split?

Yes.

@EveK818

Why can I not log into (su - sysmaint) the “sysmaint” user account from the root console, and then install and or update applications from there? Thus again, keeping the security of the sysmaint user and user-sysmaint-split application? Wouldn’t this keep me more secure than uninstalling user-sysmaint-split?

Quote sysmaint, Usage

R4.2

In Qubes OS R4.2 and earlier: Kicksecure for Qubes cannot be booted into sysmaint session. However, user-sysmaint-split is useful in Qubes VMs too because it makes SUID privilege escalation tools (sudo, su, pkexec) inaccessible for account user. You can access the root account by opening a Qubes Root Console.

Much improved in Qubes-Whonix 18 for Qubes R4.3. Highly recommend as per Qubes-Whonix 18 Released! Major Release Upgrade!

See same link as above for R4.3 documentation.

[EveK818]

Thank you for all of this. I think I understand, but I’m not certain. I will first upgrade my Qubes to 4.3, and then upgrade to whonix 18, as it seems it will be easier to solve my problem doing these things first. I will let you know if I have any further questions after the upgrade. Thanks for the helpful answers!