ToDo for Developers

From Kicksecure
< Dev
Jump to navigation Jump to search
Design Previous page: Dev/Developer Portal Index page: Design Next page: Dev/todo/archived ToDo for Developers

TODO

Developers only! Warning: This is for developers-only!

TODO DEV

[edit]

trixie-port - Qubes - sys-net - sdwdate-gui-qubes@.service - systemd protocol error

[edit]
sudo journalctl --boot -u sdwdate-gui-qubes@0-1443-1000.service | cat
Dec 04 08:59:46 sys-net systemd[1]: Starting sdwdate-gui-qubes@0-1443-1000.service - sdwdate graphical user interface - Qubes socket proxy (PID 1443/UID 1000)...
Dec 04 08:59:57 sys-net systemd[1]: sdwdate-gui-qubes@0-1443-1000.service: Failed with result 'protocol'.
Dec 04 08:59:57 sys-net systemd[1]: Failed to start sdwdate-gui-qubes@0-1443-1000.service - sdwdate graphical user interface - Qubes socket proxy (PID 1443/UID 1000).
  • Patrick: Fixed. But still more issues.
[WARNING] [systemcheck] systemd units check result: 1 systemd units failed to load. These might be stuck in state failed, activating or deactivating. Output of leaprun read-systemctl-logs-failed-units-pretty:

########################################
  UNIT                                  LOAD   ACTIVE     SUB   JOB   DESCRIPTION
● sdwdate-gui-qubes@1-1483-1000.service loaded activating start start sdwdate graphical user interface - Qubes socket proxy (PID 1483/UID 1000)

Legend: LOAD   → Reflects whether the unit definition was properly loaded.
        ACTIVE → The high-level unit activation state, i.e. generalization of SUB.
        SUB    → The low-level unit activation state, values depend on unit type.
        JOB    → Pending job for the unit.

1 loaded units listed.
########################################

[root ~]# systemctl status sdwdate-gui-qubes@1-1483-1000.service
○ sdwdate-gui-qubes@1-1483-1000.service - sdwdate graphical user interface - Qubes socket proxy
     Loaded: loaded (/usr/lib/systemd/system/sdwdate-gui-qubes@.service; static)
     Active: inactive (dead)

Dec 04 09:24:22 sys-net systemd[1]: Starting sdwdate-gui-qubes@1-1483-1000.service - sdwdate graphical user interface - Qubes socket proxy (PID 1483/UID 1000)...
Dec 04 09:24:32 sys-net systemd[1]: Started sdwdate-gui-qubes@1-1483-1000.service - sdwdate graphical user interface - Qubes socket proxy (PID 1483/UID 1000).
Dec 04 09:24:32 sys-net systemd[1]: sdwdate-gui-qubes@1-1483-1000.service: Deactivated successfully.
zsh: exit 3     systemctl status sdwdate-gui-qubes@1-1483-1000.service

[root ~]# journalctl --boot -u sdwdate-gui-qubes@1-1483-1000.service | cat
Dec 04 09:24:22 sys-net systemd[1]: Starting sdwdate-gui-qubes@1-1483-1000.service - sdwdate graphical user interface - Qubes socket proxy (PID 1483/UID 1000)...
Dec 04 09:24:32 sys-net systemd[1]: Started sdwdate-gui-qubes@1-1483-1000.service - sdwdate graphical user interface - Qubes socket proxy (PID 1483/UID 1000).
Dec 04 09:24:32 sys-net systemd[1]: sdwdate-gui-qubes@1-1483-1000.service: Deactivated successfully.
[root ~]#
  • systemd probably does not like that a Type=notify unit can exit
systemctl --no-legend --no-pager --no-block --state=failed,activating,deactivating list-units ● sdwdate-gui-qubes@49-1483-1000.service loaded 

activating start start sdwdate graphical user interface - Qubes socket proxy (PID 1483/UID 1000) can we avoid getting stuck in that state?

helper-scripts - sanitize-string and strip-html improvements

[edit]
  • sanitize-string
    • please add pipe support
    • currently: "sanitize-string: Usage: sanitize-string string [max_length]",
      • would be better to have string length as mandatory first argument? Perhaps nolimit as a keyword? Please update code base.
  • strip-html
    • please add pipe support
  • integrate minimally into tests
  • Aaron: Done, commits pushed to helper-scripts and all repositories that used sanitize-string or strip-html (in either library or executable form).
  • Patrick: Merged.
  • small lint issue: https://github.com/Kicksecure/helper-scripts/actions/runs/19847500678/job/56867679739archive.org iconarchive.today icon
    • Aaron: Fixed.
  • Should sanitize-string act like stcatn, i.e. always ensure there is a trailing newline at the end?
    • Aaron: Unsure. I would initially argue no, strings may legitimately not contain a trailing newline. If in the future we need to sanitize a string and ensure it is terminated with a newline, we should add a new option to sanitize-string to do this.
  • AI:
Additional security concerns in strip-markup

    Terminal/console escape injection remains possible. The sanitizer removes only markup tags and replaces <, >, and & with underscores when it detects suspicious transformations, but it leaves all other control characters untouched. Because StripMarkupEngine runs with convert_charrefs = True, an attacker can supply inputs containing HTML entities for escape characters (e.g., &#27; for ESC), which will be decoded and written back out unchanged via sys.stdout.write. This can produce ANSI escape sequences in logs or terminals, enabling log forgery or malicious terminal control even though HTML tags were stripped.

Not safe for contextual HTML output. The “sanitization” only removes tags and (in the fallback path) converts <, >, and & to underscores; it does not escape quotes, backticks, or other characters that are dangerous in attribute, JavaScript, or CSS contexts. If the supposedly “clean” output is later interpolated into HTML attributes or script blocks, an attacker can inject payloads such as javascript:... URLs or string-breaking quotes that lead to XSS despite markup stripping.
  • Aaron:
    • The terminal/console escape injection issue is possibly not a problem, because Python's HTML parser discards (some) entities that encode the ESC character rather than emitting the character they encode. Nonetheless, added defense-in-depth code to sanitize_string to ensure stray escapes are sanitized after HTML parsing is complete. Commits pushed to helper-scripts.
    • The contextual HTML output concern is not a worry since sanitize_string is not designed to make strings that are safe to place into the attribute of an HTML element.
  • Patrick: Merged.
  • Patrick:
    • ./usr/lib/python3/dist-packages/stdisplay/stsponge.py - temporary file should be deleted?
    • temp_file.close() is redundant due to "with"?
  • bug: running "strip-markup" as is without any input will hang forever

misc AI review #2

[edit]

trixie-port - misc qubes test failures

[edit]
Using packages from trixie Kicksecure repo, not trixie-developers
Before any morph: (8.388 + 8.015 + 8.112) / 3 = 8.171
After adding helper-scripts: (8.005 + 8.179 + 7.999) / 3 = 8.061
After adding security-misc: (8.222 + 8.346 + 8.404) / 3 = 8.324 (with outlier 18.132) (Marked drop in performance here, and the outlier did take an awfully long time, does the first boot after security-misc installation do something weird?)
After adding usability-misc: (8.381 + 8.395 + 8.326) / 3 = 8.367
After adding dist-base-files: (8.516 + 8.399 + 8.431) / 3 = 8.448
After adding kicksecure-base-files: (8.253 + 8.461 + 8.430) / 3 = 8.381
After adding desktop-config-dist: (8.714 + 8.580 + 8.598) / 3 = 8.630 (Another marked drop in performance here)
After adding sdwdate: (8.867 + 8.751 + 8.946) / 3 = 8.854 (another marked drop in performance here, not really a surprise since this pulled in Tor)
After adding sdwdate-gui: (9.167 + 9.075 + 9.165) / 3 = 9.135 (another marked drop in performance)
After adding systemcheck: (9.057 + 9.125 + 9.103) / 3 = 9.095
After adding msgcollector-gui: (9.171 + 9.190 + 9.224) / 3 = 9.195 (noticeable performance drop)
After adding vm-config-dist: (9.245 + 9.378 + 9.112) / 3 = 9.245 (doesn't seem to be a truly reliable drop in performance)
After adding bootclockrandomization: (9.312 + 9.152 + 9.081) / 3 = 9.181
After adding dist-general-gui-lxqt: (9.264 + 9.112 + 9.187) / 3 = 9.187
... should have done more incremental benchmarks here ...
After installing the rest of everything with kicksecure-qubes-gui-lxqt: (9.974 + 9.976 + 9.921) / 3 = 9.957
  • Takeaways from benchamrking:
    • It might be worth trying to avoid forking in our startup scripts; maybe having less forks and less units would allow for faster operation. Unfortunately Python multithreading isn't very fast, and Bash doesn't have multithreading, so we can't get parallelism and absence of forks at the same time.
    • We might see if we can avoid blocking startup on units that aren't startup-critical. sdwdate-gui, for instance, takes some time to come up, but also apparently blocks the UI showing up for a quarter of a second on my test machine, which could possibly be avoided.
    • None of the performance issues here seem particularly egregious to me, certainly not enough to cause slews of timeouts like we're seeing in Whonix's tests on OpenQA.
    • I used a very low-RAM system for this, and it worked quite well; no memory exhaustion issues were encountered.
    • Further research needs to be done on the specific tests that are timing out to determine what they're trying to do that is timing out.
  • Investigation of logs from a DispVM test where Whonix-Workstation timed out:
    • Qubes' test infra seems to have a periodic hardware lag issue that affects all VMs.
    • Whonix is probably just the first thing to trim timeouts because we have too many services doing too many resource-intensive tasks during early boot.
guest-disp2246.log (Fedora Linux 42, 7 second kernel load time, 1 second from "Qubes: done" to disk mount, login prompt, 35 second runtime)
guest-disp3748.log (Fedora Linux 42, 6 second kernel load time, 2 seconds from "Qubes: done" to disk mount, login prompt, 66 second runtime)
guest-disp5735.log (Fedora Linux 42, 7 second kernel load time, 2 seconds from "Qubes: done" to disk mount, login prompt, 29 second runtime)
guest-disp5839.log (Debian 13, 6 second kernel load time, 9 seconds from "Qubes: done" to disk mount, login prompt (barely), 60 second runtime)
guest-disp5955.log (Whonix-Gateway 18, 9 second kernel load time, 12 seconds from "Qubes: done" to disk mount, no login prompt, 81 second runtime)
guest-disp6231.log (Whonix-Gateway 17, 7 second kernel load time, 3 seconds from "Qubes: done" to disk mount, login prompt, 62 second runtime)
guest-disp6497.log (Debian 13, 6 second kernel load time, 8 seconds from "Qubes: done" to disk mount, login prompt (barely), 39 second runtime)
guest-disp678.log (Fedora Linux 42, 8 second kernel load time, 4 seconds from "Qubes: done" to disk mount, login prompt (barely), 39 second runtime)
guest-disp7152.log (Whonix-Workstation 18, 7 second kernel load time, 6 seconds from "Qubes: done" to disk mount, no login prompt, 70 second runtime)
guest-disp9514.log (Debian 13, 5 second kernel load time, 6 seconds from "Qubes: done" to disk mount, login prompt (barely), 43 second runtime)
guest-sys-net.log (Fedora Linux 42, 6 second kernel load time, 0 seconds from "Qubes: done" to disk mount, login prompt, hours long runtime for obvious reasons)

user session shutdown issue

[edit]

fix VirtualBox green turtle

[edit]
  • Test with Windows Home, if possible.
  • Test with Windows Pro.
  • Document how to use VirtualBox with Hyper-V.
    • https://www.virtualbox.org/manual/topics/AdvancedTopics.html#hyperv-supportarchive.org iconarchive.today icon
    • This is important because it is the future.
    • It is also important because it requires fewer changes to Windows. It does not require disabling Windows security features.
    • Using VirtualBox with Hyper-V might not be possible on Windows Home.
      • There are mixed reports about whether Windows Home supports "full" Hyper-V. The Home edition might use Hyper-V internally, which causes issues for VirtualBox. ("green turtle")
  • Document how to use VirtualBox with VirtualBox's native virtualization ("blue chip" symbol instead of "green turtle").
    • This might be useful for users on Windows Home edition.
    • Add the required commands to fix the VirtualBox "green turtle" in the wiki: VirtualBox/Green_Turtle_Issue
    • Documentation on how to manually change the settings is useful for understanding but should not be the ultimate goal.
    • All steps should be executable using command-line commands only, as there are too many steps to perform manually.
    • Consider accomplishing this using Windows Intune.
    • Write a batch script (if not using Windows Intune).
    • Add an option to the Windows Installer to do this.
    • If unsolvable, document everything learned or attempted. This might assist others in continuing the work. Collect any helpful links and add quotations from useful information.
  • Essentially, explore and document both approaches: using VirtualBox with Hyper-V and using VirtualBox with its native virtualization while disabling Windows' Hyper-V.
  • Aaron: Current research:
    • Intune is not free and does not work on home editions of Windows, thus not usable.
    • PowerShell scripting would likely make quick work of this, but unfortunately Microsoft prevents one from running PowerShell scripts without taking explicit (and IIRC convoluted) steps to enable them, as a security feature.
    • Probably the easiest solution is to use a batch file and then execute it as administrator (which is tricky but not impossible; requires calling a ShellExecuteExW function in the Windows API with the "runas" verb, see https://learn.microsoft.com/en-us/windows/win32/shell/launcharchive.org iconarchive.today icon, this should trigger a UAC prompt, then the script should be able to run and do whatever it needs to).
    • Batch files for disabling Hyper-V and re-enabling virtualization-based security under Windows 11 Home have been created. Still need to wire them into Whonix-Installer itself.
  • todo: add debug output to script in case there are issues, users can post the debug output
    • Aaron: Done.
  • todo: run hypervisorlaunchtype auto and hypervisorlaunchtype Off to work around windows bug experienced by Patrick
    • Aaron: Done.
  • todo: run at the end for debugging Get-CimInstance Win32_ComputerSystem | Select-Object HypervisorPresent
  • todo: add these commands?
  • todo: disable firmware protection
    • Aaron: Done.
  • todo: explain commands and potential failures as echo comments
    • Aaron: Done.
  • todo: add separator output between lines
    • Aaron: Done.
  • todo: allow the script to be executed by the installer
    • option: enable, disable
    • default: none (require user choice)
    • show link to the related wiki page
Fix VirtualBox green turtle issue which can cause grave VirtualBox stability and performance issues by fully disabling Windows Hyper-V?

Notes:

* Security impact: This unfortunately also disables necessarily various Windows security features.
* Root issue caused by: VirtualBox, Microsoft Windows
* Root issue not caused by: VM guest operating systems such as Whonix.

Alternatives:

* Linux based host operating systems are unaffected. See host operating system selection.
* Perhaps try out Kicksecure (on USB)?
* Or Whonix-Host in the future? (Not yet available at time of writing.)

https://www.kicksecure.com/wiki/VirtualBox/Green_Turtle_Issue
https://www.kicksecure.com/wiki/Host_Operating_System_Selection
https://www.kicksecure.com
https://www.kicksecure.com/wiki/USB_Installation
https://www.whonix.org/wiki/Whonix-Host

review tor-control-panel anon-connection-wizard merge

[edit]

trixie-port - usability-misc versus policyrcd-script-zg2

[edit]
  • usability-misc Depends: on policyrcd-script-zg2
  • todo: think through if this dependency should be removed, moved elsewhere and can interact badly with user-sysmaint-split policyrcd
  • Aaron:
    • Very unlikely to interact badly. policyrcd-script-zg2 uses the alternatives system, as does user-sysmaint-split, and user-sysmaint-split installs its policy-rc.d with a higher priority than policyrcd-script-zg2, therefore it will take priority. However, this also means that the functionality offered by policyrcd-script-zg2 is broken, likely including the pointer to helper-scripts' policy-rc.d in the POLICYRCD environment variable used by apt-get-noninteractive.
    • The use of POLICYRCD in apt-get-noninteractive seems superfluous and possibly even bad. During package builds, disabling daemon restart makes sense, but this is done by installing helper-scripts' policy-rc.d with a higher priority than even user-sysmaint-split's version, so POLICYRCD is unnecessary to prevent things like unintentional connections to Tor. Done in help-steps/prevent-daemons-from-starting. Users who use apt-get-noninteractive would probably reasonably expect daemons to be restarted during installation of new packages.
    • Suggestion: Remove dependency, strip all instances of POLICYRCD from codebase where the variable is set to a path. (Currently the variable is only set in apt-get-noninteractive and dpkg-noninteractive. There is also a use in grml-debootstrap but it appears to be used as a flag, not a path, thus this should not be removed.)
  • Patrick:
    • Because daemon restarts can cause APT upgrade failures and `apt-get-noninteractive` is designed as a tool to easily fix broken APT. Documented in its man page just now. Therefore, please keep that as is.
    • todo: move dependency of policyrcd-script-zg2 from usability-misc to helper-scripts?
    • todo: review policyrcd-script-zg2. seems to be a stable, not changing much, simple package with only 1 essential file: /usr/sbin/zg-policy-rc.d
    • todo: please port user-sysmaint-split to policyrcd-script-zg2, if sensible

sdwdate-gui - json decode bug

[edit]
+ /usr/libexec/helper-scripts/terminal-wrapper 'leaprun sdwdate-log-viewer'
sdwdate_status_changed: WARNING: Could not parse JSON from sdwdate
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/sdwdate_gui/sdwdate_gui_client.py", line 393, in sdwdate_status_changed
    status_dict: dict[str, str] = json.load(f)
                                  10:36, 1 November 2025 (UTC)[[Special:Contributions/127.0.0.1|127.0.0.1]] 10:36, 1 November 2025 (UTC)^^^
  File "/usr/lib/python3.13/json/__init__.py", line 293, in load
    return loads(fp.read(),
        cls=cls, object_hook=object_hook,
        parse_float=parse_float, parse_int=parse_int,
        parse_constant=parse_constant, object_pairs_hook=object_pairs_hook, **kw)
  File "/usr/lib/python3.13/json/__init__.py", line 346, in loads
    return _default_decoder.decode(s)
           10:36, 1 November 2025 (UTC)10:36, 1 November 2025 (UTC)10:36, 1 November 2025 (UTC)10:36, 1 November 2025 (UTC)[[Special:Contributions/127.0.0.1|127.0.0.1]]^^^
  File "/usr/lib/python3.13/json/decoder.py", line 345, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
               10:36, 1 November 2025 (UTC)10:36, 1 November 2025 (UTC)10:36, 1 November 2025 (UTC)^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.13/json/decoder.py", line 363, in raw_decode
    raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
sdwdate_status_changed: WARNING: Could not parse JSON from sdwdate
  • Patrick: Not seen in a while. Might already be fixed. If the code does not have any obvious issues, this is probably alright.

systemcheck - document ignored systemcheck warning messages

[edit]
  • /etc/systemcheck.d/30_default.conf contains a lot of ignored warnings/errors
  • please add comments on top why that line is being ignored
  • add links to upstream issues
  • in unknown cases, please investigate, report upstream
  • in case of unknowns, high effort, rabbit holes, please create follow-up issues

sysmaint-panel - add gsmartcontrol and smart-notifier

[edit]
  • non-Qubes only
  • hardware only
  • add gsmartcontrol
  • also add smart-notifier, if sensible to task bar?

change program menu icons

[edit]
  • sysmaint-panel and live-indicator: these are currently using the python logo
  • please use different icon (not necessarily project logo)

351-socks-auth-extensions

[edit]

Qubes OS - whonix-workstation-18 performance issues compared to debian-13-xfce

[edit]

genmkfile and or developer-meta-files - scan for empty folders and abort

[edit]
  • cause reproducible issues

dracut improvements

[edit]
  • install bash module by default? vs qubes initial memory
  • set SYSTEMD_SULOGIN_FORCE=1 by default to allow login into dracut emergency console even if root account password is locked

https://github.com/QubesOS/qubes-core-agent-linux/pull/526/filesarchive.org iconarchive.today icon

vm-config-dist ai review

[edit]

terminal login messages

[edit]
  • adjust cli (virtual console) login manager messages based on session type (user session versus sysmaint session)
grep -r -i "default username"

find . | grep --fixed-strings issue.d

find . | grep --fixed-strings motd.d

heads - add whole disk boot mode

[edit]
  • Kicksecure's ISO does not boot easily on Heads because booting it requires mounting the full disk device, whereas Heads is only designed to open individual disk partitions.
  • Add a new option to the boot menu for the whole disk device, for compatibility with ISOs like Kicksecure's.
  • Might not be needed it Heads upstream implements it first.

VirtualBox - shared folder - error handling

[edit]
  • user story: I think that I added a shared folder alraedy. But I am mistaken without knowing. The following error message by mnt-shared-vbox.service leads to hunting non-existing issues. The only issue is the omitted host configuration.
Nov 06 16:29:18 localhost mount-shared[1099]: /sbin/mount.vboxsf: mounting failed with the error: No such file or directory

VirtualBox - shared folder - confusing readme

[edit]
  • The readme shows up even after shared folder is perfectly functional.
  • Maybe best to abolish the readme.
  • Readme is copied over and over again?

apparmor - allow_disconnected concerns

[edit]

approx - work around and report metadata caching problems

[edit]

qubes - qrexec to NetVM

[edit]
  • investigate if it is possible to get the name of a qube's NetVM from within the qube, or otherwise send qrexec requests to the NetVM
  • contribute feature to upstream if it doesn't exist
  • use case: don't require sdwdate-gui in Qubes-Whonix-Workstation to be explicitly configured to talk to the appropriate Qubes-Whonix-Gateway in a multi-gateway setup

compiled code - investigate using clang

[edit]
  • clang provides a minimal UBSan runtime which may be usable as an additional hardening feature.
  • Investigate if this is worthwhile.
  • gcc supports more warnings, perhaps use gcc and clang together for "diagnostic builds" and static analysis, and clang for release builds?
  • Perhaps build twice with, first with gcc for testing only, then with clang?
    • Patrick: Keeping gcc support might be worthwhile as per non-technical reasons: GCC vs Clang-LLVM

port to sequoia-pgp

[edit]
  • port all code base from gpg to sequoia-pgp as much as sensible
  • related - not part of this task - only for reference - https://github.com/QubesOS/qubes-issues/issues/8241archive.org iconarchive.today icon
  • https://sequoia-pgp.org/blog/2022/12/19/202212-chameleon-0.1/archive.org iconarchive.today icon
  • https://packages.debian.org/trixie/sequoia-chameleon-gnupgarchive.org iconarchive.today icon
    • Can we just symlink /usr/bin/gpg to /usr/bin/gpg-sq?
  • Aaron: Unsure if replacing gpg with gpg-sq wholesale is a good idea. Quoting the blog post on gpg-sq:
    • "A consequence of not modifying GnuPG’s state but using an overlay is that changes made using the Chameleon will not be picked up by GnuPG. For example, if you import a certificate using the Chameleon, it will only be inserted into the overlay, and GnuPG will not see it."
    • Would prefer porting to sq's native API instead, to avoid consistency issues.
  • Aaron: Delay until after the release of Kicksecure 18 perhaps? That way the work done here doesn't end up causing us major problems before the release is complete.
    • Delaying this may be essential, as Whonix 18 should release before Qubes OS R4.3 does.
    • Please move to WAITING ON if good to delay, move back to TODO if we should pursue this now.
      • Patrick: Please do in sequoia branch.

kloak - Qubes OS mouse anonymization improvements

[edit]

optimize accountctl / get-user-list / get-password-status-list

[edit]
  • current implementation: forks frequently, has to re-open and re-parse /etc/shadow and related files for every query. Results in noticeable performance delays in some scripts, also is non-atomic and vulnerable to race conditions.
  • better implementation: a library that caches /etc/shadow and related files when the library is sourced. Queries rely on in-memory data and avoid forking if possible.
  • refactor existing bash code? rewrite in Python? Python may be simpler and faster, but existing bash implementation seems very stable.

three finger salute

[edit]
  • https://forums.kicksecure.com/t/ctrl-alt-del-three-finger-salute-action/1197archive.org iconarchive.today icon
  • the three finger salute should so something useful similar to what it does on Windows
    • lock screen (Qubes does that)
    • start task manager
    • emergency shutdown button
  • Open a sysmaint (or root) shell?
    • This feature can be deferred.
    • SAK alike?
      • Can a compromised Wayland swallow the three finger salute and mount a login spoofing attack?
        • Aaron: No, because the salute is read by the handler via evdev, which is provided directly by the kernel. It could receive the keypress despite emerg-shutdown or similar seeing it too, but emerg-shutdown would SIGSTOP the compositor before running the actual Ctrl+Alt+Delete handler.
      • Perhaps we should use the real SAK, but reconfigure its action, if that is at all possible?
    • research SIGSTOP
      • Aaron: Looks like it works reliably, even when a stuck kernel thread is involved
    • research locked up kernel threads and their abuse potential
    • anti-phishing code
      • static
      • TOTP - perhaps at a later time

live-hardener vs efi bug

[edit]
  • probably already resolved?
Aug 10 08:30:55 host live-hardener[767]: mount: /boot/efi: wrong fs type, bad option, bad superblock on overlay, missing codepage or helper program, or other error.
  • Patrick: Was already fixed

emergency-shutdown - bug - breaks Calamares installer

[edit]

emerg-shutdown - delayed shutdown

[edit]
  • emerg-shutdown may be triggered by accident, users should have an opportunity to cancel unless the root device has vanished entirely
  • for delayed shutdowns, show a warning of some sort and provide clear instructions on how to cancel the shutdown
    • switch to a TTY and display a red screen with warning text on it?
      • may conflict with agetty, investigate how to suppress it (or switch to a TTY that isn't in use and that agetty isn't configured to spawn on)
  • some users may need instant shutdown without warning, allow configuring the shutdown timeout, including making it 0

emerg-shutdown - versus ram-wipe

[edit]
  • an init (systemd) wrapper?
  • root disk must be unmounted so kernel deletes Full Disk Encryption (FDE) key from RAM

emerg-shutdown - bugs

[edit]
  • Qubes:
    • Should probably not run in Qubes at all? Disable using systemd unit file conditional?
Aug 10 06:10:23 host emerg-shutdown[635]: Failed to find any input device supporting panic keys!
Aug 10 06:10:23 host systemd[1]: emerg-shutdown.service: Main process exited, code=exited, status=1/FAILURE
Aug 10 06:10:23 host systemd[1]: emerg-shutdown.service: Failed with result 'exit-code'.
Aug 10 06:10:35 host memlockd[677]: Mapped file /lib/x86_64-linux-gnu/libgpg-error.so.0
  • Non-Qubes:
    • So far only observed in non-Qubes.
Aug 11 08:27:57 localhost memlockd[1006]: Error mmaping /etc/resolv.conf: Invalid argument

emergency-shutdown - debugging improvements

[edit]
  • add more debug output:
    • every relevant code path should be written to journal
    • trigger needs to be recorded
    • action needs to be recorded
    • purpose: in case of bugs (such as above), it should be able to debug this at least with a (virtual) serial console

chvt hardening

[edit]

Qubes OS IPv6 DNS

[edit]

Qubes in-vm kernel boot mode support

[edit]

Qubes in-vm kernel support in general

[edit]

timesync developer wiki page improvements

[edit]

sdwdate refactoring and improvements

[edit]
  • study sdwdate source code
  • lightweight refactoring (such as no longer using classes because these are used inconsistently)
  • separate into sdwdate-daemon and sdwdate-time-fetcher?
    • Aaron: sdwdate-daemon is a very interesting idea, most likely useful for the ClockVM idea, however it is only feasible in situations where one either has multiple networked physical machines or multiple connected virtual machines (i.e. VBox with one Whonix-Gateway and many Whonix-Workstations, or Qubes OS). This is because the daemon has to be able to change the system's time as it sees fit in order to get Tor working (i.e. first get consensus to work by using certificate lifetime if possible, then get circuits to work using consensus, then get real time from three separate servers which are now accessible since circuits work). There is no way to isolate CLOCK_REALTIME changes from the rest of the system, Linux has time namespaces but they don't virtualize CLOCK_REALTIME. Thus sdwdate-daemon would have to be able to modify the system time freely in its mission to find the right time.
    • In theory, this could be avoided if time changes could be communicated to the Tor daemon without modifying the system's wall clock. I do not know if this is possible, I suspect it isn't. Even though it is technically feasible, it would potentially be immensely complicated to implement.
    • Perhaps implement sdwdate-daemon as a process that only returns whatever the next time step is, and also indicate whether there are further steps? Then sdwdate-time-fetcher could either ignore the date if the daemon indicates more steps are still to come, or accept it. The ClockVM itself would unconditionally accept sdwdate-daemon's reported time values in order to assist it in finding the correct time, then client VMs would only update their clock once the "final step" was reached.
  • sdwdate oneshot feature (pick the median time from the 3 pools, output to console, then exit) if considered useful for the next bullet point
  • add support for sdwdate to be used as a Qubes-Whonix-Gateway as ClockVMarchive.org iconarchive.today icon
  • note: sdwdate can already fix the clock if it is very slow (with the help of Tor consensus and anondate)
    • Aaron: If the clock is very very slow, this seems to not work. Might be possible to use Tor certificates to get within a year of the correct date, then attempt to brute-force a month that will allow Tor consensus to work. As long as the Tor network itself will not work if the clock is too far off, we don't have to worry too much about replay attacks, untrusted data, etc. - the worst an attacker could do is denial of service, we'll only get working connectivity if we get very close to the correct time (or an adversary controls so many of the servers we're using it can trick us into thinking our time is correct, which is statistically unlikely...? is it actually statistically unlikely?)
  • add feature to sdwdate to allow it fixing the clock if it is very fast too
    • it may not be possible to implement such a feature securely (setting the clock forward has no security risk but setting the clock backwards makes already expired keys valid again). perhaps should just be a manual action? in theory, by setting the clock backwards very far into the past, sdwdate should be able to fix it. Perhaps we could try once to set the clock backwards just a few hours (not years) based on Tor consensus / anondate? Or perhaps this should only be possible by manual user action?
  • use chrony - time setting only - not time fetching - as a replacement for sclockadj as per Dev/sdwdate
    • or if easier, saner, port sclockadj from clock_settime to adjtimex?
    • Aaron: Probably easier to port sclockadj, chrony looks a bit dangerous to me.
    • please research, consider various options

kicksecure - update torification improvements

[edit]
  • only shipped-by-default apt repositories go through Tor
  • ideally, newly added apt repositories should go through Tor as well, as should flatpak installation and updates
    • Flatpaks can be made to go through Tor by enabling an HTTPTunnelPort in Tor, then setting http_proxy and https_proxy to http://localhost:9080archive.org iconarchive.today icon (assuming your port number is 9080) when running Flatpak. There doesn't appear to be a way to set a proxy in Flatpak's configuration, thus this would probably require a wrapper.

flatpak update integration

[edit]

stream isolation socks user name new spec implementation

[edit]

investigate Debian Rolling

[edit]
  • investigate why Debian Rolling initiative failed
    • From initial research:
      • Lots of disagreement about how exactly to implement it, although https://lists.debian.org/debian-devel/2011/05/msg00275.htmlarchive.org iconarchive.today icon had a very large amount of positive feedback compared to other proposals
      • Limited manpower, no one appears to have tried to actually do it
      • Need to cope with the activity occurring in Debian's unstable and testing repositories, which have some turbulence and can cause issues if one isn't careful
      • Likely worth trying to resurrect
  • contact people involved previously, if that makes sense
  • suggest prospective developers
  • Started to write tooling for this: https://github.com/ArrayBolt3/drkarchive.org iconarchive.today icon Very incomplete, nowhere near usable. Will keep developing this.

repository-dist-wizard - improvements

[edit]
  • Kicksecure GitHub repository-dist repositoryGitHub Logo
  • GUI: detect stable, stable-proposed-updates, testers, developers setting in GUI. I.e. if re-running the tool, keep the former setting. Should this depend on previous choice in the GUI (status files, probably easier) or actual status on the disk (might be manually modified by the user)
  • add support for switching back and forth between clearnet and onion

Tool to onionize all APT sources

[edit]

verified boot implementation

[edit]
  • assume firmware can extend trust to kernel via Sovereign Boot
  • create a system for extending trust from kernel to initramfs and userland
  • possibly investigate immutable images?
  • Implementation idea notes:
    • A system running with Verified Boot enabled must have the root partition in live mode (read only with tmpfs overlay). Therefore something similar to live mode will be needed when running in "verified mode"
    • dm-verify is what Google uses, there seems to be no compelling reason for us to avoid it.
    • Kernel modifications are not permitted, Kicksecure will be signing Debian's shim meaning only vanilla Debian kernels will be bootable. Rely on alternative ways of storing the dm-verify root hash in a secure immutable fashion, such as:
      • TPM / Measured Boot? Highly desirable if security issues don't result, as this avoids the need for user interaction unless something goes wrong.
        • Would require some way of authenticating that the TPM has not been reset (similar to Heads TOTP/HOTP codes)
      • User providing the hash on an external drive?
      • Verification passphrase similar to LUKS passphrase?
    • Patrick: TPM is unavailable inside VMs? In this case, verified boot support is still desirable.
  • Patrick
    • Whonix-Gateway: either no verified boot initially or install user-sysmaint-split by default
    • persistent mode, verified boot should still allow for logs persistent
    • When the verification is over?:
      • "verification is a continuous process happening as data is loaded into memory"
      • "This means if malware manages to modify the /usr/bin/mv program despite immutability, then dm-verity would notice this the next time the user or system is attempting to execute that command."
      • This security gained from this feature is somewhat reduced if the attacker can use ephermal overlays.
    • consider enable sudo access in USER session (developer debug mode): disable verified boot + write to disk + regenerate verified boot hash tree (this is to ease debugging issues only happening in user session but not in sysmaint session)
  • prefer Debian on true read-only filesystem without ephemeral overlay to benefit from kernel verified continuous verification after boot feature

calamares - add module to select or unselect firmware-nonfreedom

[edit]
  • default selection: none - require explicit user choice. If possible, otherwise default to "yes, install firmware-nonfreedom".

permission-hardener - live bug

[edit]
  • got a bug report by e-mail
sudo apt install network-manager-openvpn-gnome

security-misc (3:44.4-1)  ...
INFO: triggered security-misc: 'security-misc' security-misc DPKG_MAINTSCRIPT_
NAME: 'postinst' $\*: 'triggered /usr' 2: '/usr'
/usr/libexec/security-misc/mmap-rnd-bits: INFO: Successfully written ASLR map
config file:
/etc/sysctl.d/30_security-misc_aslr-mmap.conf
Running SUID Disabler and Permission Hardener... See also:
https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener
/var/lib/dpkg/info/security-misc.postinst: INFO: running: permission-hardener
enable
permission-hardener: [NOTICE]: Executing: dpkg-statoverride --add --update root shadow 744 /usr/lib/live/mount/rootfs/filesystem/usr/sbin/unix_chkpwd
dpkg-statoverride: : `/usr/lib/live/mount/rootfs/filesystem/usr/sbin/unix_chkpwd'
permission-hardener: [ERROR]: Command 'dpkg-statoverride --add --update root shadow 744 /usr/lib/live/mount/rootfs/filesystem/usr/sbin/unix_chkpwd' failed with exit code '2'! calling functio
n name: 'commit_policy'
permission-hardener: [NOTICE]: Executing: dpkg-statoverride --admindir /var/lib/permission-hardener-v2/new_mode --add root shadow 744 /usr/lib/live/mount/rootfs/filesystem/usr/sbin/unix_chkp
wd
permission-hardener: [NOTICE]: Executing: dpkg-statoverride --add --update root root 744 /usr/lib/live/mount/rootfs/filesystem/usr/bin/pkexec
dpkg-statoverride: : `/usr/lib/live/mount/rootfs/filesystem/usr/bin/pkexec'
permission-hardener: [ERROR]: Command 'dpkg-statoverride --add --update root root 744 /usr/lib/live/mount/rootfs/filesystem/usr/bin/pkexec' failed with exit code '2'! calling function name:
'commit_policy'
permission-hardener: [NOTICE]: Executing: dpkg-statoverride --admindir /var/lib/permission-hardener-v2/new_mode --add root root 744 /usr/lib/live/mount/rootfs/filesystem/usr/bin/pkexec
permission-hardener: [NOTICE]: Executing: dpkg-statoverride --add --update root root 744 /usr/lib/live/mount/rootfs/filesystem/usr/bin/sudo
dpkg-statoverride: : `/usr/lib/live/mount/rootfs/filesystem/usr/bin/sudo'
permission-hardener: [ERROR]: Command 'dpkg-statoverride --add --update root root 744 /usr/lib/live/mount/rootfs/filesystem/usr/bin/sudo' failed with exit code '2'! calling function name: 'c
ommit_policy'
permission-hardener: [NOTICE]: Executing: dpkg-statoverride --admindir /var/lib/permission-hardener-v2/new_mode --add root root 744 /usr/lib/live/mount/rootfs/filesystem/usr/bin/sudo
permission-hardener: [NOTICE]: Executing: dpkg-statoverride --add --update root shadow 744 /usr/lib/live/mount/medium/usr/sbin/unix_chkpwd
dpkg-statoverride: : `/usr/lib/live/mount/medium/usr/sbin/unix_chkpwd'
permission-hardener: [ERROR]: Command 'dpkg-statoverride --add --update root shadow 744 /usr/lib/live/mount/medium/usr/sbin/unix_chkpwd' failed with exit code '2'! calling function name: 'co
mmit_policy'
permission-hardener: [NOTICE]: Executing: dpkg-statoverride --admindir /var/lib/permission-hardener-v2/new_mode --add root shadow 744 /usr/lib/live/mount/medium/usr/sbin/unix_chkpwd
permission-hardener: [NOTICE]: Executing: dpkg-statoverride --add --update root root 744 /usr/lib/live/mount/medium/usr/bin/pkexec
dpkg-statoverride: : `/usr/lib/live/mount/medium/usr/bin/pkexec'
permission-hardener: [ERROR]: Command 'dpkg-statoverride --add --update root root 744 /usr/lib/live/mount/medium/usr/bin/pkexec' failed with exit code '2'! calling function name: 'commit_pol
icy'
permission-hardener: [NOTICE]: Executing: dpkg-statoverride --admindir /var/lib/permission-hardener-v2/new_mode --add root root 744 /usr/lib/live/mount/medium/usr/bin/pkexec
permission-hardener: [NOTICE]: Executing: dpkg-statoverride --add --update root root 744 /usr/lib/live/mount/medium/usr/bin/sudo
dpkg-statoverride: : `/usr/lib/live/mount/medium/usr/bin/sudo'
permission-hardener: [ERROR]: Command 'dpkg-statoverride --add --update root root 744 /usr/lib/live/mount/medium/usr/bin/sudo' failed with exit code '2'! calling function name: 'commit_polic
y'
permission-hardener: [NOTICE]: Executing: dpkg-statoverride --admindir /var/lib/permission-hardener-v2/new_mode --add root root 744 /usr/lib/live/mount/medium/usr/bin/sudo
permission-hardener: [NOTICE]: To compare the current and previous permission modes, install 'meld' (or preferred diff tool) for comparison of file mode changes:
sudo apt install --no-install-recommends meld
meld /var/lib/permission-hardener-v2/existing_mode/statoverride /var/lib/permission-hardener-v2/new_mode/statoverride
permission-hardener: [ERROR]: Exiting with non-zero exit code: '203'
/var/lib/dpkg/info/security-misc.postinst: ERROR: Permission hardening failed.
  • random guess: Could there be issues with non-latin language settings?
  • Why is it /usr/lib/live/mount/rootfs/filesystem?
  • Could it be that the user booted into live mode?
  • Maybe a case of low RAM where no further writes to RAM were possible?
  • Booting into live mode and using APT should be supported as much as feasible.
  • In case of insufficient information, could you please add debug code to provide more information in the future?
  • Unsure if further information can be requested form the reporter, but I could try.
  • Useful to add:
test -w "${file_name_from_stat}"
  • permission hardener might not be the cause of this issue. However, ideally it would show a better error message pointing out the issue.
  • Aaron: Cannot reproduce on ISO or in LIVE mode USER.
    • The /usr/lib/live/mount path suggests that the issue is the result of attempting to distribution-morph a vanilla Debian Live session. This, IMO, is not something we should support, because:
      • All changes will be lost on reboot, meaning someone who uses this in production will be downloading a lot of Kicksecure packages from our infra every time they start the system.
      • We already offer a live Kicksecure ISO.
      • None of the kernel hardening options will be enabled, and they can't be enabled, because that would require a reboot which will discard everything.
      • And of course, permission-hardener doesn't expect anything under /usr to be read-only.
    • Would suggest adding a warning to the distribution morphing documentation that a live Debian ISO session can't be morphed, and that one should download a live Kicksecure ISO if they need a Kicksecure-enhanced live system.
  • Patrick: Done. Documented.
  • Could you please add better error handling in this case?

audio

[edit]

audio generally

[edit]

VirtualBox Intel HD Audio and PipeWire Incompatibility / Audio broken after increasing ram to 5 GB / No sound after latest updates - PipeWire Bug?

[edit]

live-build - test lb config --dm-verity

[edit]
  • Does the ISO still function if build with lb config --dm-verity?
  • Does it break apt-get install pkg-name? It might not break it due to overlayfs.
  • Lacks live-build support when used with dracut:
    • lb config won't even run if you try to enable verity and dracut at the same time, unless you override live-build by commenting that sanity check out
    • The ISO won't build initially because the dm-verity building code is trying to find the live filesystem in the wrong location
    • dracut isn't configured to include systemd-veritysetup-generator, needed for verifying the root FS in the first place
    • No kernel command line options are added to the ISO for verity setup

Kicksecure Firewall

[edit]

https://forums.kicksecure.com/t/kicksecure-firewall/378/10archive.org iconarchive.today icon

Meta Packages, Kicksecure, Whonix - Desktop versus Server

[edit]

https://forums.kicksecure.com/t/meta-packages-kicksecure-desktop-versus-kicksecure-server/415archive.org iconarchive.today icon

wipe video RAM

[edit]
# zero video RAM to prevent leakage
# see (CC BY-SA 4.0): https://www.adlerweb.info/blog/2012/06/20/nvidia-x-org-video-ram-information-leak
export R600_DEBUG=zerovram;
export AMD_DEBUG=zerovram;
export RADV_DEBUG=zerovram;
  • if doable with reasonable effort

Tor 0.4.8.9 broken in combination with vanguards

[edit]

VirtualBox serial console

[edit]
Nov 24 10:13:35 localhost agetty[1346]: -: failed to get terminal attributes: Input/output error
[edit]

KVM - 3D Graphics Acceleration - SPICE - Testing - drm

[edit]

KVM - 3D Graphics Acceleration - Performance Test - Display SDL

[edit]

KVM - 3D Graphics Acceleration - Performance Test - Display GDK

[edit]

KVM - verify AppArmor sVirt confinement operation

[edit]

KVM - use rootless

[edit]

KVM - port to unix domain socket based internal networking for Whonix-Gateway to Whonix-Workstation connections

[edit]

KVM - IPv6 router advertisement issues

[edit]
  • when <dns enable=no/> is set in Whonix-external-network.xml, Whonix-Gateway cannot get an Internet-facing IPv6 address
  • router solicitation messages are being sent according to tcpdump but router advertisement messages are not being received in response
  • removing <dns enable=no/> from both the external and internal network configuration resolves the issue
  • removing <dns enable=no/> from only the external network configuration resolves the issue if and only if Whonix-Gateway is allowed to fully boot before Whonix-Workstation is started
  • above issues are present with Ubuntu 24.04's libvirt
  • test a newer libvirt version (using Arch Linux?)
  • file bug report if necessary

machine-id research

[edit]
  • in preparation for the next task
  • please read prior discussions
  • https://www.whonix.org/wiki/Protocol-Leak-Protection_and_Fingerprinting-Protection#Identifiers_Design_Goalsarchive.org iconarchive.today icon
  • https://forums.whonix.org/t/revisit-handling-of-var-lib-dbus-machine-id/18827archive.org iconarchive.today icon
  • https://forums.whonix.org/t/anonymize-etc-machine-id/7721archive.org iconarchive.today icon
  • https://gitlab.tails.boum.org/tails/tails/-/issues/7100archive.org iconarchive.today icon
  • nowadays implemented in dist-base-files
    • ./packages/kicksecure/dist-base-files/var/lib/dbus/machine-id
    • ./packages/kicksecure/dist-base-files/etc/machine-id
  • but maybe needs to be moved back to anon-base-files when porting to Debian trixie? (hard to migrate within the same release codename)
  • The machine-id files should not be shipped by a package. They are intended to be generated, not hardcoded, thus Debian's code is probably not going to cope well when a package ships these files. Case in point, live-build deleting them to avoid machines with duplicate IDs in the wild, when we want machines with duplicate IDs in the wild.
  • Calamares is designed to write the machine-id files at instalation time. It has a dedicated module for this purpose. However, it does not permit specifying a hardcoded machine-id other than a literal "uninitialized" value or an empty file. So we will have to resort to using a shellprocess for Whonix-Host that will detect when Whonix is in use, and overwrite the machine-id files with a static machine-id. Calamares is the proper location to do this at IMO, since it's designed for this, systemd's docs suggest using the installer for this, and I fear we could run into problems trying to do this on first boot with a systemd unit.
    • Patrick: Please implement.
    • Patrick: Note, Whonix VMs are built using grml-debootstrap. While using a package to handle these files might be the wrong way. Whonix VMs still need these.

Polkit - run only in sysmaint session

[edit]
  • Polkit
  • todo: discuss
  • find solutions on how to have functional shutdown/restart/etc. buttons

speed up build system

[edit]
  • get --force-unsafe-io working again or at least partially working, it's broken with mmdebstrap but maybe we can use it in some areas at least
  • parallelize package builds if possible
  • if we could figure out a hack to use native (de)compression routines rather than emulated ones that would probably help immensely

per-app UID sandboxing

[edit]
  • todo: discuss
  • related to the following tasks
  • nested wayland?

stackable wrappers

[edit]

check out bubblejail

[edit]

sandbox-app-launcher

[edit]
  • sandbox-app-launcher
  • review
  • promising? worth bringing back to life, polishing?
  • at odds with apparmor.d?
  • better using bubblejail?

automated test suite - cli version

[edit]
  • todo: discuss

apparmor.d review

[edit]

improved server support

[edit]
  • documentation
    • rebrand wiki CLI for server
  • Linux account passwords?
  • cloudinit?
  • vm-config-dist versus autologin CLI vs GUI vs server

hidepid

[edit]

research shred

[edit]
  • research if shred is still useful nowadays
  • if not, should be replaced by safe-rm

WAITING ON

[edit]

Qubes - sdwdate-gui - needed tags for qrexec aren't set on Whonix standalone

[edit]

trixie-port - Qubes - salt - template-whonix-workstation-18

[edit]

security-misc - review pull requests

[edit]

trixie-port - Qubes journal log messages

[edit]
  • Qubes. Should be fixed but is not fixed. Happening after boot.
Oct 27 13:40:36 host qrexec-agent[12402]: 2025-10-27 13:40:36.085 qrexec-agent[12402]: exec.c:902:find_qrexec_service: Warning: ignoring skip-service-descriptor=true for execute executable service /etc/qubes-rpc/qubes.UpdatesProxy
  • Qubes. Happening after boot.
Oct 27 13:50:13 host systemctl[14620]: Failed to connect to user scope bus via local transport: $DBUS_SESSION_BUS_ADDRESS and $XDG_RUNTIME_DIR not defined (consider using --machine=@.host --user to connect to bus of other user)
  • Qubes. Happening when using sdwdate-gui log viewer from systray to open a terminal emulator.
host xdg-desktop-por[1655]: Failed to load RealtimeKit property: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.RealtimeKit1 was not provided by any .service files
  • Same as above.
xdg-desktop-por[1655]: Failed connect to PipeWire: Couldn't create PipeWire context

trixie-port - screen briefly unlocked after wake from suspend

[edit]
  • LXQt unfortunately puts the system into suspend before locking the screen. However, this does not occur on Arch Linux. Debug and determine whether Debian needs a patch or our configuration needs to change.

calamares - keyboard layout setting broken in Wayland

[edit]
  • todo
  • please set up for
    • CLI user
    • CLI sysmaint
    • GUI user
    • GUI sysmaint
  • Aaron: Moving the systemd-localed keyboard layout set disable file out of the way does not result in labwc picking up the keyboard layout settings from Calamares. Will need to create a shellprocess module or similar to hack this into working right.
  • Aaron: Implemented, changes pushed to helper-scripts, user-sysmaint-split, lxqt-wayland-session, and live-config-dist. All four scenarios now work as expected.
    • Patrick: Merged.
  • Patrick: Is this reported upstream, so one day Debian, calamares will be fixed and can be used without XWayland?

Qubes R4.3 bypass review

[edit]

Qubes misc review

[edit]
  • https://github.com/QubesOS/qubes-core-agent-linux/pull/613archive.org iconarchive.today icon
  • https://github.com/QubesOS/qubes-core-admin-addon-whonix/pull/25archive.org iconarchive.today icon
    • The code on this one is mostly good but has one major flaw; any time a DispVM or NetVM somehow ends up set to None, the code is designed to always honor that and never change it away from None, as a security feature. This seems good on the surface, but there are way too many instances where the code winds up with a default DispVM of None, which ends up causing somewhat broken behavior:
      • Templates are created before whonix-workstation-18-dvm, and so both Whonix-Gateway and Whonix-Workstation templates end up with a default DispVM of None even though they're supposed to be able to have a default DispVM of whonix-workstation-18-dvm.
      • StandaloneVMs created by cloning a template end up with a default DispVM of None because their parent template had a default DispVM of None as well.
      • I'm pretty sure cloned templates will have the same problem.
    • Two ideas come to mind:
      • Maybe we just live with this? It's better than the wrong default DispVM being set at least.
      • Maybe we don't honor the default DispVM being set to None, and force it back to an appropriate value if possible? If a user really wants to disallow the use of DispVMs in a particular qube, they can use qrexec policy.
    • What would really be nice is if there was two different kinds of "None" in Qubes, one for "the user explicitly set this to None" and one for "the OS set this to None because there was no better option at the time". But unfortunately we don't have that.
    • Tested, awaiting merge.

Qubes R4.2 default_dispvm bypass

[edit]

kloak - handle dynamic keyboard layout changes

[edit]
  • when the user changes the keyboard layout in labwc, kloak's keyboard layout configuration does not change to match
  • Aaron: Discovered this is a bug in labwc, reported: https://github.com/labwc/labwc/issues/3113archive.org iconarchive.today icon
    • Waiting on upstream's response. For now, we should document that one must restart kloak with Right Shift + Escape to make a keyboard layout change take effect.

apt solver bug - pulling in incorrect alternative dependencies

[edit]

trixie port - update derivative signing key derivative.asc

[edit]
  • plan how to use a new signing key
    • Aaron: Where all do we use the signing key? It's used to sign:
      • apt packages
      • git commits
      • git tags
      • OS images
      • Warrant canaries?
        • These are signed by OpenBSD's signify tool, not GPG, thus their key migration does not necessarily have to be bound to derivative.gpg's rotation.
      • anything else?
    • apt package migration:
      • Due to how apt packages work, it is probably best to do this during release upgrade. Ship a new version of the key in legacy-dist in Bookworm only, install it during the release upgrade procedure and ensure all packages that are ever a part of the trixie repositories are signed with the new key.
    • git commit/tag migration:
      • The key expires, so there isn't a risk of it being used to sign newer packages after expiration. Just start signing commits with the new key and let expiration handle everything else.
      • Add the new key to the list of trusted keys in derivative-maker so that people can still build older tags/commits if they need to.
    • OS image migration:
      • Just start using the new key to sign OS images. Announce the key change publicly (i.e. on the forums) so users expect to need to update their key. Sign the new key with the old key so that users with high security requirements can transition from one key to the next without having to re-establish trust in the key.
    • Canary migration, if needed:
      • Can we just start signing canaries with the new key? Or do we need to put the canaries in a different location and stop updating the old ones?
  • Patrick:
    • The plan might be good enough.
    • I might just extend the validity of the signing key and postpone this plan.
  • Patrick:
    • Key has been extended.
  • Aaron:
    • Moved to WAITING ON for now, we should move this back to TODO once we're ready to do the actual key rotation.

investigate Tor Browser metadata signing and expiration

[edit]

Rollback Attacks Definition:

The Update Framework (TUF) defines `rollback attacks` [x]

> An attacker presents files to a software update system that are older than those the client has already seen. With no way to tell it is an obsolete version that may contain vulnerabilities, the user installs the software. Later on, the vulnerabilities can be exploited by attackers.

Rollback Attack Protection and Valid-Until Field

Rollback attacks attempt to trick the updater into applying an outdated (and potentially vulnerable) version of the software. One widely recommended mitigation against rollback attacks is using a "Valid-Until" field or equivalent freshness period in the signed metadata, after which a given update should no longer be accepted.

Firefox's internal updater does not publicly mention using a "Valid-Until" field (or explicit expiration on update metadata) to guarantee update freshness or safeguard against replay/rollback attacks in the same way as systems like The Update Framework (TUF) or Debian's APT

Non-solutions:

TLS might mitigate this attack but higher security than what TLS can offer should be provided in case TLS or server compromise.

Solution:

Server side: Sign, automatically periodically re-sign update metadata.

Client side: Accept only metadata signed up to a certain age.

Resources:

Mozilla has blogged about rollback attacks in the past. [x]

[x] https://theupdateframework.io/docs/security/archive.org iconarchive.today icon

[x] https://blog.mozilla.org/attack-and-defense/2020/10/12/guest-blog-post-rollback-attack/archive.org iconarchive.today icon

  • Aaron: Filed issue against Tor Browser: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44039archive.org iconarchive.today icon Also requested a Tor Project Gitlab account, which I now have.
    • I did not file a report against Mozilla Firefox, because their update mechanism involves automatically generated XML created by a backend server, whereas The Tor Project's update metadata seems to be static and not nearly as complicated.

grml-debootstrap bootloader installation failure in Docker

[edit]
  • https://github.com/grml/grml-debootstrap/issues/348#issuecomment-3017083278archive.org iconarchive.today icon
  • please use discretion on how worthwhile it is to spend time on this. as in, if you think it's doable without huge effort and you like docker, please implement. Otherwise, please only provide instructions for reproduction and leave it to upstream or tableseeker to fix.
    • Aaron: Ran into complications trying to fix this myself, handed off to tabletseeker for further investigation.

RPi GRUB - contribute to Debian

[edit]
add support for GRUB as bootloader for RPi

I've recently succeeded in converting an existing Debian Trixie RPi image to boot using GRUB on the RPi 4B and extensively documented how to do that. [1] I also posted about this on the debian-arm mailing list. [2]

Booting in this way has several substantial advantages over the current Raspberry Pi boot process:

* The kernel command line can be modified via /etc/default/grub and files under /etc/default/grub.d. Some software requires or benefits from such modifications and leverages this mechanism in GRUB to make non-invasive changes to the command line. With direct kernel boot, these changes are silently ignored, while with U-Boot + GRUB, they are correctly applied.
* In the event of a bad kernel update, users can easily boot into older kernels as they would on a typical desktop system.
* Recovering from a broken boot without a secondary system becomes much easier, as users can use the GRUB and U-Boot consoles to debug and manually boot the system.
* Multiboot installations on the Pi become possible.

Is this a feature for which you would welcome a merge request here, either as an option or even as the default?

Obviously, at this point, RPi GRUB support could only be added to Forky and later.

(I've also recently submitted a pull request to `grml-debootstrap` (a Debian bootable image builder tool) [3] [4] implementing "basic" RPi support.)

* [1] https://www.kicksecure.com/wiki/Dev/boot#Booting_Debian_Trixie_with_GRUB_+_u-boot_on_Raspberry_Pi_4
* [2] https://lists.debian.org/debian-arm/2025/04/msg00012.html
* [3] http://packages.debian.org/grml-debootstrap
* [4] https://github.com/grml/grml-debootstrap/pull/335

RPi grml-debootstrap

[edit]

grml-debootstrap - EFI partition size

[edit]

GRUB - Debian packages grub-pc and grub-efi co-install-ability

[edit]

ISO - GRUB - silence cosmetic errors in live ISO GRUB

[edit]
  • Earlier attempts to fix cosmetic errors in GRUB failed, since they introduced bugs into the live-build-provided boot screen.
  • Investigate how to fix this, potentially make an upstream feature request or patch if needed
  • Errors include loadfont issues, Secure Boot loading issues
  • Sent email to grub-devel mailing list to investigate this

ISO - memtest86+

[edit]
error: bad shim signature

test SysRq keys under LXQt Wayland

[edit]

ISO - changed files issues

[edit]

(annoted) 

+ debsums --silent
debsums: changed file /usr/sbin/sources-media (from calamares-settings-debian package) - issue for future verified boot
debsums: missing file /var/lib/dbus/machine-id (from dist-base-files package) - issue for Whonix-Host, non-ideal for Kicksecure but not a blocker

+ debsums --config --silent
debsums: changed file /etc/calamares/modules/unpackfs.conf (from calamares-settings-debian package) - issue for future verified boot
debsums: changed file /etc/cryptsetup-initramfs/conf-hook (from cryptsetup-initramfs package) - issue for future verified boot
debsums: changed file /etc/machine-id (from dist-base-files package) - issue for Whonix-Host, non-ideal for Kicksecure but not a blocker
  • All of these are modified by live-build itself:
    • /usr/sbin/sources-media is modified by live-build/share/hooks/normal/5050-dracut.hook.chroot so that it points to the proper location of the on-ISO apt repo when dracut is in use (the location is different when initramfs-tools is used). The need for this could potentially be removed by modifying the sources-media script to autodetect the correct location, though this requires upstream to be receptive to the idea.
    • /var/lib/dbus/machine-id is deleted by live-build/share/hooks/normal/8020-remove-dbus-machine-id.hook.chroot, which has a note in it as follows: "This removes dbus machine id that cache that makes each system unique." This seems important and I can't think of an obvious way to avoid needing to do this. My Kicksecure VMs appear to have machine IDs, but it's unclear how they're being generated originally, so it may be worth enabling the machineid module in our Calamares configuration to ensure that the machine ID is properly generated.
    • /etc/calamares/modules/unpackfs.conf is modified by live-build/share/hooks/normal/5050-dracut.hook.chroot so that it points to the proper location of the on-ISO squashfs containing the operating system. Again, the location is different when initramfs-tools is used. This is a "hardcoded" configuration file, there isn't a way to add autodetection logic here. It might be possible to make a pull request to Calamares that would allow it to skip squashfses that didn't exist?
    • /etc/cryptsetup-initramfs/conf-hook is modified by live-build/share/hooks/normal/1010-enable-cryptsetup.hook.chroot, where it is used to enable cryptsetup in initramfs-tools. Assuming this isn't legacy configuration, this seems important and I can't think of an obvious way to avoid needing to do this. Might be worth testing to see if this is still necessary though.
    • /etc/machine-id is deleted by live-build/share/hooks/normal/8020-remove-dbus-machine-id.hook.chroot. Has a very similar note to the other machine ID deletion hook. Same concerns apply.
      • Proposal for fixing this made.

ISO - Finish Module Action Follow-Up

[edit]

live-build - add mmdebstrap support

[edit]

live-build - use APT with error-on-any

[edit]
  • use option apt --error-on=any for all invocations of apt-get (update)
  • only needed for apt-get update, otherwise superfluous but non-issue
  • this is a security feature
  • this is to prevent inconsistent images that succeeded connecting to the "normal" repository but failed to connect to the security repository
  • can be implemented using already existing live-build option --apt-options OPTION|"OPTIONS"?
  • Requires a patch to live-build. Using --apt-options results in a build failure with E: Command line option --error-on=any is not understood in combination with the other options
  • Patch written, submitted upstream as https://salsa.debian.org/live-team/live-build/-/merge_requests/371archive.org iconarchive.today icon. New configuration option now used in my branch of live-build.

security-misc - investigate PAM

[edit]
  • there is /etc/pam.d/sudo-i for interactive and /etc/pam.d/sudo
  • pam has concepts of common-session-noninteractive vs common-session (non-interactive)
  • how could we on the PAM level notice if faillock is used interactively or non-interactively?
  • if non-interactive, skip faillock
  • if interactive, do not skip faillock
  • Bug reports:
  • Once we go sudoless, this will no longer be a concern except for VMs that aren't sudoless.

live-build - grub.cfg GRUB configuration - loopback.cfg

[edit]
  • add https://www.supergrubdisk.org/wiki/Loopback.cfgarchive.org iconarchive.today icon compatibility (as as Debian Live ISO)
  • Requires fixes in live-build and Dracut to make work:
    • live-build is specifying the wrong kernel parameter for loopback booting when using dracut - it's using findiso when it should be using iso-scan/filename. A fix for this has been integrated into my fork of live-build. MR to upstream here: https://salsa.debian.org/live-team/live-build/-/merge_requests/376archive.org iconarchive.today icon
    • dracut is failing to run udevadm trigger during its device scanning, so even when it finds the ISO and attaches it as a loopback device, it never finds it. Only appears to be a problem on Debian Bookworm, Trixie works just fine.
      • Task is on hold until we migrate to Trixie.
    • (Side note: At least on QEMU, loopback mounts in GRUB fail with out-of-memory errors if the system uses UEFI. With BIOS it works fine. Not quite sure why this happens, very well may be an issue with QEMU's implementation of UEFI hardware or my usage thereof.)

live-build - lb-binary should not run apt-get update

[edit]

live-build - policy-rc.d handling

[edit]

REVIEW PLEASE

[edit]

trixie-port - suspend bug

[edit]
  • user reported
  • Bug: suspend results in black screen with no recovery (unless hard reboot)
  • lock-screen reports it cannot lock the screen and system then frozen. Might not be related to lock-screen.
  • Aaron: Cannot reproduce on my main development machine. On a testing machine, an instant reboot was observed after waking from sleep, but installing debug-misc made the reboots stop. Checking dmesg after wake revealed a kernel warning occurring while waking a device from suspend during a filesystem write. Issue is therefore likely hardware-specific, and may be resolved by disabling panic-on-warn.

ARCHIVED

[edit]

trixie-port - ISO - static network configuration broken in user session

[edit]
  • in Qubes, but might be a general bug related to static network configuration
  • no network card seen in user session
  • Aaron: Cannot reproduce, details shared in chat.
  • Patrick: See two videos provided by user.
  • Aaron: Reproduced issue, discovered root cause ("All users may connect to this network" was disabled). Documented that one should not disable this setting with user-sysmaint-split installed, and documented how to fix the system after this happens.

privleapd restart bug

[edit]
  • hit this in Kicksecure for Qubes by changing privleapd configuration and restarting it a lot
sudo genmkfile install && sudo systemctl restart privleapd && systemcheck --verbose --function check_kernel_messages        
/usr/share/genmkfile/make-helper-one.bsh: INFO: install
/usr/libexec/systemcheck/systemcheck: WARNING: Cannot communicate with privleapd. File '/run/privleapd/comm/user' does not exist. Cannot use privleap.

You might be able to create a privleap socket by executing: sudo leapctl --create 'user'
  • privleapd and leaprun is still functional but shows this error
  • when running "leaprun log-checker-kernel" after this, no error shown
  • therefore could be a race condition, i.e. using leaprun too early after restarting privleapd?
  • when injecting a "sleep 1", i.e. "sudo genmkfile install && sudo systemctl restart privleapd && sleep 1 && systemcheck --verbose --function check_kernel_messages" there is no such issue
  • Aaron: Fixed, commit pushed to privleap.
  • Patrick: Merged.

kloak - Tor Browser scrolling issue

[edit]

ai review misc

[edit]

simplify whonix-firewall restarter

[edit]
  • as discussed
    • Aaron: Implemented, commit pushed to whonix-firewall.
  • Patrick: Merged.

trixie - screen unlock broken

[edit]

misc journal errors

[edit]
  • VirtualBox: probably unfixable? add to journal ignore on virtualbox?
    • Aaron: Likely unfixable on most affected desktop hardware unless the BIOS is updated. Microcode can't be applied within virtual machines, thus this is likely not able to be fixed in VirtualBox.
    • Hiding it only when running in a virtual machine seems like it would make sense. We should show this when running on bare metal though.
    • Implemented, commit pushed to systemcheck.
Speculative Return Stack Overflow: WARNING: See https://kernel.org/doc/html/latest/admin-guide/hw-vuln/srso.html for mitigation options.
  • the following might be hardware issues and nothing an be fixed in the code unless you notice something
Nov 24 10:13:50 host systemd[1641]: Starting updatecheck.service - System update checker (user service)...
Nov 24 10:13:50 host updatecheck-daemon[1910]: /usr/libexec/systemcheck/updatecheck-daemon: INFO: start.
Nov 24 10:13:50 host systemd[1641]: Started updatecheck.service - System update checker (user service).
Nov 24 10:13:50 host updatecheck-daemon[1910]: /usr/libexec/systemcheck/updatecheck-daemon: INFO: First start. Therefore waiting for 2 minutes for first updatecheck.
Nov 24 10:16:33 host updatecheck-daemon[1910]: /usr/libexec/systemcheck/updatecheck-daemon: INFO: loop start.
Nov 24 10:16:39 host updatecheck-daemon[8321]: /usr/bin/updatecheck: INFO: No updates available.
Nov 25 05:26:31 host systemd[1641]: updatecheck.service: Watchdog timeout (limit 7h)!
Nov 25 05:26:31 host systemd[1641]: updatecheck.service: Killing process 1910 (updatecheck-dae) with signal SIGABRT.
Nov 25 05:26:31 host systemd[1641]: updatecheck.service: Main process exited, code=dumped, status=6/ABRT
Nov 25 05:26:31 host systemd[1641]: updatecheck.service: Failed with result 'watchdog'.
Nov 25 05:26:31 host systemd[1641]: updatecheck.service: Scheduled restart job, restart counter is at 1.
Nov 25 05:26:31 host systemd[1641]: Starting updatecheck.service - System update checker (user service)...
Nov 25 05:26:31 host updatecheck-daemon[17124]: /usr/libexec/systemcheck/updatecheck-daemon: INFO: start.
Nov 25 05:26:31 host systemd[1641]: Started updatecheck.service - System update checker (user service).
Nov 25 05:26:31 host updatecheck-daemon[17124]: /usr/libexec/systemcheck/updatecheck-daemon: INFO: First start. Therefore waiting for 2 minutes for first updatecheck.
Nov 25 07:59:13 host updatecheck-daemon[17124]: /usr/libexec/systemcheck/updatecheck-daemon: INFO: loop start.
Nov 25 07:59:13 host updatecheck-daemon[17163]: /usr/bin/updatecheck: updatecheck: Software updates check failure: 'leaprun system-ready-check' failed.
Nov 25 07:59:13 host updatecheck-daemon[17163]:   Debugging information:
Nov 25 07:59:13 host updatecheck-daemon[17163]:   - system_ready_check_output: 'ERROR: Could not connect to privleapd!'
Nov 25 07:59:13 host updatecheck-daemon[17163]: To view log, run:
Nov 25 07:59:13 host updatecheck-daemon[17163]: journalctl --boot --user -u updatecheck.service
Nov 25 07:59:13 host updatecheck-daemon[17163]: Please run systemcheck.

Whonix-Workstation
VirtualBox
Windows host
no green turtle

Nov 24 10:14:51 host sdwdate[1567]: 2025-11-24 10:14:51 - sdwdate - INFO - Sleeping for 131 minutes, ok.
Nov 24 13:34:51 host systemd[1]: sdwdate.service: Watchdog timeout (limit 3h 20min)!
Nov 24 13:34:51 host systemd[1]: sdwdate.service: Killing process 1567 (sdwdate) with signal SIGABRT.
Nov 24 13:34:51 host systemd[1]: sdwdate.service: Main process exited, code=dumped, status=6/ABRT
Nov 24 13:34:51 host systemd[1]: sdwdate.service: Failed with result 'watchdog'.
Nov 24 13:34:51 host systemd[1]: sdwdate.service: Consumed 2.063s CPU time, 102.3M memory peak.
Nov 24 13:35:01 host systemd[1]: sdwdate.service: Scheduled restart job, restart counter is at 1.
Nov 24 13:35:01 host systemd[1]: Starting sdwdate.service - Secure Distributed Web Date...
Nov 24 13:35:02 host systemd[1]: Started sdwdate.service - Secure Distributed Web Date.
Nov 24 13:35:02 host sdwdate[15405]: 2025-11-24 13:35:02 - sdwdate - INFO - sdwdate (Secure Distributed Web Date) started. PID: 15405

sudo journalctl | grep stuck      
Nov 19 11:07:44 host kernel: watchdog: BUG: soft lockup - CPU#2 stuck for 2381s! [swapper/2:0]
Nov 19 22:28:10 host kernel: watchdog: BUG: soft lockup - CPU#2 stuck for 38019s! [swapper/2:0]
Nov 22 11:35:36 host kernel: watchdog: BUG: soft lockup - CPU#1 stuck for 47763s! [swapper/1:0]
Nov 22 11:46:12 host kernel: watchdog: BUG: soft lockup - CPU#1 stuck for 449s! [swapper/1:0]
Nov 24 07:50:14 host kernel: watchdog: BUG: soft lockup - CPU#0 stuck for 59412s! [swapper/0:0]
Nov 24 08:51:46 host kernel: watchdog: BUG: soft lockup - CPU#0 stuck for 3437s! [swapper/0:0]
Nov 24 10:01:18 host kernel: watchdog: BUG: soft lockup - CPU#0 stuck for 3496s! [swapper/0:0]
Nov 24 10:12:05 host kernel: watchdog: BUG: soft lockup - CPU#0 stuck for 526s! [swapper/0:0]
Nov 25 05:26:29 host kernel: watchdog: BUG: soft lockup - CPU#0 stuck for 46634s! [swapper/0:0]

Nov 24 13:55:19 host privleapd[1293]: send_action_results: INFO: Action 'sdwdate-sync-hwclock' requested by account 'sdwdate' completed
Nov 25 07:59:13 host systemd[1]: privleapd.service: Watchdog timeout (limit 10s)!
Nov 25 07:59:13 host systemd[1]: privleapd.service: Killing process 1293 (privleapd) with signal SIGABRT.
Nov 25 07:59:13 host systemd[1]: Starting privleapd.service - privleap - Limited Privilege Escalation Framework...
Nov 25 07:59:13 host systemd[1]: Started privleapd.service - privleap - Limited Privilege Escalation Framework.
Nov 25 07:59:14 host privleapd[17276]: handle_control_create_msg: INFO: Handled CREATE message for account 'user', socket created
  • Aaron: The above looks like either a slow RTC, or memory thrashing left for a very long time that eventually (partially?) resolved itself, or both. (Some of those soft lockups in a swapper kernel thread last for over half a day.)
    • My main Kicksecure development virtual machine has one watchdog timeout for sdwdate, but with no time jump immediately before it.Likely hardware-related or specific to this setup. All of the timeouts above have a time jump before them.
    • Likely hardware-related, the result of too little or improperly set up swap space, and/or sdwdate may be occasionally having very bad luck when syncing time from Tor. (The last possibility would not explain the swapper lockups, but might explain the time jumps. In combination with the lockups though, and given the pool mechanism we use, I don't expect this to be the case.)
  • Patrick: Merged.

set-system-keymap should run set-grub-keymap

[edit]
  • please implement, if sane
  • Aaron: Implemented, commit pushed to helper-scripts.
  • Patrick: Merged.

tor-ctrl - minor bugs

[edit]
  • end-of-options broken. not functional as documented in its man page.
tor-ctrl -- GETINFO version
  • please install tor-ctrl in Kicksecure by default
  • Aaron: Fixed bug, moved tor-ctrl's to a different metapackage. Commits pushed to tor-ctrl, developer-meta-files, kicksecure-meta-packages, and anon-meta-packages.
  • Patrick: Merged.

Qubes - sys-whonix - broken dom0 qvm-template

[edit]
      rpc_block_template="#!/bin/bash

printf '%s\n' '${rpc_config_file} qrexec action is prohibited in PERSISTENT Mode - SYSMAINT Session.'"
  • Aaron: Implemented, commit pushed to user-sysmaint-split.
  • Patrick: Merged.

tb-updater - auto detect version always

[edit]
  • issue currently: lots of build issues, especially on Qubes infrastructure
  • treat hardcoded tbb version number as a minimum version number. as a minimum version number sanity check.
  • even in --postinst mode, try auto detect version from remote. as long as higher than hardcoded version, that shall be acceptable.
  • The already implemented last seen version numbers shall also be kept in use as a sanity test.
  • Aaron: Implemented, commit pushed to tb-updater. Tested by installing Tor Browser on an existing VM both with up-to-date and outdated hardcoded version numbers, works. Also tested by rebuilding Whonix VMs for VirtualBox with an unchanged hardcoded version, works correctly there also.
  • Patrick: Merged.

trixie-port - black desktop background and sometimes missing task bar

[edit]
  • VirtualBox
  • 18.0.7.0
  • after a few reboots into user session/sysmaint session, Whonix-Gateway desktop background turns black - task bar still functional
  • after a few reboots into user session/sysmaint session, Whonix-Workstation desktop background turns black - task bar broken
  • non-issue: virtualbox screen resize, still working great
  • lxqt-panel can be manually started: yes, all good.
    • after reboot: lxqt-panel works normally again
  • Aaron: Cannot reproduce problem with lxqt-panel. Issue with pcmanfm-qt desktop turning black is known and happens when the first shutdown in user mode is done from the CLI with reboot or shutdown now, will debug and create a solution now.
    • Black screen issue fixed, commit pushed to desktop-config-dist.
  • Patrick: Merged.
  • bug: Black desktop background remains. Worth fixing? (The lock file nowadays removed does not exist on my system (anymore?).)
    • Aaron: Added a followup fix to desktop-config-dist.
  • Patrick: Merged.
  • Patrick: 18.0.7.0, VirtualBox, LXQt bug: black screen is back.
  • (The task bar is apparently being restored, because the task bar is overlapping the "Computer" desktop icon.)
  • Aaron: Cannot reproduce even after several reboots using the reboot command in a terminal in user mode. The taskbar overlapping the "Computer" desktop icon is expected when PCManFM-Qt settings are damaged though, so it does sound like this is the same bug as previously.
    • Was the system fully up-to-date when it broke? Was it already previously broken and just isn't managing to automatically fix itself after updates despite the heuristics we added?
  • Patrick: Correction. Version was 18.0.7.6. Wasn't previously broken since 18.0.7.6. Fails to automatically fix itself.
  • Patrick: Made some changes to start-lxqt-session.
  • Patrick: Provided debug information in chat.
  • Aaron: Reproduced issue with further information. Fix pushed to desktop-config-dist.
  • Patrick: Merged.

Qubes - user-sysmaint-split - kernel modes - Standalone VM bug

[edit]
  • QVMM shows user session boot option only for Standalone VM
  • bug: Standalone doesn't inherit boot options from Template
  • user might report bug at Qubes
  • Aaron: Could not reproduce bug by making a new standalone from a Whonix-Workstation 18 template.
  • Closed, and follow-up bug closed as user error. Archiving.

trixie port - sdwdate permission issues

[edit]
  • qubes-public, Marek:
ok, I have real systemcheck results now, there are a couple issues found in sys-whonix, but overall nothing major IMO: https://openqa.qubes-os.org/tests/156993/file/whonixcheck-whonixcheck-sys-whonix.log

sdwdate[2269]: PermissionError: [Errno 13] Permission denied: '/var/lib/sdwdate/time-replay-protection-utc-unixtime'
  • Aaron: Unable to reproduce. The file shown above is owned by sdwdate:sdwdate on my release-upgraded sys-whonix qube, AppArmor permits sdwdate to access it, and the error above does not show in the output of systemcheck --verbose --leak-tests.
  • Aaron: Reproduced in Whonix-Gateway 18 template downloaded from Qubes community template repo. Somehow the entire /var/lib/sdwdate directory is owned by debian-tor:UNKNOWN (uid 108, gid 120).

user-sysmaint-split versus Qubes Video Companion is broken on Whonix-Workstation

[edit]

kloak - update wiki and forums

[edit]

18.0.7.5-developers-only - ISO boot broken

[edit]
  • todo
  • Fixed.

trixie-port - systemcheck test for CPU stall

[edit]
  • assigned to Patrick

permission-hardener bug - pkexec restore issue

[edit]
  • anon-whonix in unrestricted admin mode
[ERROR] [systemcheck] Check 'pkexec /usr/libexec/systemcheck/pkexec-test' result: System misconfiguration detected. No need to panic. This is not a severe issue. However, other tests may be affected due to this.

The following command:
pkexec /usr/libexec/systemcheck/pkexec-test ; echo $?
did not produce an empty output with an exit code of zero, indicating an unexpected result.

exit_code: 127

privilege_escalation_tool_output:
pkexec must be setuid root

chmod-calc /usr/bin/pkexec
Permissions for: '/usr/bin/pkexec'
Type: Regular File
Owner: root
Group: root
Octal Permissions: 755
File Size: 30952 bytes
Link Count: 1
Hidden File: No
ACLs: none
Extended Attributes: none
Capabilities: None
Immutable (chattr +i): No

Symlink: No

Parent Folder Symlink: No

Category   Read   Write  Execute 
Owner      Yes    Yes    Yes     
Group      Yes    No     Yes     
Public     Yes    No     Yes     

Special Attributes:
SUID: Not Set
SGID: Not Set
Sticky Bit: Not Set
  • Aaron: pkexec doesn't actually have its SUID bit set until its postinst script runs. If security-misc, pkexec, and user-sysmaint-split are all installed in the same apt invocation, and security-misc gets configured first, it will see pkexec as having permissions 755 and will save that in the existing_mode database before changing its permissions to match user-sysmaint-split's policy. Then when permission-hardener protections are removed, permission-hardener applies those incorrect permissions to the file.
    • No good way to solve this using Debian packaging known, there isn't a way to enforce postinst script order of execution without using Pre-Depends, and a package does not seem to be able to trigger itself.
    • Resolved for new builds by saving a pre-populated existing_mode database when security-misc is installed. This handles many common executables, we can expand the database if needed later.
    • Commits pushed to security-misc.
  • Patrick: Merged.

Qubes performance - qubes-whonix systemd units

[edit]
  • maybe /usr/lib/systemd/system/qubes-whonix-sysinit.service can be abolished, if sensible. This might speed up the boot process a bit.
  • scan code base for:
    • /run/qubes-service/whonix-gateway
    • /run/qubes-service/whonix-workstation
  • for example
    • /usr/lib/systemd/system/qubes-whonix-remote-support.service
## Copyright (C) 2020 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

[Unit]
Description=Qubes-Whonix Remote Support
Documentation=https://github.com/Whonix/qubes-whonix
ConditionPathExists=|/run/qubes-service/whonix-gateway

[Service]
Type=forking
ExecStart=/usr/bin/qvm-connect-tcp 22:dom0:22
SuccessExitStatus=143

[Install]
WantedBy=multi-user.target

Could maybe be replaced by: 

## Copyright (C) 2020 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

[Unit]
Description=Qubes-Whonix Remote Support
Documentation=https://github.com/Whonix/qubes-whonix

## Not inside TemplateVM.
ConditionPathExists=!/run/qubes/this-is-templatevm
## Whonix-Gateway
ConditionPathExists=/usr/share/anon-gw-base-files/gateway
## And ( NetVM OR ProxyVM )
ConditionPathExists=|/run/qubes/this-is-netvm
ConditionPathExists=|/run/qubes/this-is-proxyvm

[Service]
Type=forking
ExecStart=/usr/bin/qvm-connect-tcp 22:dom0:22
SuccessExitStatus=143

[Install]
WantedBy=multi-user.target
  • Aaron: This did indeed look possible. Implemented throughout the codebase.

sdwdate-gui-qubes systemd unit stuck in state starting

[edit]
  • see chat
  • Aaron: Switched to using a notify service here, also fixed up the systemd-notify wrapper. Commits pushed to helper-scripts, msgcollector, systemcheck, and sdwdate-gui.

trixie-port - address systemcheck log warnings

[edit]
  • there are a number of journal messages in systemcheck output in Non-Qubes-Whonix
  • there might be others for Qubes-Whonix
  • Whonix-Gateway, non-Qubes:
Nov 21 15:34:16 host pipewire[1803]: mod.rt: RTKit error: org.freedesktop.DBus.Error.ServiceUnknown
  • Aaron: Added more lines to /etc/systemcheck.d/30_default.conf, commit pushed to systemcheck.
  • Patrick: Merged.

trixie-port - disable lxqt power manager systray icon by default for VM images

[edit]
  • todo
  • Aaron: Automatically done as part of disabling LXQt power management. See completed task below.

trixie-port - lxqt-powermanagement - power management still enabled in VBox

[edit]
  • Battery watcher and idleness watcher are still active
  • lxqt-powermanagement appears to forcibly write configuration in ~/.config/lxqt/lxqt-powermanagement.conf that enables power management regardless of the contents of $XDG_CONFIG_DIRS
  • Aaron asked in #lxqt:matrix.org if there's some way to work around this behavior (other than writing to the user's configuration under /home)
  • Aaron: Culprit found, runCheckLevel=1 needed to be set in desktop-config-dist's lxqt-powermanagement.conf. Added the setting, new installations should now obey system-wide power management settings. Existing installations that already have an autogenerated user-specific lxqt-powermanagement.conf will not have this, fixing things for those users may be hard since there is no way to distinguish intentional configuration from auto configuration for existing Kicksecure/Whonix 18 users.
    • Maybe we can detect if runCheckLevel is explicitly set in a user-specific lxqt-powermanagement.conf file and wipe the file if so? That would override settings for existing users, but wouldn't cause further problems after that.
  • Patrick: Merged.

trixie-port - sdwdate-gui - broken inside sys-net

[edit]
  • only during boot
systemctl list-units --failed                         
  UNIT                                  LOAD   ACTIVE SUB    DESCRIPTION                                                     >
● sdwdate-gui-qubes@0-1531-1000.service loaded failed failed sdwdate graphical user interface - Qubes socket proxy (PID 1531/>
  • this is probably because sys-net starts before sys-whonix
  • Aaron: Fixed (and fixed a bug I noticed while working on this), commits pushed to sdwdate-gui.

trixie-port - GRUB - boot menu style lost after installation of serial-console-enable result

[edit]
  • Kicksecure
  • VirtualBox
  • after installing serial-console-enable, system has been reset to standard GRUB boot menu
  • Patrick: This is to be expected. Nothing very bad happening. Caused by:
GRUB_TERMINAL="console serial gfxterm"

usbguard - test in Qubes

[edit]
  • Does usbguard and usbguard-notifier work for you in Qubes?
  • Aaron: Mostly; notifications were not working because qubes-notification-agent and listing USB devices using the usbguard CLI was not working because list permissions were not present. Fixed both with pushes to developer-meta-files, kicksecure-meta-packages, and security-misc.
  • Aaron: usbguard-notifier allows users to ad-hoc allow and deny USB devices when they are attached. Should we allow the qubes and sudo groups to have modify permissions in usbguard as well to allow this to work?
  • TODO: Please test.
    • Aaron: Tested, works.

trixie-port - Qubes - ISO - fails to boot - black screen

[edit]

sys-whonix - replace-ips - where to bind - Tor restarts at boot versus IPv6

[edit]
  • todo
  • sys-whonix: for eth1, use static IPv4 and IPv6 address, if sensible
  • make sure replace-ips is correct and makes Tor bind on eth1 (not on eth0)
  • implement Qubes static networking, if still in time for Qubes R4.3 and if sensible
  • Aaron: Discussed possible solutions in chat. Pushed commits to qubes-whonix and anon-gw-anonymizer-config that should implement this sufficiently well for Whonix 18.
  • Patrick: Merged.
  • Patrick: Made huge changes to replace-ips. Please review and test.
    • Aaron: Reviewed, made mostly minor changes (some more involved ones to the var_name function). Tested, seems to work right.

trixie-port - red XDG_RUNTIME_DIR unset warning during shutdown

[edit]
  • Non-Qubes-Whonix Whonix-Workstation
  • no adverse effects, but looks scary for users
  • Aaron: I've seen this before, but could not reproduce it on-demand for testing.
    • Pushed commits to desktop-config-dist and user-sysmaint-split in an attempt to resolve the issue and a related problem with scary logs being shown during shutdown. Unfortunately I ended up reproducing the issue by accident even after these changes were installed.
  • Patrick:
  • Patrick: Merged.

trixie-port - sdwdate-gui - flashing menu during time sync

[edit]
  • While a time sync is in progress, right-click on the sdwdate-gui icon. The menu will flash rapidly in bursts.
  • This is most likely caused by the sdwdate-gui-client rewrite, which is probably reacting overzealously to status file changes from sdwdate. Adjust the inotify mechanism to not notify quite so frequently.
    • Fixed, commit pushed to sdwdate-gui.
  • Patrick: Merged.

trixie-port sdwdate-gui - client busy-waits if sdwdate-gui.ConnectCheck fails

[edit]
  • expected behavior: endless repeated notifications about failed qrexec calls
  • actual behavior: failed qrexec call warnings stop after a bit, sdwdate-gui-client consumes 100% CPU
    • Fixed, commit pushed to sdwdate-gui.
  • Patrick: Merged.

trixie-port - Kicksecure ISO Installation - using btrfs - broken live mode

[edit]
  • VirtualBox
  • 18.0.7.0
  • ISO
  • btrfs
  • at boot time, an error related to subvolumes is shown
  • bug: read-only volume without read-write overlay
  • Aaron: Dracut bug, already fixed upstream but not fixed in Trixie. Bug report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1121043archive.org iconarchive.today icon
    • Pushed a commit to grub-live to revert back to the Debian-specific overlay-root module and rootovl kernel parameter.
  • Patrick: Merged.

trixie-port - privleap - ai review

[edit]
Nov 18 10:03:03 host privleapd[1648]: auth_signal_request: WARNING: Action run request: Could not find action 'sudo' requested by account 'user'
Nov 18 10:03:06 host privleapd[1648]: send_msg_safe: ERROR: Could not send 'UNAUTHORIZED'
Nov 18 10:03:06 host privleapd[1648]: BrokenPipeError: [Errno 32] Broken pipe
  • Aaron: Most likely caused by pressing Ctrl+C during the delay caused by attempting to run an action without authorization. Fixed by the new signal handling mechanism in leaprun used to fix check_action_terminate: ERROR: Could not get message from client run by account 'user'!.
  • Patrick: Merged.

trixie-port - broken passwordless sudo in unrestricted admin mode

[edit]

trixie-port - privleap - check_action_terminate: ERROR: Could not get message from client run by account user

[edit]
  • VirtualBox
  • 18.0.8.0
  • not upgraded
Nov 18 09:01:02 localhost privleapd[1143]: check_action_terminate: ERROR: Could not get message from client run by account 'user'!
Nov 18 09:01:02 localhost privleapd[1143]: Traceback (most recent call last):
Nov 18 09:01:02 localhost privleapd[1143]:   File "/usr/lib/python3/dist-packages/privleap/privleapd.py", line 517, in check_action_terminate
Nov 18 09:01:02 localhost privleapd[1143]:     comm_msg: PrivleapMsg = comm_session.get_msg()
Nov 18 09:01:02 localhost privleapd[1143]:                             ~~~~~~~~~~~~~~~~~~~~^^
Nov 18 09:01:02 localhost privleapd[1143]:   File "/usr/lib/python3/dist-packages/privleap/privleap.py", line 691, in get_msg
Nov 18 09:01:02 localhost privleapd[1143]:     recv_buf: bytes = self.__recv_msg_cautious()
Nov 18 09:01:02 localhost privleapd[1143]:                       ~~~~~~~~~~~~~~~~~~~~~~~~^^
Nov 18 09:01:02 localhost privleapd[1143]:   File "/usr/lib/python3/dist-packages/privleap/privleap.py", line 549, in __recv_msg_cautious
Nov 18 09:01:02 localhost privleapd[1143]:     raise ConnectionAbortedError("Connection unexpectedly closed")
Nov 18 09:01:02 localhost privleapd[1143]: ConnectionAbortedError: Connection unexpectedly closed
Nov 18 09:01:02 localhost privleapd[1143]: send_action_results: INFO: Action 'sdwdate-log-viewer' requested by account 'user' completed
  • not reproducible after upgrade
    • Aaron: Mitigated somewhat with a commit to leaprun, however this was most likely caused by the leaprun process receiving a signal mid-execution. There isn't much that can be reasonably done to prevent a session terminated prematurely at an arbitrary point from resulting in the server griping about it, other than hiding possibly useful debugging output. The commit fixes a likely common case though.
  • Patrick: Merged.

trixie-port - leapctl - could not connect to privleapd

[edit]
  • Tor could not bind. At second boot.
  • VirtualBox
  • 18.0.6.8
  • upgraded
  • see log provided
  • output by leapctl does not allow to nail this down easily at this point. Perhaps if difficult to debug, add additional debug output to leapctl so we can point out which exact leapctl call is causing this?
  • please add more debug output to leapctl calls in any case for the future.
    • Aaron: Sufficient information to debug the leapctl failure is present in the logs. The issue seems to have been triggered by privleapd dying due to a watchdog timeout. The exact reason is unclear, the VM seems to have locked up for 10 seconds or otherwise experienced a time jump possibly. Details shared in chat.

trixie-port - set-system-keymap improvements #2

[edit]
  • 1) bug: in sysmaint session sudo set-system-keymap de fails to reload labwc. reboot required to change keyboard layout. (confusion resolved: system vs user configuration)
  • 2) bug: set-system-keymap / set-console-keymap is broken in some situations:
    • inside dracut emergency shell
    • single user mode (kernel parameter single)
    • this is because localectl is unavailable. Patrick pushed some changes to ignore this.
  • 3) feature request: set-system-keymap should configure the system keymap in case of
    • single user mode (kernel parameter single) - possible by re-generating initrd running "sudo dracut -f" - tested - functional
    • dracut emergency shell - same as above.
    • run sudo dracut -f &>/dev/null to hide verbose dracut output and report only success or failure.
    • Patrick implemented this.
  • 4) feature request: set grub stage 2 keyboard layout
    • 1 or 2 separate grub boot menu entries
      • additional boot menu entry 1: specific user-chosen keymap only
        • use case: easier to use GRUB menu entry - no need to scroll through lots of language entries
      • additional boot menu entry 2: generate all keymaps (within reasonable limits?)
        • What would be a good time/trigger to generate the keymaps? Useful/avoidable to keep re-generating the keymaps over and over again? A new /etc/grub.d drop-in? Part of which script?
        • use case: usable on the ISO
        • use case: users can easily try kernel boot parameters to attempt to fix the boot process in case of hardware issues
      • boot menu entries should be at the very bottom
      • enabling verbose ("set -x") equivalent may be useful
    • boot with GRUB standard keyboard. Only if the user selects a custom GRUB keyboard layout change menu try loading a different keyboard driver and layout.
    • Aaron: USB keyboard support does not appear practical, as numerous GRUB issues occur when using nativedisk and insmod usb_keyboard:
      • GRUB randomly can't find hard drives sometimes
      • Stack overflows occur
      • Sometimes "alloc magic" errors appear
      • Fonts can become very messed up
      • Boot usually becomes impossible
    • Aaron: Implemented, commits pushed to helper-scripts, kicksecure-base-files, usability-misc, anon-gw-base-files, anon-ws-base-files, and derivative-maker.
  • 5) feature request: set-labwc-keymap: --persist should be the default?
  • 6) feature request: apply console layout change by running systemctl --no-block --no-pager restart keyboard setup
  • 7) set-console-keymap: allow running as non-root / support file ~/.keyboard
    • Discussed, researched, not possible to set console keymap without root permissions and setting the keymap system-wide.
  • 8) bug: Should write INFOs to stdout, not stderr? Or is there a reason to write everything to stderr? In such special cases, please document this by adding a script comment on how channels (stdout, stderr) are used.
  • 8) set-system-keymap in sysmaint mode bug: layout change requires reboot
  • Patrick: Merged.

trixie-port - Tor could not bind to IPv6 race condition

[edit]
  • Tor could not bind. At second boot.
  • VirtualBox
  • happened at first boot only
  • happened just once. difficult to reproduce.
  • see old log provided (was version 18.0.6.8)
  • Patrick: Fixed.

trixie-port - lengthen live-config-dist timeouts

[edit]

trixie-port - Kicksecure /etc/hostname bug

[edit]
  • todo
  • Aaron: Fixed, commit pushed to derivative-maker.
  • Patrick: Merged.

privleap - improve debug output

[edit]
  • "ERROR: You are unauthorized ..."
    • Who is "You"? :)
    • todo: please add who "you" is. This might simplify debugging when using nested privleap.
  • Aaron: Implemented, also did some test script refactoring. Commit pushed to privleap.
  • Patrick: Merged.

trixie-port - livecheck-lsblk.service broken in Qubes

[edit]
  • noticed only once in sys-whonix
Nov 11 03:56:11 host systemd[1]: Starting livecheck-lsblk.service - Obtains lsblk output for use by livecheck...
Nov 11 03:56:12 host livecheck-lsblk[654]: overwrite: ERROR: Error while writing file '/run/desktop-config-dist/livecheck-lsblk', and >
Nov 11 03:56:12 host systemd[1]: livecheck-lsblk.service: Main process exited, code=exited, status=1/FAILURE
Nov 11 03:56:12 host systemd[1]: livecheck-lsblk.service: Failed with result 'exit-code'.
Nov 11 03:56:12 host systemd[1]: Failed to start livecheck-lsblk.service - Obtains lsblk output for use by livecheck.

trixie-port - reconsider non-Qubes RAM settings

[edit]
  • rads RAM threeshold?
  • non-Qubes minimum RAM for CLI? 512 insufficient nowadays?
    • Aaron: Should be sufficient now that we have swapfile issues solved.

trixie-port - login broken in cli

[edit]
  • sysmaint session
  • 512 MB RAM
  • login as sysmaint succcess
  • message "You are using the sysmaint account. This account has sudoers capabilities." visible but then system frozen
  • only reproducible at first login, maybe not reproducible
  • Aaron: RAM issue, encrypted swapfiles as made by swap-file-creator work on Bookworm but are broken on Trixie.
    • unencrypted: works
    • encrypted by virtue of being on a LUKS-encrypted partition: works
    • file on an unencrypted filesystem which is then itself encrypted and device-mapper mounted, then used as a swapfile: broken, machine hangs as if memory is exhausted while gigabytes of swap remain
    • Reported bug to LKML: https://lore.kernel.org/lkml/20251111231835.1232ad8f@kf-m2g5/T/#uarchive.org iconarchive.today icon
    • Adjusted swap-file-creator to use unencrypted swapfiles, but only allow creating swapfiles on systems with LUKS FDE. Commits pushed to swap-file-creator.
  • Patrick: Merged.

qubes memory issues

[edit]

trixie-port - default desktop icons

[edit]
  • Network: Seems useless. Please remove.
    • Aaron: Removed, commits pushed to kicksecure-base-files, anon-gw-base-files, and anon-ws-base-files.
  • Patrick: Merged.

trixie-port - environment variable VISUAL missing

[edit]
  • usability-misc
/etc/profile.d/50_default_editor.sh /etc/zprofile.d/50_default_editor.zsh
/etc/profile.d/50_default_editor.sh /etc/X11/Xsession.d/50_default_editor
  • in non-Qubes, Wayland: env | grep VISUAL
  • also other environment variables set through profile.d/ zprofile.d, Xsession.d mechanism might be missing
  • Aaron: Issue was caused by a check for "$XDG_SESSION_TYPE" = "tty". Removed that conditional, now it works. (greetd appears to run the session start script in a TTY.)
    • Did not find any other missing variables in /etc/profile.d that were being missed except for safe-rm's addition of its own path to $PATH (this file is not symlinked to /etc/zprofile.d so this is likely expected).
    • Fixed 50_default_editor.sh, commit pushed to usability-misc.
  • Patrick: Merged.

trixie-port - vm-config-dist - install on ISO by default

[edit]
  • vm-config-dist has vbox-guest-installer and wlr-resize-watcher, which both can be/are highly useful inside virtualbox
  • Do you see anything that makes vm-config-dist incompatible with installed on the host operating system or inside Qubes?
  • investigate /etc/dracut.conf.d/30-vm-config-dist.conf and if it seems safe for rm_conffile removal
  • Please modify, if sane, to make it compatible with the host / Qubes. I.e. implement no-ops, if needed.
  • Install by default everywhere non-Qubes, Qubes and host, if sane.
  • Aaron: Next steps:
    • Need to change the `shared` bookmark so it is saved in a system-wide location and only created on VMs.
    • Keep wlr-resize-watcher from running on physical hardware
    • OK to comment out power management disabling and VBox guest additions installation in the postinst?
  • Aaron: Done, commits pushed to vm-config-dist.
  • Patrick: Ready to installed by default on the ISO? If yes, please add.
    • Aaron: Done, commits pushed to developer-meta-files and kicksecure-meta-packages.
  • Patrick: Merged.

trixie-port - failed to mount /tmp

[edit]
  • seen in persistent mode user, briefly, during shutdown
  • cosmetic issue only
  • avoidable?
  • Aaron: VBoxDRMClient bug. Report filed: https://github.com/VirtualBox/virtualbox/issues/375archive.org iconarchive.today icon
    • Possible security risks in /tmp remaining mounted during shutdown? Perhaps if shutdown hangs while /tmp is mounted, valuable data might be left in-memory that an attacker could access, but we have emerg-shutdown to deal with most situations where this would be a concern.
    • As a stop-gap, we could use a service in usability-misc to kill VBoxDRMClient during shutdown if we want to ensure /tmp is properly unmounted.
      • Patrick: Please implement in security-misc? Seems security related. As a stop-gap until ensure-shutdown gets default and (more) reliable.
        • Aaron: Done, commits pushed to security-misc and user-sysmaint-split.
  • Patrick: Merged.

comment on pdf reader and other packages suggestions

[edit]


trixie-port - sgdisk

[edit]
  • VirtualBox 7.24
  • Kicksecure LXQt 18.0.5.8
  • Can these warnings be fixed?
sudo sgdisk -v /dev/sda

Caution: Partition 3 doesn't end on a 2048-sector boundary. This may
result in problems with some disk encryption tools.

No problems found. 2021 free sectors (1010.5 KiB) available in 2
segments, the largest of which is 2014 (1007.0 KiB) in size.

trixie port - hibernation

[edit]

login security check bug

[edit]
  • sys-whonix
INFO: user-sysmaint-split session detection result: SYSMAINT Session.
INFO: Whonix Login Security Check:
+----------+--------------------------------------+
| Users    | Password               GUI Autologin |
+----------+--------------------------------------+
| root     | Locked (Present)       Disabled      |
| user     | Absent                 Disabled      |
| sysmaint | Absent                 Enabled       |
+----------+--------------------------------------+
  • anon-whonix
[INFO] [systemcheck] user-sysmaint-split session detection result: USER Session.
INFO: Whonix Login Security Check:
+----------+--------------------------------------+
| Users    | Password               GUI Autologin |
+----------+--------------------------------------+
| root     | Restricted (Absent)    Disabled      |
| user     | Locked (Absent)        Enabled       | [Locked (Absent) - green color]
| sysmaint | Locked (Absent)        Enabled       | [Locked (Absent) - orange color]
+----------+--------------------------------------+
  • Kicksecure Qubes
[INFO] [systemcheck] user-sysmaint-split session detection result: USER Session.
[INFO] [systemcheck] Kicksecure Login Security Check:
+----------+--------------------------------------+
| Users    | Password               GUI Autologin |
+----------+--------------------------------------+
| root     | Restricted (Absent)    Disabled      |
| user     | Absent                 Enabled       |
| sysmaint | Locked (Absent)        Enabled       |
+----------+--------------------------------------+
  • bug: user | Locked (Absent) versus user | Absent?
  • bug: why do some Locked (Absent) entries get green color and others orange?
  • bug: why are some accounts locked while others are not?
  • new design
  • refuse screen lock because the password is locked
  • refuse logout because the password is locked
  • when booted in user mode:
    • prevent logging into accounts that are passwordless and members of group sudo, root, or sysmaint
    • prevent logging into account sysmaint
  • when booted in sysmaint session:
    • prevent logging into any accounts other than sysmaint
  • stop locking account sysmaint in user sessions since we now rely on a PAM module
  • remove special handling of account sysmaint in login security table of systemcheck
  • Aaron: Implemented, commits pushed to security-misc, user-sysmaint-split, and systemcheck.
  • Patrick: bug:
    • Kicksecure, 512 MB RAM, user session:
      • can no longer login. Account false-positive detected as sensitive passwordless account.
      • Perhaps because account user is a member of group sudo?
        • Aaron: Fixed, commit pushed to security-misc.
  • Patrick: Merged.

trixie-port - fix shutdown slowdown bug

[edit]
  • todo
  • slower since fixing unmount of /tmp?
  • Aaron: Unable to reproduce. Timing measurements from screen recordings (all times and timestamps are measured in 1/30 of a second):
                                     start   end    end minus start
before upgrade - bootup            : 335  -> 736  | 401
before upgrade - shutdown          : 914  -> 1156 | 242
after upgrade - bootup             : 323  -> 728  | 405
after upgrade - shutdown           : 869  -> 1058 | 189
before upgrade - sysmaint bootup   : 247  -> 746  | 499
before upgrade - sysmaint shutdown : 1377 -> 1621 | 244
after upgrade  - sysmaint bootup   : 215  -> 616  | 401
after upgrade  - sysmaint shutdown : 1195 -> 1410 | 215
  • If slow shutdown is noticed again, will re-measure and compare to these values.

stardict - investigate

[edit]

trixie-port - user-sysmaint-split - improve error handling

[edit]
  • now: when booting into sysmaint session and user-sysmaint-split fails, one actually boots into a user session
  • expected: better error handling
  • todo: when user-sysmaint-split fails (such as read-only file system, either due to a live-hardner bug or filesystem corruption, disk hardware issues):
    • show an error, wait, reboot or poweroff?
    • offer to open a recovery console? conflicts with no recovery console by default goal. so settings should be honored. a recovery console however or even booting into "user session" may be helpful for debugging.
    • need to have some way to debug the system
  • Aaron: Suggested action: Make sysmaint-boot.service print stdout and stderr to journal+console (so messages are seen by the user). If an error is encountered and trapped, pause for five seconds so they can see or screenshot the error. Ensure that the user does not get dropped to a sysmaint session with a full LXQt desktop, or a user session, prefer dropping them to a login screen as worst-case scenario.
    • This should allow easy-ish debugging (switch to a TTY and log in as account sysmaint) assuming the sysmaint account was unlocked before sysmaint-boot.service crashed. It also avoids the possible security risks of logging in as a standard user while the sysmaint account is unlocked.
    • Maybe also block logging into a full graphical user session when booted in sysmaint session, to encourage the use of a TTY instead?
    • Suggestions implemented, commits pushed to user-sysmaint-split and desktop-config-dist.
  • Patrick: Merged.

trixie-port - kloak - disable red crosshair by default

[edit]
  • todo discuss
  • Aaron: Done, commits pushed to kloak and lxqt-wayland-session.
  • Patrick: Merged.

live-hardener - skip overlay of non-overlayable filesystems

[edit]
  • todo
  • Aaron: Added requested feature, also greatly improved regression test coverage, added better comments, and fixed some bugs with finding submounts.
  • Patrick: Merged.
  • Patrick: please review https://github.com/assisted-by-ai/grub-live/pull/1archive.org iconarchive.today icon
    • Aaron: Merged.

security-misc /etc/systemd/system/ review

[edit]
  • Do /etc/systemd/system folder contents still make sense nowadays?
  • https://github.com/Kicksecure/security-misc/tree/master/etc/systemd/systemarchive.org iconarchive.today icon
    • Aaron: In my opinion, yes. The contents of these files prevent a locked root account from denying access to emergency mode, which IMO is very useful so that someone with physical access to the machine and the disk passphrase (and bootloader password) can fix a broken system even if the root account is locked for security. I also think that these should remain in /etc as they are now, because that allows users who want to disable this behavior to do so easily.

LXQt - ISO - move task bar to the top

[edit]

Whonix-Starter - please fork on github and nothing

[edit]
  • https://github.com/Whonix/Whonix-Starterarchive.org iconarchive.today icon
  • 1. please fork
  • 2. done
  • (this is just to be able to git fetch from github using dm-packaging-helper-script without errors, exceptions, the only not yet forked repository)
  • 3. please move to archived when done
    • Aaron: Repo was already forked. Made sure the master and work branches of all my repos were updated just in case that would help the issue.

bookworm - disk lost after initial upgrade-nonroot

[edit]
  • occurs for users running Whonix KVM under Fedora, Manjaro
    • Debugged, was only able to reproduce the issue once (using Manjaro KDE). Partition table was corrupted after first boot, the partition table field indicating the end of the partition had been changed to a larger value, but integrity checking info was not updated, thus Linux wasn't detecting any partitions on the device. Interestingly, in a later working VM, the same larger value was seen in the partition table, but there were no boot issues.
    • The most likely culprit is systemd-repart.
    • Unable to reproduce with Whonix 18 on Manjaro KDE. Documented possible workaround here: https://www.whonix.org/wiki/KVM#VM_disk_corruption_after_first_bootarchive.org iconarchive.today icon

trixie-port - power saving

[edit]

trixie-port - livecheck - avoid multiple popups

[edit]
  • if pressing the livecheck button multiple times, and an active popup window is already open, don't open additional popups
    • Aaron: Implemented in desktop-config-dist.
  • Patrick: Merged.

trixie-port - set-system-keymap

[edit]
  • bug: Whonix-Gateway - no user-sysmaint-split - sudo set-system-keymap de
  • expected: runs labwc --reconfigure
  • actual: does not run labwc --reconfigure
  • todo: look at $SUDO_USER and run sudo --non-interactive -u $SUDO_USER labwc --reconfigure
  • todo: run sudo --non-interactive -u $user_name_item labwc --reconfigure for all users?
  • todo: set-system-keymap / set-console-keymap: run loadkeys to apply changes without reboot? (not possible)
  • Aaron: Implemented, however this does not fully work due to a labwc bug: https://github.com/labwc/labwc/issues/3184archive.org iconarchive.today icon
  • Patrick: Merged.

trixie-port - text encoding issues

[edit]

trixie port - sdwdate-gui icon under Qubes gets stuck in "broken" mode

[edit]
  • Steps to reproduce:
    • Set anon-whonix NetVM to "none"
    • Boot sys-whonix
    • Boot anon-whonix
    • Observe sdwdate-gui icon changes to a "broken" icon (this is intentional, as sdwdate in anon-whonix is broken due to the NetVM being "none"
    • Shutdown anon-whonix
    • Expected result: sdwdate-gui icon changes back to what it was previously
    • Actual result: sdwdate-gui icon is stuck "broken"
  • Fixed: https://github.com/ArrayBolt3/sdwdate-gui/commit/deffa5039800d1eac28d83ed5cb9dc7dc9cb1f19archive.org iconarchive.today icon
  • Patrick: Merged.

trixie-port - sdwdate-gui-broken when sys-whonix is booted in sysmaint session

[edit]
  • bug: starts sdwdate-gui instead of sdwdate-gui-qubes?
  • bug: /usr/libexec/sdwdate-gui/sdwdate-gui-qubes-proxy-helper is broken because UID 1000 is hardcoded
  • this results in other App Qubes (such as anon-whonix) frequent sdwdate-gui systemd journal errors
  • Aaron: Fixed, pushed commit to sdwdate-gui.
  • Patrick: Merged.

trixie-port - iso broken in Qubes

[edit]

broken units:

  • systemd-networkd-persistent-storoge.service
  • greetd-config-build.service
  • live-mode-apparmor.service
  • sdwdate-pre.service
  • cold-boot-attack-defense-status
  • tor@default.service
  • usbguard.service
  • Maybe just insufficient RAM? -> todo: fail more obvious, stop boot?
  • failed units can mess up sysmaint session?
  • Aaron: Reproduced with slightly different symptoms (had a VM crash during bootup once and boot into CLI mode another time), increasing RAM did appear to fix the issue. Could possibly use a oneshot unit very early in startup that would print a message to the TTY if RAM was below a certain "safe" threshold.
    • Pushed a commit to rads that should result in a warning message and fallback to CLI-only mode if RAM is insufficient.
  • same issue as trixie-port - live mode - sysmaint session - broken

trixie-port - live mode - user session - broken

[edit]
  • many systemd units failing during boot
  • could be related to above
  • Aaron: Could not reproduce, tried multiple scenarios after discussion in chat.
  • same issue as trixie-port - live mode - sysmaint session - broken

trixie-port - live mode - sysmaint session - broken

[edit]
  • to debug, use "leaprun sudo" (as documented on https://www.kicksecure.com/wiki/Sysmaint#enable_sudo_access_in_USER_sessionarchive.org iconarchive.today icon)
  • bug: boots into user session, presumably due to read-only file system
  • bug: sudo touch /etc/testfile show "read-only file system"
  • bug: live-hardener: INFO: Non-zero exit code. - Should be ERROR or at least WARNING?
    • Patrick: Fixed.
  • bug: live-hardener detect grub-live-semi-persistent-unsafe but livecheck does not point that out
  • bug: live hardener attempts to remount /boot/efi but fails
  • bug: live-hardener runs a mount code that has a non-zero exit code but yet live-hardener exits zero rather than non-zero
  • Aaron: Could not reproduce, tried multiple scenarios after discussion in chat.
  • Patrick: live-hardener log: removed since not caused by live-hardener.
  • Patrick: Probably not caused by live-hardener. sudo systemctl mask live-hardener.service - did not solve the issue
  • Patrick: Also not a VirtualBox green turtle issue as this was also resolved on my system.
  • lots of overlayfs related issues: https://github.com/dracut-ng/dracut-ng/issues?q=overlayfsarchive.org iconarchive.today icon
  • user session mode - persistent mode - no issue - for comparison only
mount

/dev/sda3 on / type ext4 (rw,relatime,errors=remount-ro)
devtmpfs on /dev type devtmpfs (rw,nosuid,size=4096k,nr_inodes=246855,mode=755,inode64)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev,inode64)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=600,ptmxmode=000)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot)
pstore on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime)
bpf on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,relatime,mode=700)
proc on /proc type proc (rw,relatime)
tmpfs on /run type tmpfs (rw,nosuid,nodev,size=403684k,nr_inodes=819200,mode=755,inode64)
systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=36,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=4308)
mqueue on /dev/mqueue type mqueue (rw,nosuid,nodev,noexec,relatime)
hugetlbfs on /dev/hugepages type hugetlbfs (rw,nosuid,nodev,relatime,pagesize=2M)
tracefs on /sys/kernel/tracing type tracefs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /run/lock type tmpfs (rw,nosuid,nodev,noexec,relatime,size=5120k,inode64)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,nr_inodes=1048576,inode64)
tmpfs on /run/credentials/systemd-journald.service type tmpfs (ro,nosuid,nodev,noexec,relatime,nosymfollow,size=1024k,nr_inodes=1024,mode=700,inode64,noswap)
fusectl on /sys/fs/fuse/connections type fusectl (rw,nosuid,nodev,noexec,relatime)
configfs on /sys/kernel/config type configfs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /run/credentials/systemd-networkd.service type tmpfs (ro,nosuid,nodev,noexec,relatime,nosymfollow,size=1024k,nr_inodes=1024,mode=700,inode64,noswap)
/dev/sda1 on /boot/efi type vfat (rw,relatime,fmask=0077,dmask=0077,codepage=437,iocharset=ascii,shortname=mixed,utf8,errors=remount-ro)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,nosuid,nodev,noexec,relatime)
tmpfs on /run/user/1000 type tmpfs (rw,nosuid,nodev,relatime,size=201840k,nr_inodes=50460,mode=700,uid=1000,gid=1000,inode64)
tmpfs on /run/credentials/getty@tty1.service type tmpfs (ro,nosuid,nodev,noexec,relatime,nosymfollow,size=1024k,nr_inodes=1024,mode=700,inode64,noswap)
portal on /run/user/1000/doc type fuse.portal (rw,nosuid,nodev,relatime,user_id=1000,group_id=1000)
shared on /mnt/shared type vboxsf (rw,nodev,relatime)
  • user session - live mode - broken read-only filesystem
/dev/sda3 on / type ext4 (ro,relatime)
devtmpfs on /dev type devtmpfs (rw,nosuid,size=4096k,nr_inodes=246855,mode=755,inode64)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev,inode64)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=600,ptmxmode=000)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot)
pstore on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime)
bpf on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,relatime,mode=700)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
tmpfs on /run type tmpfs (rw,nosuid,nodev,size=403684k,nr_inodes=819200,mode=755,inode64)
systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=36,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=4451)
tracefs on /sys/kernel/tracing type tracefs (rw,nosuid,nodev,noexec,relatime)
hugetlbfs on /dev/hugepages type hugetlbfs (rw,nosuid,nodev,relatime,pagesize=2M)
tmpfs on /run/lock type tmpfs (rw,nosuid,nodev,noexec,relatime,size=5120k,inode64)
mqueue on /dev/mqueue type mqueue (rw,nosuid,nodev,noexec,relatime)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,nr_inodes=1048576,inode64)
tmpfs on /run/credentials/systemd-journald.service type tmpfs (ro,nosuid,nodev,noexec,relatime,nosymfollow,size=1024k,nr_inodes=1024,mode=700,inode64,noswap)
fusectl on /sys/fs/fuse/connections type fusectl (rw,nosuid,nodev,noexec,relatime)
configfs on /sys/kernel/config type configfs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /run/credentials/systemd-networkd.service type tmpfs (ro,nosuid,nodev,noexec,relatime,nosymfollow,size=1024k,nr_inodes=1024,mode=700,inode64,noswap)
/dev/sda1 on /boot/efi type vfat (rw,relatime,fmask=0077,dmask=0077,codepage=437,iocharset=ascii,shortname=mixed,utf8,errors=remount-ro)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,nosuid,nodev,noexec,relatime)
tmpfs on /run/user/1000 type tmpfs (rw,nosuid,nodev,relatime,size=201840k,nr_inodes=50460,mode=700,uid=1000,gid=1000,inode64)
tmpfs on /run/credentials/getty@tty1.service type tmpfs (ro,nosuid,nodev,noexec,relatime,nosymfollow,size=1024k,nr_inodes=1024,mode=700,inode64,noswap)
portal on /run/user/1000/doc type fuse.portal (rw,nosuid,nodev,relatime,user_id=1000,group_id=1000)
  • user session: same output for both, persistent mode and live mode
sudo sgdisk -v /dev/sda

Caution: Partition 3 doesn't end on a 2048-sector boundary. This may
result in problems with some disk encryption tools.

No problems found. 2021 free sectors (1010.5 KiB) available in 2
segments, the largest of which is 2014 (1007.0 KiB) in size.
  • Patrick: For debugging, removed error=remount-ro from /etc/fstab. No effect.
  • Aaron: Issue spotted, your system is still using the Debian-specific module for mounting an overlayfs, and thus is looking for rootovl rather than rd.live.overlay.overlayfs=1.
  • Patrick: Merged.

trixie-port - sysmaint - lock screen - black screen

[edit]
  • probably minor bug: boot into sysmaint session -> lock screen -> black screen
    • note: this bug was only observed prior reboot. after reboot, screen locking was refused with popup. as expected. (because no password set)
      • after setting a password and locking the screen, everything worked as expected.
  • we might be able to ignore this bug since unreleased
  • xtrace of /usr/libexec/user-sysmaint-split/sysmaint-session-wayland
    • (ticket below for unrelated error messages found)
  • Aaron: Cannot reproduce. Asked for more info in chat.
  • Aaron: Possibly transient, symptoms did not match any screen locking utility in Kicksecure. Archiving for now.

trixie port - possibly broken systemcheck disallowed-test

[edit]
  • Aaron saw the AppArmor "disallowed-test" fail in KVM. Investigate.
    • Issue does not occur in a freshly built KVM VM. Archiving.

trixie-port - user-sysmaint-split versus flatpak

[edit]
  • flatpak install flathub org.mozilla.firefox
  • functional in user session
  • also functional
  • please investigate security impact
  • Aaron: Users were indeed able to install applications system-wide, so that account user could install an app in a location where account sysmaint could run it later.
    • Added a commit to security-misc to lock down Flatpak's polkit controls, requiring authorization for most things. Installing software with flatpak install --user is still functional as account user even with user-sysmaint-split installed.
  • Patrick: Does it belong into security-misc or user-sysmaint-split?
    • Aaron: security-misc seems preferable. Might prevent deployment of a system-wide malicious flatpak.
  • Patrick: Please update debian/control and readme.
    • Aaron: Updated README.md. debian/control didn't look like it had anything that needed updated.
  • Patrick: Merged.

trixie-port - kloak - compilation warning

[edit]
In file included from src/kloak.c:47:
src/xdg-output-protocol.h: In function 'zxdg_output_v1_add_listener':
src/xdg-output-protocol.h:347:38: warning: cast discards 'const' qualifier from pointer target type [-Wcast-qual]
  347 |                                      (void (**)(void)) listener, data);
      |                                      ^
In file included from src/kloak.c:48:
src/wlr-layer-shell.h: In function 'zwlr_layer_surface_v1_add_listener':
src/wlr-layer-shell.h:434:38: warning: cast discards 'const' qualifier from pointer target type [-Wcast-qual]
  434 |                                      (void (**)(void)) listener, data);
      |                                      ^
make[1]
  • Aaron: Warnings are in headers autogenerated by wayland-scanner. The way in which the code is used that leads to these warnings appears to be correct use of the Wayland protocols and libraries, thus this should be safe to ignore.
  • Patrick: Merged.

trixie-port - qubes update

[edit]
  • privleap systemctl workaround
  • no stream isolation warnings injected by uwt
    • Aaron: Both done, new commits in uwt.
  • Patrick: Merged.

mediawiki-shell review and merge

[edit]
  • https://github.com/Kicksecure/mediawiki-shell/pull/1archive.org iconarchive.today icon
  • please review, merge and commit any fixes on top if any new bugs were introduced or obvious bugs spotted
  • branch: trixie (primarily used internally)
    • Aaron: Reviewed, fixed many small issues, pushed to my fork of mediawiki-shell. Code is untested as of yet, can come back to test this if/when desirable.
  • Patrick: Merged.

trixie-port - /etc/profile.d environment variables missing

[edit]
  • Kicksecure 18, ISO with vm-config-dist installed
  • /etc/profile.d/20_software_rendering_in_vms.sh - script executes correctly if executed using sh -x /etc/profile.d/20_software_rendering_in_vms.sh
  • when typing env | grep -i QML the environment variable is missing under Wayland
  • Aaron: Found bug, glxinfo is not directly compatible with Wayland and can be misleading when using Xwayland.
  • Patrick: Merged.

tor-control-panel - anon-connection-wizard - review contributions

[edit]

trixie port - dom0 updates over Whonix-Gateway

[edit]

trixie port - sysmaint - sys-whonix - missing systemd units

[edit]
  • Please check if any systemd units are missing in sysmaint.target.
sudo systemctl list-units --all | grep "loaded    inactive dead"
  • Aaron: Compared the units running in a user session with the units running in a sysmaint session, rather than using --all; this approach should be more accurate.
    • Added some missing units to user-sysmaint-split (sysmaint-boot.service).
    • Also sent an email to Qubes to see if we should just blanket whitelist all qubes units going forward (this should be done with automation of some sort most likely to avoid units introduced in the future ending up missed). https://www.mail-archive.com/qubes-devel@googlegroups.com/msg05673.htmlarchive.org iconarchive.today icon

trixie-port - qubes-bind-dirs bug

[edit]
  • uses has privately shared a log where /var/lib/sdwdate/time-replay-protection-utc-unixtime was not writeable by sdwdate
  • /usr/lib/tmpfiles.d/sdwdate.conf looks fine
  • therefore this is a qubes-bind-dirs issue?
  • https://github.com/QubesOS/qubes-issues/issues/8466archive.org iconarchive.today icon
    • if possible during R4.3 RC. otherwise priority can be lowered.
    • otherwise, non-ideal workaround otherwise for all bind-dirs:
## https://github.com/QubesOS/qubes-issues/issues/8466
ExecStartPre=chown --recursive canary:canary /var/lib/canary

trixie-port - lock-screen improvements

[edit]
  • move from /usr/libexec/helper-scripts/lock-screen to /usr/bin/lock-screen since it might be useful to lock the screen using the command line
  • bug: unhandled swaylock issues. If swaylock exits non-zero, there would currently be no error popup. (Theoretical issue only at this time.)
  • disable screen lock by default inside VMs, if sane?
    • Versus security on servers with wayland installed?
    • Versus vm-config-dist? (Which says it disables screen locks for VMs but does not yet for Wayland.)
  • use a different background image that simply states "screen lock" all over the place?
  • use a swaylack theme?
  • there is not really a swaylock alternative where the password prompt is more obvious? (was discussed before, i think)
  • automatically lock screen in sysmaint session. Currently does not seem to happen.
  • Aaron: All implemented in appropriate packages (anon-gw-base-files, anon-ws-base-files, desktop-config-dist, helper-scripts, kicksecure-base-files, sysmaint-panel, user-sysmaint-split, vm-config-dist)
  • Patrick: Merged.

trixie port - multiple wayland sessions or wayland session restarts

[edit]
  • excerpt from above log file from task trixie-port - sysmaint - lock screen - black screen
  • steps to reproduce:
    • 1) from a virtual console.
    • 2) while a wayland session is already running
    • 3) sudo systemctl restart greetd
  • Multiple sessions? Not important. Most important is to handle or fail better:
    • The usual thing would be to kill the old session and start a new one?
    • If not, can we fail with a better error message?
  • Aaron: Implemented the "kill the old session and start a new one" solution. Commits pushed to user-sysmaint-split, helper-scripts, and kloak (since code from kloak ended up being reused in user-sysmaint-split and was split into a new library in helper-scripts).
  • Patrick: Merged.

trixie port - backlight-tool

[edit]
  • excerpt from above log file from task trixie-port - sysmaint - lock screen - black screen
    • i did not use backlight-tool because testing inside a VM
    • yet, journal will probably pick up an issue such as the following
/usr/bin/backlight-tool-dist-agent: ERROR: Cannot read target file!
  • bug: backlight-tool shows errors inside VMs where it is expected that there is no backlight kernel driver
  • question:
    • related to calc_bl_brightness=$(( (bl_max_brightness * bl_pct) / 100 )) || true (split by Patrick into two lines)
    • action: bash -x usr/bin/backlight-tool-dist-agent set 100
      • result: overwrite /home/user/.config/backlight-tool-dist-last-bright-pct 50
      • always "50" is written to that file
  • some changes by Patrick. Please review.
    • Aaron: Reviewed, made some string changes and added a better info message when no saved brightness value is present for restoring.
  • Patrick: Merged.

trixie-port - vm-config-dist - disable power savings by default in wayland

[edit]
  • needed?
  • Aaron: Done as part of disabling screen locking in VMs on Wayland.

trixie-port - don't offer on-screen keyboard in sysmaint-panel on Qubes

[edit]
  • The on-screen keyboard button does nothing under Qubes because Wayland is not in use. Even if Wayland was in use, this would be confusing.
    • Hid this and the system keymap button under Qubes OS at the same time.
  • Patrick: Merged.

trixie-port - apparmor-info - fix

[edit]
  • bug: apparmor-info is no longer functional on trixie. It fails to show denied (or any) apparmor messages.
  • Aaron: Fixed, commits pushed to security-misc and helper-scripts.
    • WARNING: apparmor-info and apparmor-watch moved from helper-scripts to security-misc, thus please add to security-misc Breaks/Replaces against helper-scripts versions older than the next uploaded version.
      • Patrick: Merged, reverted to avoid breaks, replaced. Instead added the journal auditd socket activation to usability-misc.

trixie-port - system keymap script improvements #2

[edit]
  • separate set-console-keymap
    • Aaron: Implemented in helper-scripts.
  • sysmaint-panel: do not show keymap change in Qubes
    • Aaron: Implemented. Notes about UI design left in chat.
  • Patrick: Merged.

automate detection of new tor and tor-browser versions

[edit]
  • We currently ship Tor in the Kicksecure repository, taking packages from deb.torproject.org for this.
  • We also hardcode a Tor Browser version number in tb-updater.
  • Create scripts for finding the latest versions of Tor and Tor Browser, and taking the necessary actions to update them
## developer-meta-files
/usr/bin/dm-virtualbox-update-local-and-wiki-links

make_cross_build_platform_list="i386 amd64 arm64" ./build-steps.d/*_create-debian-packages --flavor internal --target root --function download_tpo_packages

./build-steps.d/*_create-debian-packages --flavor internal --target virtualbox --function download_packages_from_debian_sid
  • Aaron: Implemented Tor package update script as dm-tor-update-repository, added wrapper in dm-packaging-helper-script.
  • Aaron: Tor Browser version updater is already implemented as pkg_tor_browser_version_update in dm-packaging-helper-script.
  • Aaron: Unsure where to add master wrapper to update Tor, Tor Browser, and VirtualBox all at once. Perhaps create a new shell script, dm-update-third-party-software-references or similar?
  • Patrick: Merged.
  • Patrick: dm-maintenance created

trixie-port - default screen resolution

[edit]
  • vm-config-dist: debian/control
 Set screen resolution 1920x1080 by default for VM in VirtualBox and KVM.
 Workaround for low screen resolution 1024x768 at first boot. When using lower
 screen resolutions, Xfce will automatically scale down.
 `/etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/displays.xml` TODO: This
 may no longer be the case with Wayland.
  • please re-implement for Wayland, if sane.
  • Aaron: Doing this exactly as described may be hard on Wayland, because there is no location where the display configuration is saved any longer, it is always generated dynamically and must be fixed manually by the user if desired. However, what we can do is set the resolution of all displays to 1920x1080 if the appropriate hypervisor helpers (VBoxDRMClient, spice-vdagentd) are not active when wlr_resize_helper launches.
    • Implemented this in vm-config-dist.
  • Patrick: Merged.

trixie port - forcing reinstallation of alternative /usr/libexec/user-sysmaint-split/policy-rc.d because link group policy-rc.d is broken

[edit]
  • bug?
Setting up systemcheck (3:43.6-1) ...
warn: The user `canary' is already a member of `debian-tor'.
warn: The user `systemcheck' is already a member of `debian-tor'.
warn: The user `systemcheck' is already a member of `systemd-journal'.
Processing triggers for qubes-core-agent (4.3.34-1+deb13u1) ...
Setting up user-sysmaint-split (3:9.1-1) ...
update-alternatives: warning: forcing reinstallation of alternative /usr/libexec/user-sysmaint-split/policy-rc.d because link group policy-rc.d is broken
Synchronizing state of openvpn.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install enable openvpn
Generating grub configuration file ...
Found theme: /boot/grub/themes/kicksecure/theme.txt
Adding boot menu entry for UEFI Firmware Settings ...
done
Setting up security-misc-desktop (3:48.8-1) ...

trixie port - remove volume widget from Whonix-Gateway sysmaint panel

[edit]
  • Waybar is showing an empty volume widget on Whonix-Gateway
  • Move config files to remove this.
    • Likely need to handle migration of the files from desktop-config-dist to the appropriate base-files packages to prevent breaking Qubes OS R4.3 rc3. See qubes-public Matrix room for context.
    • Done, commits pushed to kicksecure-base-files, anon-ws-base-files, anon-gw-base-files, and desktop-config-dist for this.
      • WARNING: After desktop-config-dist's version is bumped, all three *-base-files packages MUST have a Breaks/Replaces against desktop-config-dist (<< LATEST_VERSION) added.
  • Patrick: Note to self:
myfind . | grep base-files | grep --invert-match dist-base-files | grep --invert-match whonix-base-files | grep control

./whonix/anon-gw-base-files/debian/control
./whonix/anon-ws-base-files/debian/control
./kicksecure/kicksecure-base-files/debian/control
  • Patrick: Done.
  • Patrick: Please check if functional on your side. If so, please move to archived.
    • Aaron: Upgrades worked, however due to an oversight the volume widget in Whonix-Gateway wasn't fully removed. Pushed a commit to anon-gw-base-files to fix.
    • Also noticed a preinst script header was missing in usability-misc, and pushed a commit to fix that too.
  • Patrick: Merged.

trixie port - virtualbox / kvm - dynamic resolution resizing with labwc

[edit]
  • Automatic display resizing is no longer working under VirtualBox with Wayland. It actually does work, but it requires the user to manually set the resolution to the "native" resolution after every window resize.
  • Possible solutions listed for discussion at https://github.com/labwc/labwc/discussions/3109archive.org iconarchive.today icon
  • Discussion ongoing, currently waiting on upstream to reply. I might attempt to do further development work on this if we consider it a priority.
  • Discussed with Patrick, we should probably solve this ourselves via a daemon that watches udev messages, as not having this feature may result in serious usability issues with VirtualBox.
  • Discovered that a missing binary, VBoxDRMClient, was needed to even try to implement resize support. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=968390#15archive.org iconarchive.today icon
    • Found and tested a fix, sent it to the VirtualBox Debian maintainers. Awaiting a response from them. I can still work on implementing the resizing code in the mean time.
      • This was accepted in Debian.
  • Implemented the helper tools for actually changing the display resolution.
  • Patrick: Merged.
  • Patrick: Tested in VirtualBox. Working great!
  • Patrick: TODO: Please error out if vbox drm client is missing or fails.
    • Aaron: Implemented, along with similar code for KVM: https://github.com/ArrayBolt3/vm-config-dist/commit/166a3e13a2ad1369265aed7f23e3a7ae21cdea89archive.org iconarchive.today icon
      • Patrick: Merged.
      • Patrick: Maybe better don't exit non-zero in case and keep running? Because there is no (systemd) supervisor to restart the script.
      • Patrick: Before: Forgiving in case dependencies are missing but installed later.
      • Patrick: Now: Non-forgiving, more brittle?
        • Aaron: Fixed, pushed a new commit to vm-config-dist for this.
      • TODO: Start wlr-resize-watcher as a systemd user unit, if sensible. Would be useful if the process gets randomly killed (some sort of user space OOM management).
        • Aaron: Undesirable, as this would prevent wlr-randr from finding the appropriate Wayland compositor. Having the session start the process makes sure the right WAYLAND_DISPLAY variable is set, which means wlr-randr should always access the correct compositor.

Qubes Kicksecure - sdwdate-gui qrexec denied messages

[edit]
  • Qubes R4.3
  • 1) Kicksecure 17 Template installed
  • 2) qubes-core-admin-addon-kicksecure installed
  • 3) release-upgraded to Kicksecure 18
  • 4) created App Qube based on Kicksecure Template
  • bug: sdwdate-gui qrexec denied messages
  • debugging information:
    • running "sudo qvm-features-request kicksecure=1" shows nothing in dom0 journal (i would expect that to show something)
    • running in dom0 "qvm-features kicksecure-17 | grep kicksecure" shows that qvm-feature "kicksecure" is missing
  • Aaron: Reproduced, but the issue can be fixed by doing the following:
    • Ensure qubes-core-admin-addon-kicksecure is installed in dom0, if it isn't, install it (sudo qubes-dom0-update --action=install qubes-core-admin-addon-kicksecure) and then restart qubesd (sudo systemctl restart qubesd)
      • Patrick: Qubes bug? sudo systemctl restart qubesd should be automated? Perhaps the postinst script can do that?
    • Boot the upgraded Kicksecure 18 qube
    • Run cd /etc/qubes/post-install.d; for i in *.sh; do source $i; done
    • Reboot dom0 or restart qubesd again
  • Aaron: Why are the post-install.d scripts not being properly called after a release upgrade? Shouldn't apt do this for us? We could probably work around this issue by making release-upgrade source all scripts in post-install.d after the upgrade.
      • Patrick: Please report at Qubes to find a solution for this, if still an issue.
      • Patrick: Possible to add some echo informational debug output so we can see what is run?
    • Aaron: After another test, I believe these scripts are being run. Most likely the reason I ran into this issue was because I failed to restart qubesd or dom0 before running the release upgrade. After reinstalling Kicksecure 17 again and upgrading it to Kicksecure 18 again, the feature is properly set and a new AppVM based on the template is able to connect to sys-whonix's sdwdate_gui_server.
        • Patrick: Probably same solution as above: Automate restart of qubesdb?
  • Aaron: What's a good way to inform users that they need to install qubes-core-admin-addon-kicksecure and reboot before installing Kicksecure templates?
    • Patrick: No idea. Could you discuss at Qubes please? I guess also applies to qubes-core-admin-addon-whonix to a lesser degree. Meanwhile, please document.
  • Patrick: Can qubes-core-admin-addon-kicksecure be made functional if installed too late (after Kicksecure Template installation)?
    • Aaron: Qubes OS R4.3 will have qubes-core-admin-addon-kicksecure preinstalled, so this likely won't happen to anyone using the final release. Sourcing all scripts in /etc/qubes/post-install.d will resolve the issue if it somehow shows up in the wild.
  • Aaron: Anything left to do here? Our last conversation on Matrix ended with the conclusion that we could not re-evaluate the in-vm post-install.d scripts when dom0's qubes-core-admin-addon-kicksecure was installed or updated, but I'm not sure if we came to a conclusion about what to do with this, if anything. Maybe just document that users can do something like export LC_ALL=C; cd /etc/qubes/post-install.d; for i in *.sh; do source "$i"; done if necessary?

trixie-port - system keymap script improvements

[edit]
  • more changes were added by Patrick
  • 1) always show a success message such as the following even if run manually (currently only in interactive mode)
    • Aaron: Implemented in helper-scripts.
  printf '%s\n' "$0: INFO: Keyboard layout change successful." >&2
  • 2) port live-config-dist to set-all-keymap, if sensible
    • Aaron: Implemented in helper-scripts and live-config-dist.
  • 3) sysmaint-panel: add an option to start set-all-keymap
    • Aaron: Implemented in sysmaint-panel.
  • Patrick: Merged.

systemcheck - garbage configuration should result in non-zero exit code

[edit]

trixie port - Kicksecure template build failure due to firmware-nonfreedom

[edit]

trixie-port - Warning: ignoring exit-on-service-eof=true for executable service /etc/qubes-rpc/qubes.UpdatesProxy

[edit]
Warning: ignoring exit-on-service-eof=true for executable service /etc/qubes-rpc/qubes.UpdatesProxy

install fewer firmware-nonfreedom packages by default in Qubes

[edit]
  • install firmware-nonfreedom by default in Qubes. Done by Patrick.
  • purpose: useful for sys-net (non-free wifi controller)
  • we might want a smaller collection of packages to save disk space since for example microcode is irrelevant? can we rely on a Qubes package for the non-free firmware package selection?
  • Aaron: Qubes does not appear to have a package we can use for this.
  • Aaron: Split packages containing networking firmware (wireless or wired) from firmware-nonfreedom into firmware-nonfreedom-network, and switched kicksecure-qubes-cli to use firmware-nonfreedom-network. Commits in developer-meta-files, kicksecure-meta-packages.
  • Patrick: Merged.

rename sdwdate.ConnectCheck to sdwdate-gui.ConnectCheck etc

[edit]

trixie port - Whonix Qubes template issues

[edit]

kloak - Qubes OS input anonymization flicker bug

[edit]

trixie-port - browser-choice - do not Depends on tb-updater

[edit]
  • should be installed only on demand
  • this is to avoid Kicksecure Qubes Templates downloading Tor Browser
  • Patrick: Implemented. Needs to be tested.
    • Aaron: Notes shared in chat.
  • Patrick: Simple solution. Install tb-updater and tb-starter only. Instruct user to run Tor Browser Downloader in user session.
    • Aaron: Implemented, commits pushed to browser-choice.
  • Patrick: Merged.

ipv6 sleep 10 improvements

[edit]
  • as discussed
  • skip sleep when IPv6 is disabled in kernel
  • event-based if possible
  • re-check every 0.1 - 1 second
  • commentary why this is necessary
  • Aaron: Pushed commits to anon-gw-anonymizer-config, reimplementing tor-wait-for-network in Python for speed and ease of working with files, and adding the requested functionality.
  • Patrick: Merged.

trixie-port - port Whonix-Gateway to privleap

[edit]
  • currently broken: anon connection wizard, tor control panel
  • Aaron: Pushed new commits to anon-connection-wizard and tor-control-panel to fix issues in both. Untested (yet).
  • Patrick: Merged.

trixie port - sysmaint session occasional black screen

[edit]

trixie-port - keyboard layout change usability improvements

[edit]
  • user story: I am a VM using and in user session, CLI. How do I change my keymap? "sudo loadkeys de"? Doesn't work. No sudo.
  • todo:
    • refuse running set-labwc-keymap as root
    • set-console-keymap: CLI tool that can be used to configure the virtual terminal
    • set-multi-keymap: CLI tool that can set the keymap for currently logged-in account (most likely user), sysmaint and root. It should run, is a wrapper around set-console-keymap and set-labwc-keymap. A tool that sets the keymap for all places relevant to the user.
      • sysmaint GUI: set-labwc-keymap --persist keymap
      • user GUI: sudo --non-interactive -u user set-labwc-keymap --no-reload --persist keymap
      • sysmaint CLI: set-console-keymap de
      • user CLI: sudo --non-interactive -u user set-console-keymap de
    • not sure about --non-interactive
  • Aaron: Implementation ended up being via two wrapper scripts, set-labwc-keymap and set-system-keymap, the former of which configures labwc for the current user, the latter of which configures labwc and the console for all users (with labwc settings being overridable by user-specific settings). The main reason for this is that there is no user-specific console keyboard layout, only a system-wide one. Both scripts wrap a library, set-keyboard-layout.sh. Changes pushed to helper-scripts.
    • Test plan completed, some fixes made during testing.
  • Patrick: Merged.

trixie port - greetd only provides one chance to log in

[edit]

trixie-port - desktop environment broken after release upgrade

[edit]
  • Kicksecure Xfce 17.4.4.6 (for VirtualBox)
  • sudo apt update && sudo apt dist-upgrade
  • sudo release upgrade
  • reboot
  • bug: desktop environment no longer starting
  • debugging:
    • in sysmaint session, CLI:
systemctl is-enabled greetd
disabled

sudo journalctl --boot -u sysmaint-boot
...
INFO: Wayland session: 'no'
...

trixie port - display brightness

[edit]

curl dns ticket reply

[edit]
  • https://github.com/QubesOS/qubes-core-agent-linux/pull/614archive.org iconarchive.today icon
    • I thought my reply was productive. But apparently not. Please discuss, comment.
      • Aaron: Can't comment, discussion has been locked to limited collaborators there. However I don't see anything non-productive about the comment at https://github.com/curl/curl/discussions/11125#discussioncomment-7498491archive.org iconarchive.today icon. If a Tor developer went out of their way to say the library shouldn't block onion resolution, and they do anyway because a Tor spec supposedly says they should, that's a strange decision and one they arguably shouldn't have made. Not sure much else can be done there other than work around the issue as we do now.

misc review

[edit]

qubes - kernel boot mode for Template shows user session instead of sysmaint session

[edit]
  • todo
  • Aaron: Cannot reproduce.
    • Freshly installed Kicksecure 17 template:
      • Boot mode: PERSISTENT Mode - SYSMAINT Session
      • AppVM default boot mode: PERSISTENT Mode - USER Session
    • After upgrading from Kicksecure 17 to Kicksecure 18:
      • Boot mode: PERSISTENT Mode - SYSMAINT Session
      • AppVM default boot mode: PERSISTENT Mode - USER Session
    • Freshly installed Whonix-Workstation 17 template:
      • Boot mode: PERSISTENT Mode - SYSMAINT Session
      • AppVM default boot mode: PERSISTENT Mode - USER Session
    • After upgrading from Whonix-Workstation 17 to Whonix-Workstation 18:
      • Boot mode: PERSISTENT Mode - SYSMAINT Session
      • AppVM default boot mode: PERSISTENT Mode - USER Session
    • Freshly installed Whonix-Gateway 17 template:
      • Boot mode: PERSISTENT Mode - USER Session
        • Expected, since Whonix-Gateway does not have user-sysmaint-split installed on it.
      • AppVM default boot mode: PERSISTENT Mode - USER Session
    • After upgrading from Whonix-Gateway 17 to Whonix-Gateway 18:
      • Boot mode: PERSISTENT Mode - USER Session
      • AppVM default boot mode: PERSISTENT Mode - USER Session
    • AppVMs for both Kicksecure 18 and Whonix-(Workstation/Gateway) 18 have the correct "PERSISTENT Mode - USER Session" boot mode
  • Patrick: Whonix-Gateway - without user-sysmaint-split - shouldn't show PERSISTENT Mode - USER Session since not applicable?
  • Aaron: After threat model discussion, choosing to install user-sysmaint-split in Whonix-Gateway.
    • See chat notes, fixing a UX issue requires some files to move in a way that will either require a painful migration process or require Whonix 18 and Kicksecure 18 systems to be rebuild/reinstalled/repaired by the end user. Would suggest the latter, as Kicksecure/Whonix 18 doesn't have even testing releases out yet.
      • Patrick: Confusing fixed by installing user-sysmaint-split by default.

systemcheck - dependencies version check broken

[edit]
[INFO] [systemcheck] kicksecure-dependencies-cli: Could not detect derivative kicksecure-dependencies-cli version. (Code: 2) Please report this bug!
  • Fix should be added to usr/libexec/systemcheck/preparation.bsh:
   if [ -f "/usr/share/anon-gw-base-files/gateway" ]; then
      derivative_deb_package_name="whonix-gateway-packages-dependencies-cli"
   elif [ -f "/usr/share/anon-ws-base-files/workstation" ]; then
      derivative_deb_package_name="whonix-workstation-packages-dependencies-cli"
   elif [ -f "/usr/share/kicksecure/marker" ]; then
      derivative_deb_package_name="kicksecure-dependencies-cli"
   fi
  • Patrick: Fixed.

Qubes Kicksecure Template - unrestricted session - requires sudo password bug

[edit]
  • Qubes Kicksecure 18 Template
  • unrestricted session
  • bug: asks for sudo password
  • perhaps run: passwordless-root
  • Aaron: Reproduced issue. Fix: https://github.com/ArrayBolt3/user-sysmaint-split/commit/acdf596affe8c40232863a83f19f4101607600c9archive.org iconarchive.today icon
    • This fix is insufficient on its own because passwordless-root is persistent even in AppVMs. Need to make it ephemeral in AppVMs by default, persistent only if explicitly requested.
      • Done, commits pushed to helper-scripts and usability-misc. NOTE: This includes moving passwordless-root from usability-misc to helper-scripts (done to avoid needing to add usability-misc as a dependency of user-sysmaint-split), so this will require the Breaks/Replaces in helper-scripts to be bumped.
      • Patrick: Merged.

install extrepo-offline-data by default

[edit]
  • todo
  • Patrick: Done.

repository-dist-wizard gui broken in Qubes R4.3

[edit]
  • input by keyboard functional
  • input by mouse clicks broken
  • if not easily reproducible then please ignore
  • Aaron: Reproduced, I can select the "No..." radio button with the mouse, but not the "Yes..." radio button.
    • Moving the radio button group box down so that it isn't partially overlapped by the text above resolves the problem.
    • Short-term solution, move the box down.
    • Long-term solution, this should be using layouts so that the window can be resized freely and overlap bugs of this sort don't occur. This will also make the wizard compatible with non-default Qt themes which may have differently sized elements.
    • Implemented long-term solution: https://github.com/ArrayBolt3/repository-dist/commit/9c9feff070470b4494520c8a5d16699f6185a04carchive.org iconarchive.today icon Tested on Whonix-Gateway, works.
      • Patrick: Merged.

trixie port - Qubes R4.3 Templates

[edit]
  • Kicksecure, Whonix: Please bump Qubes R4.3 upstream to Kicksecure, Whonix 18
  • Aaron: Waiting on input on upgrade plan.
  • https://github.com/QubesOS/qubes-issues/issues/10253archive.org iconarchive.today icon
  • Aaron: Marek seems to be doing this so far. Will watch and assist where possible.
    • This appears to have been completed.

/etc/apt/sources.list.d/debian.soures not readable by user only readable by root

[edit]
  • is this intended?
  • Aaron: Not intended. I'm unable to reproduce this issue though - neither a fresh ISO installation of Kicksecure nor Whonix-Gateway or Whonix-Workstation VirtualBox VMs have this issue. Also not seeing this issue in a Whonix-Gateway 18 sys-whonix on Qubes R4.3.
    • I believe I've seen this issue occur in the past, but haven't seen it in a while. I'm happy to build new VM images and check them for this issue if desirable.
    • Patrick: No longer reproducible.

sysmaint-panel - sysmaint session - add display settings shortcut

[edit]
  • add open display settings
  • rationale: When booting for the first time and into sysmaint session inside a VM, the display is too big.
  • Aaron: Implemented in sysmaint-panel. Also pushed commits to developer-meta-files and kicksecure-meta-packages for adding kanshi.
    • Patrick: Merged.

ISO - virtualbox guest additions missing

[edit]

browser-choice - better notification when action such as installation is complete

[edit]
  • todo
  • once there is a exit code of zero or non-zero, show a passive popup? change window color? animation?
  • Aaron: Implemented in browser-choice. Also found and fixed an unrelated bug with dist-virtual-keyboard in helper-scripts.
    • Decided to use a notify-send popup because that will work in both sysmaint and user sessions and has a good chance of getting the user's attention even if the browser-choice window is hiding behind another window or is minimized. Considered using QWindow::alert but this would probably have not worked in a sysmaint session.
      • Patrick: Merged.

volume setting in sysmaint systray

[edit]
  • usability bug: when hovering over volume changes in sysmaint session, the color gets darker, which implies it being clickable, but actually is not clickable
  • Aaron: Fixed with a commit to desktop-config-dist.
    • Patrick: Merged.

sysmaint - restart of greetd allows login into regular desktop ssession

[edit]
  • sudo systemctl restart greetd
  • login as sysmaint
  • bug: expected: sysmaint session. actual: normal desktop session
  • Aaron: Fixed this and a bunch of related issues that popped up when the sysmaint session had autologin disabled. Changes pushed to helper-scripts, user-sysmaint-split, and desktop-config-dist.
    • Patrick: Merged.

browser-choice - brave installation broken

[edit]
  • Kicksecure 17 release upgraded to Kicksecure 18
+ pkexec bash -c -- 'extrepo enable brave_release && apt-get update && apt-get-noninteractive --no-install-recommends --yes install brave-browser'
500 Can't connect to extrepo-team.pages.debian.net:443 (Temporary failure in name resolution) at /usr/share/perl5/Debian/ExtRepo/Data.pm line 34.
Could not download index YAML file:

Done, but operation failed!

Qubes Kicksecure Template Upgrade in R4.3

[edit]
  • todo
  • Aaron: Cannot reproduce issues mentioned in chat. Successfully updated Kicksecure, Whonix-Gateway, and Whonix-Workstation 17 to 18 on Qubes R4.3 with no special configuration changes required.

systemcheck - split log parsing code

[edit]

setxkbmap replacement too for wayland

[edit]

calamares - language setup

[edit]
  • please set up for
    • CLI user
    • CLI sysmaint
    • GUI user
    • GUI sysmaint
  • Aaron: Setting a non-English language in Calamares already sets the language for all of these scenarios in the installed system. Tested by doing an ISO installation of Kicksecure 18 with the langauge set to Spanish (Mexico). Spanish-translated strings were visible in all four session types. Admittedly, many strings were not translated, but that is likely simply a case of missing translations.

trixie port - qubes-core-agent-pcmanfm-qt

[edit]

kloak - systemd ordering cycle

[edit]
  • host: trixie (non-Kicksecure)
 [SKIP} kloak.service to stop ordering cycle loop 

graphical.target: Found ordering cycle on multi-user.target/start
graphical.target: Found dependency on kloak.service/start
graphical.target: Found dependency on graphical.target/start
graphical.target: Job kloak.service/start deleted to break ordering cycle starting with graphical.target/start
  • wild guess: related to removal of symlinks?
  • no more information available. Will hopefully be posted in the forums.
  • Aaron: Cannot reproduce on Debian 13 with GNOME Desktop, using the pre-v2 version of kloak. User may have added a configuration rule that attempted to require kloak to start before multi-user.service. Waiting on more info.
  • https://forums.whonix.org/t/kloak-latest-update-is-broken/22244archive.org iconarchive.today icon

ESP - EFI system partition versus dracut generic

[edit]
  • we're now using /etc/dracut.conf.d/30-dist-base-files.conf
compress="xz"
hostonly="yes"
hostonly_mode="sloppy"
  • Should we therefore increase the size of the ESP?
  • grml
  • calamares
  • Aaron: No changes needed to EFI partition size, dracut initramfs files are stored in /boot, not /boot/efi.
    • As discussed, boot partition doesn't need to be larger, it's 4 GB with Calamares and is integrated into the root partition on VM images.
    • grml-debootstrap is not interested in increasing the EFI partition size at this time, so I don't believe there's any reason to do this.
  • Patrick: Should have said /boot partition.
    • VMs: We are not using a separate /boot partition.
    • Host: Fedora increased /boot to 2 GBarchive.org iconarchive.today icon We're already using 4 GB for /boot when installing using calamares.
    • This issue does not exist.

bindp - compilation warning - _GNU_SOURCE redefined

[edit]
Setting up bindp (3:4.2-1) ...
/usr/lib/bindp.c:48:9: warning: "_GNU_SOURCE" redefined
   48 | #define _GNU_SOURCE
      |         ^~~~~~~~~~~
  • <command-line>: note: this is the location of the previous definition
  • Patrick: Merged.

install an onscreen keyboard by default

[edit]
  • todo
  • purpose: configuration a keyboard layout when not knowing how to enter some special character such as "=" on the keyboard using the local keyboard
  • related: On-Screen Keyboard
  • Aaron: Done, new commits pushed to developer-meta-files, kicksecure-meta-packages, and usability-misc for this.
  • Patrick: Merged.

trixie port - Whonix update failure if sys-whonix isn't already running

[edit]

change keyboard layout versus ISO

[edit]
  • currently, change keyboard layout required reboot but that is a contradiction on the ISO which cannot be rebooted
    • Aaron: I don't think keyboard layout changes require a reboot - if kloak isn't running, they take effect immediately after running labwc --reconfigure (which is automatically done by the newly created set-labwc-keymap script). If kloak is running, they take effect after kloak is restarted (which can be done even from a user session with Right Shift + Escape).
    • In the event a full compositor restart was needed to make a settings change take effect, logging out and logging back in would be sufficient to restart the compositor, even on the ISO.
  • https://github.com/labwc/labwc/issues/1407archive.org iconarchive.today icon
    • Aaron: This bug appears fixed in Trixie.

sysmaint-panel - new shortcuts

[edit]
  • add onscreen keyboard shortcut
  • add open display settings or open lxqt settings shortcut
  • Aaron: Implemented, pushed commits to usability-misc, helper-scripts, sysmaint-panel.
    • LXQt settings button will only appear in non-sysmaint sessions, as it is not useful and possibly misleading in sysmaint sessions.
  • Patrick: Merged.

sdwdate-gui - add left click menu

[edit]
  • usability bug: currently left click on sdwdate-gui does nothing
    • Aaron: Unfixable or at least extremely difficult to fix due to a combination of Wayland and Qt limitations.
    • Qt does not expose any API for popping up the menu the way a right-click pops it up. The only way to pop up a menu on a left-click is by using one of the exec() or popup() functions on the menu itself, which causes them to appear as a window in the middle of the screen under Wayland rather than them appearing as a popup menu.
    • Both Qt5 and Qt6 behave in the same way.
    • ChatGPT recommended using Gtk to create the context menu instead. A quick test revealed that Gtk has similar issues as Qt in this regard. I did not discover how to get a left-click to be registered by Gtk, documentation appears to be sparse and ChatGPT was not able to offer a functional suggestion.
    • I tried to see if it would be possible to use D-Bus to trigger the StatusNotifierItem associated with the QSystemTrayIcon to pop up a menu. The closest I was able to get to making this work simply popped up a window containing the menu in the middle of the screen.
    • The removable media and sound application icons seem to be left-clickable, but these are LXQt Panel plugins, not system tray icons. I suspect that's why they work, in which case that isn't a suitable solution for us.
    • It might be possible in the future to create an LXQt panel plugin for sdwdate_gui_server, but this would most likely require rewriting sdwdate_gui_server in C++, which I do not believe is practical at the moment.
    • For now, probably best to live with the issue, and make the time synchronization monitor popup specify "Right-click for menu" rather than "Click for menu".
    • Commit pushed to sdwdate-gui to change wording as described above.

labwc environment default configuration file

[edit]
  • if file ~/.config/labwc/environment does not exist, pre populate it with XKB_DEFAULT_LAYOUT= (and other useful settings?)
  • might not be needed if the tool below gets implemented
  • Aaron: Ignoring in favor of setxkbmap replacement tool, as suggested.

compiled code - remove unsafe sanitizers

[edit]
  • All sanitizers except minimal UBSan are unsafe to use in production, they may result in security vulnerabilities.
  • LSan is causing sclockadj to go into an infinite loop on exit for Marek.
  • Leave minimal UBSan runtime enabled, remove full UBSan and ASan from all code.
    • As it turns out, only Clang supports the minimal UBSan runtime, but we use GCC, so this is not possible. Just disable all sanitizers.
  • Adjust sanitizer flags in compiler flags wiki page.
  • Done, changed sdwdate, bindp, kloak, and security-misc to remove all sanitizers.

trixie port - misc remaining issues

[edit]
  • Aaron:
    • swaylock is configured to show a solid black screen. We may want to show something else so that the user knows the system isn't broken and is awaiting a password.
      • Turns out telling the user that the system is awaiting a password is impossible with Swaylock's current feature set. See https://github.com/swaywm/swaylock/issues/100archive.org iconarchive.today icon.
      • Asked Debian if they would be interested in us providing a patch to them, will likely contact the swaylock maintainer if that is confirmed as the correct next step.
      • Added background color / image configuration for now.
      • Swaylock has rejected further requests to allow displaying user-defined text on the lock screen, because they consider it an aesthetic feature and do not target a userbase that needs to be told that the lockscreen is waiting for them to type their password.
      • Debian has rejected an offer of a patch because the maintainer wants to stick with Swaylock upstream.
      • For now, we will likely just document how to unlock the screen and hope users don't get confused.
      • Documented: https://www.kicksecure.com/wiki/Protection_Against_Physical_Attacks#Screen_Lockarchive.org iconarchive.today icon
    • some systemcheck gripes need to be silenced, mostly just journal check stuff, but also the virtualizer check is "failing" on physical hardware because systemd-detect-virt returns non-zero if running on physical hardware. We probably shouldn't interpret that as failure.
      • Silenced a lot of these, but still have to build new VBox and KVM VMs to ensure all of them are silenced if possible.
      • Also fixed the virtualizer check.
    • Need to build the Qubes templates and make sure they actually work. I haven't tried to build a Qubes template even once so far. That's probably what I'm going to do now.
      • Kicksecure template built after some effort.
        • Need to submit changes to qubes-builderv2 so this works out of the box.
          • Somewhat done; Marek has changes in-flight that will do this for us.
        • Need to modify qubes-template-kicksecure to point to kicksecure-qubes-gui-lxqt package.
          • Done.
        • Need to modify qubes-template-kicksecure to point to trixie-developers repository.
          • Done.
        • Need to update template build documentation.
          • Done.
      • Whonix templates still need built.
    • Might be good to launch Flameshot on login, make it not show a "welcome" message when launched, and bind the Print Screen key so that it triggers the screenshot UI when pressed.
      • We've decided to simply document this for now, since Flameshot consumes 80+ MB memory at idle. TODO: Where should we document this?
        • Patrick: Software?
        • Aaron: Good, let's just stick with the existing documentation there.
    • We should be configuring PCManFM-Qt to not show graphical thumbnails. (PCManFM-Qt is also missing some of our distribution-specific configuration because of some odd behavior with configuration profiles, a symlink should be enough to solve that.)
      • Done, tested, works on physical hardware and Qubes OS.
    • In the sysmaint session, the battery status notification takes a long time to notice if AC power is plugged in or unplugged. Should be pretty easy to solve by just shortening the check interval to 5 seconds rather than the default of 60.
      • Done, tested, works on physical hardware.
    • We need to document how to configure the keyboard layout using labwc. At some point we may want to write a tool for this, it's just a matter of modifying a configuration file written in XML, and Python has built-in XML manipulation capabilities. They can't be used on untrusted XML, but the labwc configuration won't be untrusted.
      • Done.
    • CLI builds don't have enhanced zsh configuration yet. Not sure if we figured out what to do with that, I think we wanted to create a new package for this but haven't actually done so yet.
      • Fixed by Patrick.

browser-choice - consider using --no-install-recommends

[edit]
  • bug: Installing chromium from Debian package sources results in installing avahi and cups. Better sudo apt install --no-install-recommends chromium chromium-sandbox?
  • use --no-install-recommends whenever applicable
  • Patrick: Done.

kloak - core versus adapter split

[edit]

screenlocker backdoors

[edit]

trixie port - anon-ws-disable-stacked-tor apparmor issues

[edit]
  • apparmor fails to start if /etc/apparmor.d/abstractions/tor does not exist, but shipping this file in anon-ws-disable-stacked-tor results in upgrade problems because Tor is being installed by default on Whonix-Workstation 17
  • Patrick: Merged.
  • Aaron: Ended up removing this fix and replacing it with an if exists fix instead as discussed. Commits pushed to helper-scripts, systemcheck, and anon-ws-disable-stacked-tor for this.
  • Patrick: Merged.

privleap comment

[edit]

kloak - natural scrolling

[edit]

trixie port - browser-choice versus user-sysmaint-split

[edit]
  • user-sysmaint-split installed
  • Qubes Template
  • Kicksecure trixie based
  • Qubes R4.2
    • This may not be applicable to Qubes R4.3.
  • Also reproducible in Qubes R4.2 + bookworm based Kicksecure.
  • The following error message is not applicable:
You are currently running Browser Choice inside a user session. You will be unable to install most browsers from here; only browsers that install into the current user account will be installable. To install a browser, reboot, select PERSISTENT Mode| SYSMAINT Session | system maintenance tasks from the boot menu, and click Install a Browser in the System Maintenance Panel. See Sysmaint for more information.

You are currently running Browser Choice as a normal user. You will be unable to install most browsers from here; only browsers that install into the current user account will be installable. To install a browser, open a terminal in dom0, run qvm-run -u root VMNAME xfce4-terminal, then run browser-choice from that terminal. See Sysmaint for more information.

trixie port - adjust Qubes templates for LXQt

[edit]

unshare vs. ptrace

[edit]

trixie port - FDE systemcheck test passing incorrectly

[edit]

trixie port - wl-clipboard

[edit]

browser-choice - inside Qubes Template - prohibit starting browsers

[edit]

tirdad - improvements

[edit]

trixie port - usbguard - IPC connection failure

[edit]
  • Happening inside Qubes (R4.2) Template
IPC connection failure!IPC connect: service=usbguard: Operation not permitted

trixie port - KVM shared clipboard

[edit]

trixie port - VirtualBox shared clipboard

[edit]

remove unnecessary dependencies from arc-theme

[edit]
  • https://github.com/UbuntuBudgie/arc-theme/pull/2archive.org iconarchive.today icon
  • since upstream is unlikely to react, could you please send a patch to Debian instead if that seems possible/useful?
  • or perhaps a different, better theme? separate ticket: #desktop theme improvements
  • Aaron: Pinged Ubuntu Budgie upstream via Matrix, got a response, waiting to see how (or if) that develops. Debian is likely not the right place to override this unless we absolutely have to do that. In either event, the dependencies won't be removed until Forky at best.
  • Cancelled, we are not using the arc theme any longer.

qubes boot modes - GRUB in-vm kernel support

[edit]

trixie port - desktop theme improvements

[edit]
  • suggestions from https://forums.whonix.org/t/xfce-theming-a-few-suggestions/7205/82archive.org iconarchive.today icon valid?
  • useful to change the desktop theme?
  • Might be useful to postpone after port to trixie. After the first trixie based release. Because by that time, desktop environment choice (Xfce vs LXqt) and wayland should be settled. No point in improving Xfce based style in case of porting to LXQt.
  • Provided suggestions for improving Xfce theming and attempted to port the theming to LXQt. Should defer to Trixie.
  • Can be postponed after the first trixie based release.
  • Aaron: Mostly implemented as part of the port to LXQt, but we should entirely remote MATE's notification daemon in favor of LXQt's (this hasn't been done yet).
  • Aaron: This is now done and has been merged for a while.

trixie port - check compiled code

[edit]
  • does our compiled code still compile on trixie?
  • and compile time warnings to fix?
  • any new compile time hardening flags that should be used?
    • Perhaps our own compilation hardening wrapper would be useful?
  • this is mostly about kloak but may affect other compiled code
  • use -fanalyzer, where sensible.
  • For high effort, lower gain items, please create lower priority follow-up issues for post trixie.
    • Aaron: Documented compilation flags at Dev/compiler hardening
      • I seem to have messed up the page title... it says "compiler_hardening" rather than "compiler hardening" in the navbar. Is there a way to fix it?
        • Patrick: Fixed.
    • Aaron: Hardened sclockadj, bindp, and emerg-shutdown. kloak was hardened in earlier tasks. Did not harden tirdad yet, unsure if it's possible / safe to do so.
      • Patrick: Follow-up ticket created.
  • Patrick: All merged.
  • Patrick: Please try hardening-check and address, if applicable.
hardening-check /usr/libexec/sdwdate/sclockadj 
/usr/libexec/sdwdate/sclockadj:
 Position Independent Executable: yes
 Stack protected: yes
 Fortify Source functions: unknown, no protectable libc functions used
 Read-only relocations: yes
 Immediate binding: yes
 Stack clash protection: unknown, no -fstack-clash-protection instructions found
 Control flow integrity: no, not found!
 Branch Protection: no, not found!

trixie port - switch image viewer to loupe

[edit]
  • current default image viewer is Tor Browser, which is non-ideal
  • lximage-qt is potentially dangerous
  • loupe uses Glycin to load images, which is sandboxed and written in Rust, thus likely less vulnerable
  • Done, made changes to tb-starter, developer-meta-files, kicksecure-meta-packages, and anon-meta-packages to change this.
  • Patrick: Merged.

trixie port - physical hardware installation uses /dev path in grub.cfg

[edit]

trixie port - wlgreet autologin for sysmaint session broken on ISO

[edit]

trixie port - Kicksecure Qubes test

[edit]
  • install firmware-nonfree in Kicksecure Qubes. It's also default in Debian Qubes default Template.
    • Aaron: Package wpasupplicant also had to be installed to get Wi-Fi to work.
  • Does DNS work when using a Kicksecure 18 based sys-net?
    • Aaron: Yes, DNS seems fine. Was able to reach Google, Bing, Reddit, speedtest.net, and qubes-os.org at least.
  • sys-firewall ok?
    • Aaron: Yes, all connectivity from the AppVM used for testing went through sys-firewall and encountered no issues. Reconfiguring sys-firewall to block connections to everything except Wikipedia resulted in Wikipedia working but all other outgoing connectivity breaking, as expected. Undoing that configuration restored outgoing connectivity, as expected. Works both with WiFi and Ethernet.
  • Kicksecure Qubes internet speed versus Debian Internet speed?
    • Aaron: WiFi test results (using a Fedora 42 AppVM with Firefox):
      • With sys-net based on Kicksecure 18:
        • Test 1: 55.58 Mbps down, 2.08 Mbps up
        • Test 2: 54.86 Mbps down, 2.20 Mbps up
        • Test 3: 62.13 Mbps down, 2.25 Mbps up
      • With sys-net based on Debian 13:
        • Test 1: 51.89 Mbps down, 2.61 Mbps up
        • Test 2: 50.06 Mbps down, 2.68 Mbps up
        • Test 3: 45.32 Mbps down, 2.11 Mbps up
      • Conclusion: Likely no difference. Debian 13 appears slower than Kicksecure 18 in testing, but that is most likely due to speed fluctuations with my cellular Internet connectivity. Speeds seem coherent with the speeds I usually see with Ubuntu.
    • Aaron: Ethernet test results (using a Fedora 42 AppVM with Firefox):
      • With sys-net based on Kicksecure 18:
        • 18.59 Mbps down, 1.89 Mbps up
        • 19.91 Mbps down, 2.07 Mbps up
        • 18.39 Mbps down, 1.97 Mbps up
      • With sys-net based on Debian 13:
        • 20.58 Mbps down, 2.01 Mbps up
        • 20.95 Mbps down, 1.83 Mbps up
        • 20.29 Mbps down, 1.90 Mbps up
      • Conclusion: Likely no or relatively negligible difference. Debian 13 appears faster than Kicksecure 18 in testing, but again, this is probably because of network speed fluctuations on my end, and this is as good or better than speeds I was seeing using this link previously. (Note that because my hotspot's Ethernet support is buggy, I used NetworkManager internet connection sharing from another laptop with Ethernet, which is probably why this is so much slower than WiFi.)
  • Aaron: Should we be pre-installing wpasupplicant in some instances? It appears to be preinstalled in the Debian 13 template.
    • Patrick: Please install.
  • Patrick: Please look for other missing packages.
  • Aaron: Added wpasupplicant to Kicksecure for Qubes and baremetal.
  • Aaron: No additional packages were needed for wired networking to function properly.

trixie port - decrease touchpad sensitivity

[edit]

Footnotes

[edit]

Design Previous page: Dev/Developer Portal Index page: Design Next page: Dev/todo/archived

Notification image
Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 13 year success story and maybe DONATE!

Retrieved from "https://www.kicksecure.com/w/index.php?title=Dev/todo&oldid=103804"