Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Template builder generating non-working TemplateVMs #250

Closed
conorsch opened this issue Apr 15, 2019 · 2 comments · Fixed by #251
Closed

Template builder generating non-working TemplateVMs #250

conorsch opened this issue Apr 15, 2019 · 2 comments · Fixed by #251

Comments

@conorsch
Copy link
Contributor

conorsch commented Apr 15, 2019

Running make template inside this repository generates an RPM, which installs cleanly in dom0, but cannot be used as part of the SDW VM setup.

Symptoms

After installing, and on every start of the VM, Qubes throws a very scary warning about potential compromise:

securedrop-workstation-gui-effort

Current hypothesis is that the GUI event referenced in the warning message is related to the GUID logs. Compare the results from the old, circa 2018-10 RPM of the securedrop-workstation TemplateVM, with those from a newer version.

Qubes guest logs from 20181005
==> /var/log/qubes/guid.securedrop-workstation.log <==
Icon size: 128x128
libvchan_is_eof
Icon size: 128x128

==> /var/log/qubes/pacat.securedrop-workstation.log <==
Stream buffer attributes changed.ESC[K
Stream underrun.ESC[K
Stream started.ESC[K
Stream underrun.ESC[K
Stream started.ESC[K
Stream underrun.ESC[K
Stream started.ESC[K
Stream device alsa_input.pci-0000_00_1f.3.analog-stereo suspended.ESC[K
Stream cork
Stream buffer attributes changed.ESC[K

==> /var/log/qubes/qrexec.securedrop-workstation.log <==
eintr
libvchan_is_eof

==> /var/log/qubes/qubesdb.securedrop-workstation.log <==
terminating
vchan closed
reconnecting
vchan closed
vchan closed
reconnecting
vchan closed
vchan closed
reconnecting
vchan closed
Qubes guest logs from 20190412
==> /var/log/qubes/guid.securedrop-workstation.log <==
Icon size: 128x128
Verify failed: untrusted_hdr.type > MSG_MIN && untrusted_hdr.type < MSG_MAX
Gtk-Message: GtkDialog mapped without a transient parent. This is discouraged.
got unknown msg type 147

==> /var/log/qubes/pacat.securedrop-workstation.log <==
Connection established.ESC[K
Stream successfully created.
Buffer metrics: maxlength=4194304, tlength=15456, prebuf=14436, minreq=1024
Using sample spec 's16le 2ch 44100Hz', channel map 'front-left,front-right'.
Connected to device alsa_output.pci-0000_00_1f.3.analog-stereo (0, not suspended).
Stream successfully created.
Buffer metrics: maxlength=4194304, tlength=4096, prebuf=4294967295, minreq=4294967295
Using sample spec 's16le 2ch 44100Hz', channel map 'front-left,front-right'.
Connected to device alsa_input.pci-0000_00_1f.3.analog-stereo (1, not suspended).
Stream started.ESC[K

==> /var/log/qubes/qrexec.securedrop-workstation.log <==
eintr
eintr
eintr
eintr
eintr
eintr
libvchan_is_eof

==> /var/log/qubes/qubesdb.securedrop-workstation.log <==
vchan closed
reconnecting
vchan closed
terminating
vchan closed
reconnecting
vchan closed
vchan closed
reconnecting
vchan closed

Additionally, apps cannot run on the TemplateVM. For instance, qvm-run securedrop-workstation gnome-terminal does not start a terminal window. For comparison, qvm-run -p securedrop-workstation 'echo hello' does render output, confirming that the VM is indeed running, and can be connected to.

Steps to reproduce

  1. Run make template inside this repo
  2. Copy the RPM to dom0 (qvm-run -p sd-dev 'cat path/to/rpm' > qubes-template.rpm)
  3. Install RPM in dom0: sudo rpm -i qubes-template.rpm
  4. Set desired kernel settings: qvm-prefs -s securedrop-workstation virt_mode hvm && qvm-prefs -s securedrop-workstation kernel ''
  5. Observe scary GUI warning during install.
  6. Try to run a terminal, observe no terminal rendered: qvm-run securedrop-workstation gnome-terminal

Initial analysis

There's likely been divergence in the upstream Qubes template building logic that we must adapt to. It's worth noting that installing the old 20181004 template, then upgrading all packages to the latest and rebooting, does not show any of the above errors—further favoring the build logic as the likely culprit.

It would also be worth tracking down precisely which codepath generates the GUI warning shown above. It seems reasonable it's monitoring the GUID logs, embedded above, but haven't confirmed that yet.

Even when skipping the custom kernel steps in the test plan above, meaning the VM runs the Qubes-provided kernels, the problems persist.

@conorsch
Copy link
Contributor Author

@conorsch
Copy link
Contributor Author

conorsch commented May 8, 2019

@conorsch conorsch closed this as completed May 8, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant