diff --git a/Cargo.lock b/Cargo.lock index 134526f..883eb51 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2207,7 +2207,7 @@ dependencies = [ [[package]] name = "signer" -version = "0.0.16" +version = "0.0.17" dependencies = [ "base64", "chacha20poly1305", diff --git a/Cargo.toml b/Cargo.toml index 6e5233b..e1f7ea0 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "signer" -version = "0.0.16" +version = "0.0.17" edition = "2021" license = "MIT" description = "Attended Nostr signing daemon — Rust port of n_signer" diff --git a/qdiag.sh b/qdiag.sh new file mode 100755 index 0000000..c7d36b5 --- /dev/null +++ b/qdiag.sh @@ -0,0 +1,84 @@ +#!/bin/bash +# qdiag.sh — read-only Qubes dom0 diagnostics for SignerRpc qrexec issues. +# Run as root in dom0: sudo bash qdiag.sh +# Output: qdiag.txt in the current directory. No system changes are made. + +OUT="qdiag.txt" +: >"$OUT" + +sec() { printf '\n===== %s =====\n' "$1" >>"$OUT"; } +run() { printf '\n$ %s\n' "$*" >>"$OUT"; "$@" >>"$OUT" 2>&1 || true; } +runsh() { printf '\n$ %s\n' "$1" >>"$OUT"; bash -c "$1" >>"$OUT" 2>&1 || true; } + +sec "1. Identity / versions" +run hostname +run id +run uname -a +run cat /etc/qubes-release +run qubesctl --version +run rpm -q qubes-core-admin-linux qubes-core-qrexec 2>/dev/null + +sec "2. Qubes version detail" +run qvm-ls --raw-data --fields NAME,STATE,CLASS,TEMPLATE 2>/dev/null +run qvm-ls --running 2>/dev/null + +sec "3. Policy directories inventory" +run ls -la /etc/qubes/policy.d/ +run ls -la /etc/qubes-rpc/policy/ 2>/dev/null +run ls -la /usr/share/qubes/policy.d/ 2>/dev/null +run ls -la /etc/qubes-rpc/ 2>/dev/null + +sec "4. Policy file ownership/permissions" +runsh 'find /etc/qubes/policy.d /etc/qubes-rpc/policy /usr/share/qubes/policy.d -maxdepth 1 -type f -printf "%M %u:%g %s %p\n" 2>/dev/null | sort' + +sec "5. Symlinks in policy dirs" +runsh 'find /etc/qubes/policy.d /etc/qubes-rpc /etc/qubes-rpc/policy -maxdepth 2 -type l -printf "%p -> %l\n" 2>/dev/null' + +sec "6. Search for SignerRpc / nsigner / signer policy files" +runsh 'find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -iname "*signer*" -print 2>/dev/null | grep -vi "^/home" | head -50' +runsh 'grep -RIl "SignerRpc\|NsignerRpc\|nsigner" /etc/qubes /usr/share/qubes 2>/dev/null | head -30' + +sec "7. Policy contents (signer-related)" +runsh 'for f in $(grep -RIl "SignerRpc\|NsignerRpc\|nsigner\|signer" /etc/qubes/policy.d /etc/qubes-rpc/policy /usr/share/qubes/policy.d 2>/dev/null); do echo "--- $f ---"; cat "$f"; echo; done' + +sec "8. Clipboard policy contents" +runsh 'for f in $(grep -RIl "ClipboardPaste" /etc/qubes/policy.d /etc/qubes-rpc/policy /usr/share/qubes/policy.d 2>/dev/null); do echo "--- $f ---"; cat "$f"; echo; done' + +sec "9. Full policy.d listing with contents (all files)" +runsh 'for f in /etc/qubes/policy.d/*; do echo "--- $f ---"; cat "$f" 2>/dev/null; echo; done' + +sec "10. Effective policy query (if tools exist)" +runsh 'command -v qrexec-policy-graph && qrexec-policy-graph --include-ask 2>&1 | grep -iE "signer|clipboard" | head -30' +runsh 'command -v qvm-tags && qvm-tags dom0 2>/dev/null | head -20' + +sec "11. qrexec policy daemon status" +run systemctl status qrexec-policy-daemon --no-pager -l 2>&1 +run systemctl is-active qrexec-policy-daemon 2>&1 + +sec "12. Target qube info (nostr_signer)" +run qvm-ls --raw-data --fields NAME,STATE,CLASS,TEMPLATE,NETVM nostr_signer 2>/dev/null +run qvm-features nostr_signer 2>/dev/null +run qvm-prefs nostr_signer 2>/dev/null + +sec "13. Caller qube info (ai)" +run qvm-ls --raw-data --fields NAME,STATE,CLASS,TEMPLATE,NETVM ai 2>/dev/null +run qvm-features ai 2>/dev/null + +sec "14. Recent qrexec/policy journal errors" +runsh 'journalctl -b --no-pager 2>/dev/null | grep -iE "qrexec|policy|SignerRpc|NsignerRpc|clipboard" | tail -80' + +sec "15. qrexec service definitions in target qube (via qvm-run, read-only)" +runsh 'qvm-run -p nostr_signer "ls -la /etc/qubes-rpc/ 2>/dev/null; echo ---; ls -la /rw/config/qubes-rpc/ 2>/dev/null; echo ---; cat /rw/config/rc.local 2>/dev/null" 2>&1 | head -60' + +sec "16. Test qrexec call to nostr_signer (read-only get_info)" +runsh 'echo "{\"id\":\"diag\",\"method\":\"get_info\",\"params\":[]}" | timeout 10 qrexec-client-vm nostr_signer qubes.SignerRpc 2>&1; echo "exit=$?"' +runsh 'echo "{\"id\":\"diag\",\"method\":\"get_info\",\"params\":[]}" | timeout 10 qrexec-client-vm nostr_signer qubes.NsignerRpc 2>&1; echo "exit=$?"' + +sec "17. Qubes global config files" +runsh 'ls -la /etc/qubes/ | head -30' +runsh 'cat /etc/qubes/policy.d/50-config-input.policy 2>/dev/null' +runsh 'cat /etc/qubes/policy.d/50-config-updates.policy 2>/dev/null' + +sec "DONE" +printf 'Diagnostics complete. Output saved to %s\n' "$OUT" +exit 0 diff --git a/qdiag.txt b/qdiag.txt new file mode 100644 index 0000000..6d321d6 --- /dev/null +++ b/qdiag.txt @@ -0,0 +1,1445 @@ + +===== 1. Identity / versions ===== + +$ hostname +dom0 + +$ id +uid=0(root) gid=0(root) groups=0(root) + +$ uname -a +Linux dom0 6.12.59-1.qubes.fc41.x86_64 #1 SMP PREEMPT_DYNAMIC Sun Nov 30 10:39:00 UTC 2025 x86_64 GNU/Linux + +$ cat /etc/qubes-release +Qubes release 4.3.0 (R4.3) + +$ qubesctl --version +usage: qubesctl [-h] [--show-output] [--force-color] [--skip-dom0] + [--max-concurrency MAX_CONCURRENCY] [--skip-top-check] + [--sync-extmods] [--targets TARGETS | --all] [--templates] + [--standalones] [--app] + ... +qubesctl: error: unrecognized arguments: --version + +$ rpm -q qubes-core-admin-linux qubes-core-qrexec +package qubes-core-admin-linux is not installed +qubes-core-qrexec-4.3.11-1.fc41.x86_64 + +===== 2. Qubes version detail ===== + +$ qvm-ls --raw-data --fields NAME,STATE,CLASS,TEMPLATE +ai|Running|StandaloneVM|- +anon-whonix|Running|AppVM|whonix-workstation-18 +clearnet|Running|StandaloneVM|- +corn-whonix|Running|AppVM|whonix-workstation-18 +debian-13-xfce|Halted|TemplateVM|- +default-dvm|Halted|AppVM|debian-13-xfce +default-mgmt-dvm|Halted|AppVM|debian-13-xfce +disp870|Paused|DispVM|default-dvm +disp9124|Paused|DispVM|default-dvm +dom0|Running|AdminVM|- +fedora-42-xfce|Halted|TemplateVM|- +n-os-tr|Halted|StandaloneVM|- +nostr|Running|StandaloneVM|- +nostr_signer|Running|StandaloneVM|- +sys-fips|Halted|StandaloneVM|- +sys-firewall|Running|DispVM|default-dvm +sys-net|Running|AppVM|debian-13-xfce +sys-usb|Running|DispVM|default-dvm +sys-vpn-mullvad-app|Running|StandaloneVM|- +sys-whonix|Running|AppVM|whonix-gateway-18 +vault|Running|AppVM|debian-13-xfce +whonix-gateway-18|Halted|TemplateVM|- +whonix-workstation-18|Halted|TemplateVM|- +whonix-workstation-18-dvm|Halted|AppVM|whonix-workstation-18 + +$ qvm-ls --running +please wait... ................................................................................ +NAME STATE CLASS LABEL TEMPLATE NETVM +ai Running StandaloneVM orange - sys-vpn-mullvad-app +anon-whonix Running AppVM red whonix-workstation-18 sys-whonix +clearnet Running StandaloneVM purple - sys-firewall +corn-whonix Running AppVM red whonix-workstation-18 sys-whonix +dom0 Running AdminVM black - - +nostr Running StandaloneVM gray - sys-vpn-mullvad-app +nostr_signer Running StandaloneVM yellow - sys-vpn-mullvad-app +sys-firewall Running DispVM green default-dvm sys-net +sys-net Running AppVM red debian-13-xfce - +sys-usb Running DispVM red default-dvm - +sys-vpn-mullvad-app Running StandaloneVM red - sys-firewall +sys-whonix Running AppVM black whonix-gateway-18 sys-firewall +vault Running AppVM black debian-13-xfce - + +===== 3. Policy directories inventory ===== + +$ ls -la /etc/qubes/policy.d/ +total 80 +drwxrwxr-x 3 root qubes 4096 Aug 20 15:12 . +drwxr-xr-x 7 root root 4096 Mar 23 19:24 .. +-rw-rw-r-- 1 root root 674 Aug 30 2025 35-compat.policy +-rw-r--r-- 1 root root 284 Aug 20 14:45 45-signer.policy +-rw-r--r-- 1 root root 3 Aug 20 15:12 50-config-clipboard.policy +-rw-r--r-- 1 root root 150 Mar 23 20:00 50-config-input.policy +-rw-r--r-- 1 root root 129 Mar 23 19:59 50-config-updates.policy +-rw-rw-r-- 1 root qubes 2961 Dec 9 2025 80-whonix.policy +-rw-rw-r-- 1 root qubes 2261 Nov 8 2025 85-admin-backup-restore.policy +-rw-rw-r-- 1 root qubes 9075 Nov 8 2025 90-admin-default.policy +-rw-rw-r-- 1 root root 1197 Aug 30 2025 90-admin-policy-default.policy +-rw-r--r-- 1 root root 563 Oct 19 2025 90-default-gui-daemon.policy +-rw-rw-r-- 1 root qubes 227 Nov 4 2025 90-default-linux.policy +-rw-rw-r-- 1 root qubes 227 Oct 9 2025 90-default-pdf-convert.policy +-rw-rw-r-- 1 root qubes 6690 Nov 8 2025 90-default.policy +drwxrwxr-x 2 root qubes 4096 Mar 23 19:24 include +-rw-rw-r-- 1 root root 185 Aug 30 2025 README + +$ ls -la /etc/qubes-rpc/policy/ +total 24 +drwxrwsr-x 3 root qubes 4096 Aug 20 14:20 . +drwxr-xr-x 3 root root 12288 Aug 16 17:10 .. +drwxrwxr-x 2 root root 4096 Aug 30 2025 include +-rw-r--r-- 1 root qubes 12 Aug 20 14:20 qubes.SignerRpc + +$ ls -la /usr/share/qubes/policy.d/ +ls: cannot access '/usr/share/qubes/policy.d/': No such file or directory + +$ ls -la /etc/qubes-rpc/ +total 88 +drwxr-xr-x 3 root root 12288 Aug 16 17:10 . +drwxr-xr-x 112 root root 4096 Apr 27 07:31 .. +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.backup.Cancel -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.backup.Execute -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.backup.Info -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.deviceclass.List -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.Events -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.label.Create -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.label.Get -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.label.Index -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.label.List -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.label.Remove -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.Add -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.Info -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.List -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.ListDrivers -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.Remove -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.Set.ephemeral_volatile -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.Set.revisions_to_keep -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.UsageDetails -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.volume.Info -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.volume.List -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.volume.ListSnapshots -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.volume.Resize -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.volume.Revert -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.volume.Set.ephemeral -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.volume.Set.revisions_to_keep -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.volume.Set.rw -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.volume.Snapshot -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.property.Get -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.property.GetAll -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.property.GetDefault -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.property.Help -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.property.HelpRst -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.property.List -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.property.Reset -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.property.Set -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vmclass.List -> ../../var/run/qubesd.sock +-rwxr-xr-x 1 root root 705 Nov 8 2025 admin.vm.Console +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.Create.AppVM -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.CreateDisposable -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.Create.DispVM -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.CreateInPool.AppVM -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.CreateInPool.DispVM -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.CreateInPool.StandaloneVM -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.CreateInPool.TemplateVM -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.Create.StandaloneVM -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.Create.TemplateVM -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.CurrentState -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.block.Assign -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.block.Assigned -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.block.Attach -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.block.Attached -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.block.Available -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.block.Detach -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.block.Set.assignment -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.block.Unassign -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.denied.Add -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.denied.List -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.denied.Remove -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.mic.Assign -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.mic.Assigned -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.mic.Attach -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.mic.Attached -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.mic.Available -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.mic.Detach -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.mic.Set.assignment -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.mic.Unassign -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.pci.Assign -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.pci.Assigned -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.pci.Attach -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.pci.Attached -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.pci.Available -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.pci.Detach -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.pci.Set.assignment -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.pci.Unassign -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.usb.Assign -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.usb.Assigned -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.usb.Attach -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.usb.Attached -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.usb.Available -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.usb.Detach -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.usb.Set.assignment -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.usb.Unassign -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.feature.CheckWithAdminVM -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.feature.CheckWithNetvm -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.feature.CheckWithTemplate -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.feature.CheckWithTemplateAndAdminVM -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.feature.Get -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.feature.List -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.feature.Remove -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.feature.Set -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.firewall.Flush -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.firewall.Get -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.firewall.GetPolicy -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.firewall.Reload -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.firewall.Set -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.firewall.SetPolicy -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.Kill -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.List -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.notes.Get -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.notes.Set -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.Pause -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.property.Get -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.property.GetAll -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.property.GetDefault -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.property.Help -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.property.HelpRst -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.property.List -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.property.Reset -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.property.Set -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.Remove -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.Shutdown -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.Start -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.Stats -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.tag.Get -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.tag.List -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.tag.Remove -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.tag.Set -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.Unpause -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.volume.Clear -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.volume.CloneFrom -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.volume.CloneTo -> ../../var/run/qubesd.sock +-rwxr-xr-x 1 root root 3543 Nov 8 2025 admin.vm.volume.Import +lrwxrwxrwx 1 root root 22 Nov 8 2025 admin.vm.volume.ImportWithSize -> admin.vm.volume.Import +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.volume.Info -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.volume.List -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.volume.ListSnapshots -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.volume.Resize -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.volume.Revert -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.volume.Set.ephemeral -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.volume.Set.revisions_to_keep -> ../../var/run/qubesd.sock +lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.volume.Set.rw -> ../../var/run/qubesd.sock +drwxrwsr-x 3 root qubes 4096 Aug 20 14:20 policy +lrwxrwxrwx 1 root root 32 Aug 30 2025 policy.Ask -> /var/run/qubes/policy-agent.sock +srw-rw---- 1 root qubes 0 Aug 16 17:10 policy.EvalGUI +srw-rw---- 1 root qubes 0 Aug 16 17:10 policy.EvalSimple +lrwxrwxrwx 1 root root 27 Aug 30 2025 policy.Get -> /usr/bin/qubes-policy-admin +lrwxrwxrwx 1 root root 27 Aug 30 2025 policy.GetFiles -> /usr/bin/qubes-policy-admin +lrwxrwxrwx 1 root root 27 Aug 30 2025 policy.include.Get -> /usr/bin/qubes-policy-admin +lrwxrwxrwx 1 root root 27 Aug 30 2025 policy.include.List -> /usr/bin/qubes-policy-admin +lrwxrwxrwx 1 root root 27 Aug 30 2025 policy.include.Remove -> /usr/bin/qubes-policy-admin +lrwxrwxrwx 1 root root 27 Aug 30 2025 policy.include.Replace -> /usr/bin/qubes-policy-admin +lrwxrwxrwx 1 root root 27 Aug 30 2025 policy.List -> /usr/bin/qubes-policy-admin +lrwxrwxrwx 1 root root 32 Aug 30 2025 policy.Notify -> /var/run/qubes/policy-agent.sock +-rwxr-xr-x 1 root root 5217 Aug 30 2025 policy.RegisterArgument +lrwxrwxrwx 1 root root 27 Aug 30 2025 policy.Remove -> /usr/bin/qubes-policy-admin +lrwxrwxrwx 1 root root 27 Aug 30 2025 policy.Replace -> /usr/bin/qubes-policy-admin +-rwxr-xr-x 1 root root 234 Nov 8 2025 qubes.ConnectTCP +-rwxr-xr-x 1 root root 162 Nov 8 2025 qubes.FeaturesRequest +-rwxr-xr-x 1 root root 1780 Nov 8 2025 qubes.GetDate +-rwxr-xr-x 1 root root 2165 Nov 8 2025 qubes.GetRandomizedTime +-rwxr-xr-x 1 root root 63 Nov 12 2025 qubes.InputKeyboard +-rwxr-xr-x 1 root root 52 Nov 12 2025 qubes.InputMouse +-rwxr-xr-x 1 root root 61 Nov 12 2025 qubes.InputTablet +lrwxrwxrwx 1 root root 45 Dec 2 2025 qubes.Notifications -> ../../usr/bin/qubes-notification-proxy-server +-rwxr-xr-x 1 root root 158 Nov 8 2025 qubes.NotifyTools +-rwxr-xr-x 1 root root 157 Nov 8 2025 qubes.NotifyUpdates +lrwxrwxrwx 1 root root 45 Nov 4 2025 qubes.ReceiveUpdates -> ../../usr/libexec/qubes/qubes-receive-updates +-rwxr-xr-x 1 root root 377 Oct 9 2025 qubes.RemoveAppMenusFor +lrwxrwxrwx 1 root root 49 Nov 4 2025 qubes.repos.Disable -> ../../usr/lib/qubes/qubes-rpc/qubes.repos.Disable +lrwxrwxrwx 1 root root 48 Nov 4 2025 qubes.repos.Enable -> ../../usr/lib/qubes/qubes-rpc/qubes.repos.Enable +lrwxrwxrwx 1 root root 46 Nov 4 2025 qubes.repos.List -> ../../usr/lib/qubes/qubes-rpc/qubes.repos.List +-rwxr-xr-x 1 root root 258 Oct 9 2025 qubes.SyncAppMenus +-rwxr-xr-x 1 root root 393 Oct 9 2025 qubes.UpdateAppMenusFor +-rwxr-xr-x 1 root root 921 Aug 30 2025 qubes.WaitForSession +lrwxrwxrwx 1 root root 33 Oct 19 2025 qubes.WindowIconUpdater -> /var/run/qubes/icon-receiver.sock + +===== 4. Policy file ownership/permissions ===== + +$ find /etc/qubes/policy.d /etc/qubes-rpc/policy /usr/share/qubes/policy.d -maxdepth 1 -type f -printf "%M %u:%g %s %p\n" 2>/dev/null | sort +-rw-r--r-- root:qubes 12 /etc/qubes-rpc/policy/qubes.SignerRpc +-rw-r--r-- root:root 129 /etc/qubes/policy.d/50-config-updates.policy +-rw-r--r-- root:root 150 /etc/qubes/policy.d/50-config-input.policy +-rw-r--r-- root:root 284 /etc/qubes/policy.d/45-signer.policy +-rw-r--r-- root:root 3 /etc/qubes/policy.d/50-config-clipboard.policy +-rw-r--r-- root:root 563 /etc/qubes/policy.d/90-default-gui-daemon.policy +-rw-rw-r-- root:qubes 2261 /etc/qubes/policy.d/85-admin-backup-restore.policy +-rw-rw-r-- root:qubes 227 /etc/qubes/policy.d/90-default-linux.policy +-rw-rw-r-- root:qubes 227 /etc/qubes/policy.d/90-default-pdf-convert.policy +-rw-rw-r-- root:qubes 2961 /etc/qubes/policy.d/80-whonix.policy +-rw-rw-r-- root:qubes 6690 /etc/qubes/policy.d/90-default.policy +-rw-rw-r-- root:qubes 9075 /etc/qubes/policy.d/90-admin-default.policy +-rw-rw-r-- root:root 1197 /etc/qubes/policy.d/90-admin-policy-default.policy +-rw-rw-r-- root:root 185 /etc/qubes/policy.d/README +-rw-rw-r-- root:root 674 /etc/qubes/policy.d/35-compat.policy + +===== 5. Symlinks in policy dirs ===== + +$ find /etc/qubes/policy.d /etc/qubes-rpc /etc/qubes-rpc/policy -maxdepth 2 -type l -printf "%p -> %l\n" 2>/dev/null +/etc/qubes-rpc/admin.vm.device.usb.Available -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.volume.Set.ephemeral -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.mic.Attach -> ../../var/run/qubesd.sock +/etc/qubes-rpc/policy.List -> /usr/bin/qubes-policy-admin +/etc/qubes-rpc/admin.vm.device.mic.Unassign -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.property.Help -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.label.List -> ../../var/run/qubesd.sock +/etc/qubes-rpc/policy.Notify -> /var/run/qubes/policy-agent.sock +/etc/qubes-rpc/policy.include.List -> /usr/bin/qubes-policy-admin +/etc/qubes-rpc/admin.vm.CreateInPool.DispVM -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.pool.volume.Set.rw -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.pool.volume.List -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.backup.Execute -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.property.List -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.pci.Unassign -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.Start -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.label.Get -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.pci.Attached -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.CurrentState -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.pool.volume.Set.revisions_to_keep -> ../../var/run/qubesd.sock +/etc/qubes-rpc/qubes.repos.Enable -> ../../usr/lib/qubes/qubes-rpc/qubes.repos.Enable +/etc/qubes-rpc/qubes.repos.Disable -> ../../usr/lib/qubes/qubes-rpc/qubes.repos.Disable +/etc/qubes-rpc/admin.property.List -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.label.Create -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.usb.Unassign -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.volume.Info -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.firewall.GetPolicy -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.volume.ImportWithSize -> admin.vm.volume.Import +/etc/qubes-rpc/admin.vm.feature.CheckWithNetvm -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.Create.StandaloneVM -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.block.Assign -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.volume.Clear -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.usb.Set.assignment -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.block.Available -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.Remove -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.usb.Assign -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.Create.DispVM -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.property.Reset -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.CreateInPool.StandaloneVM -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.pool.Set.revisions_to_keep -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.Pause -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.firewall.SetPolicy -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.volume.List -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.CreateInPool.AppVM -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.notes.Get -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.volume.Resize -> ../../var/run/qubesd.sock +/etc/qubes-rpc/policy.GetFiles -> /usr/bin/qubes-policy-admin +/etc/qubes-rpc/qubes.ReceiveUpdates -> ../../usr/libexec/qubes/qubes-receive-updates +/etc/qubes-rpc/admin.pool.volume.Info -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.pci.Assign -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.property.GetDefault -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.pool.volume.Resize -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.pool.Info -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.Kill -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.property.HelpRst -> ../../var/run/qubesd.sock +/etc/qubes-rpc/policy.include.Remove -> /usr/bin/qubes-policy-admin +/etc/qubes-rpc/admin.property.HelpRst -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.tag.Get -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.feature.Get -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.property.Set -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.property.GetDefault -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.tag.Set -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.usb.Detach -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.mic.Detach -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.backup.Cancel -> ../../var/run/qubesd.sock +/etc/qubes-rpc/policy.include.Get -> /usr/bin/qubes-policy-admin +/etc/qubes-rpc/admin.vm.volume.Set.rw -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.volume.Set.revisions_to_keep -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.property.Set -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.CreateInPool.TemplateVM -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.property.Get -> ../../var/run/qubesd.sock +/etc/qubes-rpc/policy.Ask -> /var/run/qubes/policy-agent.sock +/etc/qubes-rpc/admin.vm.Shutdown -> ../../var/run/qubesd.sock +/etc/qubes-rpc/policy.Remove -> /usr/bin/qubes-policy-admin +/etc/qubes-rpc/admin.pool.Remove -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.property.GetAll -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.property.GetAll -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.Stats -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.pool.volume.ListSnapshots -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.mic.Assign -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.notes.Set -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.pci.Attach -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.firewall.Set -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.usb.Attach -> ../../var/run/qubesd.sock +/etc/qubes-rpc/qubes.WindowIconUpdater -> /var/run/qubes/icon-receiver.sock +/etc/qubes-rpc/admin.vm.feature.Remove -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.usb.Assigned -> ../../var/run/qubesd.sock +/etc/qubes-rpc/qubes.repos.List -> ../../usr/lib/qubes/qubes-rpc/qubes.repos.List +/etc/qubes-rpc/admin.vm.firewall.Get -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.feature.CheckWithTemplateAndAdminVM -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.pool.ListDrivers -> ../../var/run/qubesd.sock +/etc/qubes-rpc/policy.include.Replace -> /usr/bin/qubes-policy-admin +/etc/qubes-rpc/admin.Events -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.mic.Set.assignment -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.pool.volume.Set.ephemeral -> ../../var/run/qubesd.sock +/etc/qubes-rpc/qubes.Notifications -> ../../usr/bin/qubes-notification-proxy-server +/etc/qubes-rpc/admin.vm.device.mic.Attached -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.backup.Info -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.volume.CloneFrom -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.List -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.volume.CloneTo -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.pool.Add -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.pool.List -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.denied.Remove -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.volume.Revert -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.feature.List -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.pool.Set.ephemeral_volatile -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.property.Reset -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.block.Attach -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.tag.Remove -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.feature.Set -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.mic.Assigned -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.block.Set.assignment -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.mic.Available -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vmclass.List -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.pool.volume.Snapshot -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.pci.Assigned -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.label.Index -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.denied.List -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.deviceclass.List -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.CreateDisposable -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.pool.volume.Revert -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.denied.Add -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.feature.CheckWithTemplate -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.tag.List -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.Unpause -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.feature.CheckWithAdminVM -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.block.Detach -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.block.Unassign -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.property.Get -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.firewall.Reload -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.block.Assigned -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.pci.Available -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.usb.Attached -> ../../var/run/qubesd.sock +/etc/qubes-rpc/policy.Get -> /usr/bin/qubes-policy-admin +/etc/qubes-rpc/admin.property.Help -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.label.Remove -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.pci.Detach -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.Create.AppVM -> ../../var/run/qubesd.sock +/etc/qubes-rpc/policy.Replace -> /usr/bin/qubes-policy-admin +/etc/qubes-rpc/admin.pool.UsageDetails -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.block.Attached -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.firewall.Flush -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.Create.TemplateVM -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.volume.ListSnapshots -> ../../var/run/qubesd.sock +/etc/qubes-rpc/admin.vm.device.pci.Set.assignment -> ../../var/run/qubesd.sock + +===== 6. Search for SignerRpc / nsigner / signer policy files ===== + +$ find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -iname "*signer*" -print 2>/dev/null | grep -vi "^/home" | head -50 +/var/log/qubes/qubesdb.n_signer.log +/var/log/qubes/qrexec.n_signer.log +/var/log/qubes/qubesdb.nostr_signer.log +/var/log/qubes/update-nostr_signer.log +/var/log/qubes/guid.n_signer.log +/var/log/qubes/guid.nostr_signer.log +/var/log/qubes/qrexec.nostr_signer.log +/var/log/qubes/guid.nostr_signer.log.old +/var/log/libvirt/libxl/n_signer.log +/var/log/libvirt/libxl/nostr_signer.log +/var/log/xen/console/guest-nostr_signer.log +/var/log/xen/console/guest-n_signer.log-20260510.gz +/var/log/xen/console/guest-nostr_signer.log-20260816.gz +/var/log/xen/console/guest-nostr_signer.log-20260809.gz +/var/log/xen/console/guest-n_signer.log +/var/log/xen/console/guest-nostr_signer.log-20260726.gz +/var/log/xen/console/guest-nostr_signer.log-20260802.gz +/var/lib/qubes/appvms/nostr_signer +/usr/lib64/python3.13/site-packages/PyQt6/QtDesigner.pyi +/usr/lib64/python3.13/site-packages/PyQt6/lupdate/designer_source.py +/usr/lib64/python3.13/site-packages/PyQt6/lupdate/__pycache__/designer_source.cpython-313.pyc +/usr/lib64/python3.13/site-packages/PyQt6/lupdate/__pycache__/designer_source.cpython-313.opt-1.pyc +/usr/lib64/python3.13/site-packages/PyQt6/QtDesigner.abi3.so +/usr/lib64/cmake/Qt6Designer +/usr/lib64/libQt6Designer.so.6.8.3 +/usr/lib64/qt6/plugins/designer +/usr/lib64/qt6/qml/QtQuick3D/AssetUtils/designer +/usr/lib64/qt6/qml/QtQuick3D/ParticleEffects/designer +/usr/lib64/qt6/qml/QtQuick3D/Effects/designer +/usr/lib64/qt6/qml/QtQuick3D/Helpers/designer +/usr/lib64/qt6/qml/QtQuick3D/Particles3D/designer +/usr/lib64/qt6/qml/QtQuick3D/designer +/usr/lib64/qt6/qml/QtQuick/Controls/designer +/usr/lib64/libQt6Designer.so.6 +/usr/share/mime/application/x-designer.xml +/usr/share/icons/Mint-X/mimetypes/24/application-x-designer.png +/usr/share/icons/Mint-X/mimetypes/24/gnome-mime-application-x-designer.png +/usr/share/icons/Mint-X/mimetypes/16/application-x-designer.png +/usr/share/icons/Mint-X/mimetypes/16/gnome-mime-application-x-designer.png +/usr/share/icons/Mint-X/mimetypes/32/application-x-designer.png +/usr/share/icons/Mint-X/mimetypes/32/gnome-mime-application-x-designer.png +/usr/share/icons/Mint-X/mimetypes/48/application-x-designer.png +/usr/share/icons/Mint-X/mimetypes/48/gnome-mime-application-x-designer.png +/usr/share/icons/Mint-X/mimetypes/96/application-x-designer.svg +/usr/share/icons/Mint-X/mimetypes/96/gnome-mime-application-x-designer.svg +/usr/share/icons/Mint-X/mimetypes/22/application-x-designer.png +/usr/share/icons/Mint-X/mimetypes/22/gnome-mime-application-x-designer.png +/usr/share/icons/Mint-X/apps/24/qtdesigner.png +/usr/share/icons/Mint-X/apps/24/designer.png +/usr/share/icons/Mint-X/apps/16/qtdesigner.png + +$ grep -RIl "SignerRpc\|NsignerRpc\|nsigner" /etc/qubes /usr/share/qubes 2>/dev/null | head -30 +/etc/qubes/policy.d/45-signer.policy + +===== 7. Policy contents (signer-related) ===== + +$ for f in $(grep -RIl "SignerRpc\|NsignerRpc\|nsigner\|signer" /etc/qubes/policy.d /etc/qubes-rpc/policy /usr/share/qubes/policy.d 2>/dev/null); do echo "--- $f ---"; cat "$f"; echo; done +--- /etc/qubes/policy.d/45-signer.policy --- +# Qubes OS qrexec policy for signer +qubes.SignerRpc * ai @tag:signer-signer allow target=nostr_signer +qubes.SignerRpc * nostr @tag:signer-signer allow target=nostr_signer +qubes.SignerRpc * @anyvm @tag:signer-signer ask default_target=nostr_signer +qubes.SignerRpc * @anyvm @anyvm deny + + +===== 8. Clipboard policy contents ===== + +$ for f in $(grep -RIl "ClipboardPaste" /etc/qubes/policy.d /etc/qubes-rpc/policy /usr/share/qubes/policy.d 2>/dev/null); do echo "--- $f ---"; cat "$f"; echo; done +--- /etc/qubes/policy.d/90-default-gui-daemon.policy --- +## Note that policy parsing stops at the first match, +## so adding anything below "@anyvm @anyvm action" line will have no effect +## +## Clipboard paste (Ctrl-Shift-V) will treat "ask" as "allow" but only when +## called by this keyboard shortcut. "deny" always denies the operation. + +## Please use a single # to start your custom comments + +qubes.ClipboardPaste * @adminvm @anyvm ask +qubes.ClipboardPaste * @anyvm @anyvm ask + +# The default policy handles only GUI in dom0. GUIVM needs similar line in its +# policy too. +qubes.WindowIconUpdater * @anyvm dom0 allow + + +===== 9. Full policy.d listing with contents (all files) ===== + +$ for f in /etc/qubes/policy.d/*; do echo "--- $f ---"; cat "$f" 2>/dev/null; echo; done +--- /etc/qubes/policy.d/35-compat.policy --- +# +# NOTE: +# +# The following line enables compatibility mode. It reads files in old directory +# (/etc/qubes-rpc/policy). It also generates deny rules that were previously +# implicit after each file, but they are added only after policies for specific +# arguments, that is, for files with '+' in the name. For generic files, without +# '+', no such rules are generated and the control "falls through", which is +# a departure from previous semantics. It is done that way not to shadow the +# default rules. +# +# The "!compat-4.0" directive is transitional only and will be unavailable in +# next major release (R5.0). This file will be removed in that release also. +# + +!compat-4.0 + +--- /etc/qubes/policy.d/45-signer.policy --- +# Qubes OS qrexec policy for signer +qubes.SignerRpc * ai @tag:signer-signer allow target=nostr_signer +qubes.SignerRpc * nostr @tag:signer-signer allow target=nostr_signer +qubes.SignerRpc * @anyvm @tag:signer-signer ask default_target=nostr_signer +qubes.SignerRpc * @anyvm @anyvm deny + +--- /etc/qubes/policy.d/50-config-clipboard.policy --- +# + + +--- /etc/qubes/policy.d/50-config-input.policy --- +qubes.InputMouse * sys-usb dom0 allow +qubes.InputKeyboard * sys-usb dom0 allow +# not configurable by this state +qubes.InputTablet * sys-usb dom0 deny + +--- /etc/qubes/policy.d/50-config-updates.policy --- +qubes.UpdatesProxy * @tag:whonix-updatevm @default allow target=sys-whonix +qubes.UpdatesProxy * @tag:whonix-updatevm @anyvm deny + +--- /etc/qubes/policy.d/80-whonix.policy --- +## Do not modify this file, create a new policy file with a lower number in the +## filename instead. For example `30-user.policy`. + +# service arg source target action params + +sdwdate-gui.Connect * @tag:sdwdate-gui-client @tag:sdwdate-gui-server allow autostart=no notify=no +sdwdate-gui.ConnectCheck * @tag:sdwdate-gui-client @tag:sdwdate-gui-server allow autostart=no notify=no + +sdwdate-gui.Connect * @anyvm @anyvm deny +sdwdate-gui.ConnectCheck * @anyvm @anyvm deny + +# Legacy, all of these services should effectively be no-ops for fully updated +# Whonix-Gateway and Whonix-Workstation qubes. +sdwdate.Connect * @tag:sdwdate-gui-client @tag:sdwdate-gui-server allow autostart=no notify=no +sdwdate.ConnectCheck * @tag:sdwdate-gui-client @tag:sdwdate-gui-server allow autostart=no notify=no + +sdwdate.Connect * @anyvm @anyvm deny +sdwdate.ConnectCheck * @anyvm @anyvm deny + +whonix.SdwdateStatus + @tag:anon-gateway @tag:anon-vm allow autostart=no notify=no +whonix.SdwdateStatus + @tag:anon-gateway @default deny notify=no +whonix.SdwdateStatus + @anyvm @anyvm deny + +whonix.NewStatus * @tag:anon-vm @tag:anon-gateway allow autostart=no +whonix.NewStatus * @anyvm @anyvm deny + +whonix.GatewayCommand +restart @tag:anon-gateway @tag:anon-vm allow autostart=no +whonix.GatewayCommand +stop @tag:anon-gateway @tag:anon-vm allow autostart=no +whonix.GatewayCommand +showlog @tag:anon-gateway @tag:anon-vm allow autostart=no +whonix.GatewayCommand * @anyvm @anyvm deny + +# Harden against potential IP leaks by not allowing a compromised +# Whonix-Workstation to open files, URLs, or applications in VMs other than +# Whonix-Workstation VMs (typically DispVMs). +qubes.OpenInVM * @tag:anon-vm @dispvm ask default_target=@dispvm +qubes.OpenInVM * @tag:anon-vm @tag:anon-vm ask +qubes.OpenInVM * @tag:anon-vm @default ask +qubes.OpenInVM * @tag:anon-vm @anyvm deny + +qubes.OpenURL * @tag:anon-vm @dispvm ask default_target=@dispvm +qubes.OpenURL * @tag:anon-vm @tag:anon-vm ask +qubes.OpenURL * @tag:anon-vm @default ask +qubes.OpenURL * @tag:anon-vm @anyvm deny + +qubes.StartApp * @tag:anon-vm @dispvm ask default_target=@dispvm +qubes.StartApp * @tag:anon-vm @tag:anon-vm ask +qubes.StartApp * @tag:anon-vm @default ask +qubes.StartApp * @tag:anon-vm @anyvm deny + +--- /etc/qubes/policy.d/85-admin-backup-restore.policy --- +## File format: +## service-name|* +argument|* source destination action [options] + +## Allow selected DisposableVM perform "paranoid backup restore" +admin.vm.Create.AppVM * @tag:backup-restore-mgmt dom0 allow target=dom0 +admin.vm.Create.StandaloneVM * @tag:backup-restore-mgmt dom0 allow target=dom0 +admin.vm.Create.TemplateVM * @tag:backup-restore-mgmt dom0 allow target=dom0 +admin.vm.List * @tag:backup-restore-mgmt dom0 allow target=dom0 +## Allow checking some basic info about all the VMs, to propose conflicts resolution +admin.vm.List * @tag:backup-restore-mgmt @anyvm allow target=dom0 +admin.vm.property.Get +provides_network @tag:backup-restore-mgmt @anyvm allow target=dom0 +admin.vm.property.Get +template_for_dispvms @tag:backup-restore-mgmt @anyvm allow target=dom0 + +## Allow it to configure just created qubes +admin.vm.feature.Set * @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0 +admin.vm.firewall.Set * @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0 +admin.vm.property.Set * @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0 +admin.vm.tag.Set * @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0 +admin.vm.volume.Import * @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0 +admin.vm.volume.ImportWithSize * @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0 +admin.vm.volume.Info * @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0 +admin.vm.volume.List * @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0 +admin.vm.volume.Set.revisions_to_keep * @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0 + +## And finally, allow it to retrieve the actual backup +qubes.RestoreById * @tag:backup-restore-mgmt @tag:backup-restore-storage allow + + +--- /etc/qubes/policy.d/90-admin-default.policy --- +## Do not modify this file, create a new policy file with a lower number in the +## filename instead. For example `30-admin-user.policy`. + +### +### Default Admin API qrexec policy +### + +## WARNING: most qrexec services here allows a qube to control system +## configuration. It should be allowed only to trusted qubes. + +## Remember to add "target=dom0" option to any (allow/ask) entry you create. + +## For convenience of maintaining this policy, all services include one of: +## - include/admin-local-rwx (services to modify a specific qube configuration) +## - include/admin-local-ro (services to read a specific qube configuration) +## - include/admin-global-rwx (services to modify global parameters) +## - include/admin-global-ro (services to read global parameters) + +!include-service admin.vm.Console * include/admin-local-rwx +!include-service admin.vm.volume.Import * include/admin-local-rwx +!include-service admin.vm.volume.ImportWithSize * include/admin-local-rwx + +!include-service admin.vm.device.mic.Assign * include/admin-local-rwx +!include-service admin.vm.device.mic.Assigned * include/admin-local-ro +!include-service admin.vm.device.mic.Attach * include/admin-local-rwx +!include-service admin.vm.device.mic.Attached * include/admin-local-ro +!include-service admin.vm.device.mic.Available * include/admin-local-ro +!include-service admin.vm.device.mic.Detach * include/admin-local-rwx +!include-service admin.vm.device.mic.Set.assignment * include/admin-local-rwx +!include-service admin.vm.device.mic.Unassign * include/admin-local-rwx +!include-service admin.vm.device.usb.Assign * include/admin-local-rwx +!include-service admin.vm.device.usb.Assigned * include/admin-local-ro +!include-service admin.vm.device.usb.Attach * include/admin-local-rwx +!include-service admin.vm.device.usb.Attached * include/admin-local-ro +!include-service admin.vm.device.usb.Available * include/admin-local-ro +!include-service admin.vm.device.usb.Detach * include/admin-local-rwx +!include-service admin.vm.device.usb.Set.assignment * include/admin-local-rwx +!include-service admin.vm.device.usb.Unassign * include/admin-local-rwx + +!include-service admin.backup.Cancel * include/admin-global-rwx +!include-service admin.backup.Execute * include/admin-global-rwx +!include-service admin.backup.Info * include/admin-local-ro +!include-service admin.vm.CreateDisposable * include/admin-global-rwx +!include-service admin.deviceclass.List * include/admin-global-ro +!include-service admin.Events * include/admin-global-ro +!include-service admin.label.Create * include/admin-global-rwx +!include-service admin.label.Get * include/admin-global-ro +!include-service admin.label.Index * include/admin-global-ro +!include-service admin.label.List * include/admin-global-ro +!include-service admin.label.Remove * include/admin-global-rwx +!include-service admin.pool.Add * include/admin-global-rwx +!include-service admin.pool.Info * include/admin-global-ro +!include-service admin.pool.List * include/admin-global-ro +!include-service admin.pool.ListDrivers * include/admin-global-ro +!include-service admin.pool.Remove * include/admin-global-rwx +!include-service admin.pool.Set.ephemeral_volatile * include/admin-global-rwx +!include-service admin.pool.Set.revisions_to_keep * include/admin-global-rwx +!include-service admin.pool.UsageDetails * include/admin-global-ro +!include-service admin.pool.volume.List * include/admin-global-ro +!include-service admin.property.Get * include/admin-global-ro +!include-service admin.property.GetAll * include/admin-global-ro +!include-service admin.property.GetDefault * include/admin-global-ro +!include-service admin.property.Help * include/admin-global-ro +!include-service admin.property.List * include/admin-global-ro +!include-service admin.property.Reset * include/admin-global-rwx +!include-service admin.property.Set * include/admin-global-rwx +!include-service admin.vm.Console * include/admin-local-rwx +!include-service admin.vm.Create.AppVM * include/admin-global-rwx +!include-service admin.vm.Create.DispVM * include/admin-global-rwx +!include-service admin.vm.Create.RemoteVM * include/admin-global-rwx +!include-service admin.vm.Create.StandaloneVM * include/admin-global-rwx +!include-service admin.vm.Create.TemplateVM * include/admin-global-rwx +!include-service admin.vm.CreateInPool.AppVM * include/admin-global-rwx +!include-service admin.vm.CreateInPool.DispVM * include/admin-global-rwx +!include-service admin.vm.CreateInPool.RemoteVM * include/admin-global-rwx +!include-service admin.vm.CreateInPool.StandaloneVM * include/admin-global-rwx +!include-service admin.vm.CreateInPool.TemplateVM * include/admin-global-rwx +!include-service admin.vm.CurrentState * include/admin-local-ro +!include-service admin.vm.device.block.Assign * include/admin-local-rwx +!include-service admin.vm.device.pci.Assign * include/admin-local-rwx +!include-service admin.vm.device.block.Attach * include/admin-local-rwx +!include-service admin.vm.device.pci.Attach * include/admin-local-rwx +!include-service admin.vm.device.block.Attached * include/admin-local-ro +!include-service admin.vm.device.pci.Attached * include/admin-local-ro +!include-service admin.vm.device.block.Available * include/admin-local-ro +!include-service admin.vm.device.pci.Available * include/admin-local-ro +!include-service admin.vm.device.denied.Add * include/admin-local-rwx +!include-service admin.vm.device.denied.List * include/admin-local-ro +!include-service admin.vm.device.denied.Remove * include/admin-local-rwx +!include-service admin.vm.device.block.Detach * include/admin-local-rwx +!include-service admin.vm.device.pci.Detach * include/admin-local-rwx +!include-service admin.vm.device.block.Assigned * include/admin-local-ro +!include-service admin.vm.device.pci.Assigned * include/admin-local-ro +!include-service admin.vm.device.block.Set.assignment * include/admin-local-rwx +!include-service admin.vm.device.pci.Set.assignment * include/admin-local-rwx +!include-service admin.vm.device.block.Unassign * include/admin-local-rwx +!include-service admin.vm.device.pci.Unassign * include/admin-local-rwx +!include-service admin.vm.feature.CheckWithAdminVM * include/admin-local-ro +!include-service admin.vm.feature.CheckWithNetvm * include/admin-local-ro +!include-service admin.vm.feature.CheckWithTemplate * include/admin-local-ro +!include-service admin.vm.feature.CheckWithTemplateAndAdminVM * include/admin-local-ro +!include-service admin.vm.feature.Get * include/admin-local-ro +!include-service admin.vm.feature.List * include/admin-local-ro +!include-service admin.vm.feature.Remove * include/admin-local-rwx +!include-service admin.vm.feature.Set * include/admin-local-rwx +!include-service admin.vm.firewall.Get * include/admin-local-ro +!include-service admin.vm.firewall.Reload * include/admin-local-rwx +!include-service admin.vm.firewall.Set * include/admin-local-rwx +!include-service admin.vm.Kill * include/admin-local-rwx +!include-service admin.vm.List * include/admin-global-ro +!include-service admin.vm.notes.Get * include/admin-local-ro +!include-service admin.vm.notes.Set * include/admin-local-rwx +!include-service admin.vm.Pause * include/admin-local-rwx +!include-service admin.vm.property.Get * include/admin-local-ro +!include-service admin.vm.property.GetAll * include/admin-local-ro +!include-service admin.vm.property.GetDefault * include/admin-local-ro +!include-service admin.vm.property.Help * include/admin-local-ro +!include-service admin.vm.property.List * include/admin-local-ro +!include-service admin.vm.property.Reset * include/admin-local-rwx +!include-service admin.vm.property.Set * include/admin-local-rwx +!include-service admin.vm.Remove * include/admin-global-rwx +!include-service admin.vm.Resume * include/admin-local-rwx +!include-service admin.vm.Shutdown * include/admin-local-rwx +!include-service admin.vm.Start * include/admin-local-rwx +!include-service admin.vm.Stats * include/admin-global-ro +!include-service admin.vm.Suspend * include/admin-local-rwx +!include-service admin.vm.tag.Get * include/admin-local-ro +!include-service admin.vm.tag.List * include/admin-local-ro +!include-service admin.vm.tag.Remove * include/admin-local-rwx +!include-service admin.vm.tag.Set * include/admin-local-rwx +!include-service admin.vm.Unpause * include/admin-local-rwx +!include-service admin.vm.volume.Clear * include/admin-local-rwx +!include-service admin.vm.volume.CloneFrom * include/admin-local-rwx +!include-service admin.vm.volume.CloneTo * include/admin-local-rwx +!include-service admin.vm.volume.Info * include/admin-local-ro +!include-service admin.vm.volume.List * include/admin-local-ro +!include-service admin.vm.volume.ListSnapshots * include/admin-local-ro +!include-service admin.vm.volume.Resize * include/admin-local-rwx +!include-service admin.vm.volume.Revert * include/admin-local-rwx +!include-service admin.vm.volume.Set.ephemeral * include/admin-local-rwx +!include-service admin.vm.volume.Set.revisions_to_keep * include/admin-local-rwx +!include-service admin.vm.volume.Set.rw * include/admin-local-rwx +!include-service admin.vmclass.List * include/admin-global-ro + +--- /etc/qubes/policy.d/90-admin-policy-default.policy --- +## Do not modify this file, create a new policy file with a lower number in the +## filename instead. For example `30-admin-policy.policy`. + +### +### Policy Admin API qrexec policy +### + +## WARNING: the services here allow viewing and changing the Qubes RPC policy, +## which effectively gives the caller full control over the system. You should +## allow them only to trusted qubes. + +## For convenience of maintaining this policy, all services include one of: +## - include/admin-policy-rwx (services to modify the policy) +## - include/admin-policy-ro (services to read the policy) + +!include-service policy.List * include/admin-policy-ro +!include-service policy.include.List * include/admin-policy-ro +!include-service policy.Get * include/admin-policy-ro +!include-service policy.include.Get * include/admin-policy-ro +!include-service policy.GetFiles * include/admin-policy-ro + +!include-service policy.Replace * include/admin-policy-rwx +!include-service policy.include.Replace * include/admin-policy-rwx +!include-service policy.Remove * include/admin-policy-rwx +!include-service policy.include.Remove * include/admin-policy-rwx + +--- /etc/qubes/policy.d/90-default-gui-daemon.policy --- +## Note that policy parsing stops at the first match, +## so adding anything below "@anyvm @anyvm action" line will have no effect +## +## Clipboard paste (Ctrl-Shift-V) will treat "ask" as "allow" but only when +## called by this keyboard shortcut. "deny" always denies the operation. + +## Please use a single # to start your custom comments + +qubes.ClipboardPaste * @adminvm @anyvm ask +qubes.ClipboardPaste * @anyvm @anyvm ask + +# The default policy handles only GUI in dom0. GUIVM needs similar line in its +# policy too. +qubes.WindowIconUpdater * @anyvm dom0 allow + +--- /etc/qubes/policy.d/90-default-linux.policy --- +# qubes-dom0-update +qubes.ReceiveUpdates * @anyvm dom0 allow + +# This used to define policies for: +# - qubes.repos.List +# - qubes.repos.Enable +# - qubes.repos.Disable +# but since those are "deny" by default anyway, skip them + +--- /etc/qubes/policy.d/90-default-pdf-convert.policy --- +## Note that policy parsing stops at the first match, +## so adding anything below "@anyvm @anyvm action" line will have no effect + +## Please use a single # to start your custom comments + +qubes.PdfConvert * @anyvm @dispvm allow + +--- /etc/qubes/policy.d/90-default.policy --- +## Do not modify this file, create a new policy file with a lower number in the +## filename instead. For example `30-user.policy`. + +### +### Default qrexec policy +### + +## File format: +## service-name|* +argument|* source destination action [options] + +## Note that policy parsing stops at the first match. + +# policy.RegisterArgument should be allowed only for specific arguments. +policy.RegisterArgument * @anyvm @anyvm deny +policy.RegisterArgument * @anyvm dom0 deny + +# WARNING: The qubes.ConnectTCP service is dangerous and allows any +# qube to access any other qube TCP port. It should be restricted +# only to restricted qubes. This is why the default policy is 'deny' + +# Example of policy: qubes.ConnectTCP +22 mytcp-client @default allow target=mytcp-server +qubes.ConnectTCP * @anyvm @anyvm deny + +# VM advertise its supported features +qubes.FeaturesRequest * @anyvm dom0 allow + +# Windows VM advertise installed Qubes Windows Tools +qubes.NotifyTools * @anyvm dom0 allow + +# File copy/move +qubes.Filecopy * @anyvm @anyvm ask + +# Get current date/time +qubes.GetDate * @tag:anon-vm @anyvm deny +qubes.GetDate * @anyvm @anyvm allow target=dom0 + +# Get slightly randomized date/time +qubes.GetRandomizedTime * @anyvm dom0 allow + +# Convert image to a safe format, also, allows to get an image (icon) file from a VM +qubes.GetImageRGBA * @anyvm @dispvm allow +qubes.GetImageRGBA * @anyvm @anyvm ask + +# Notify about available updates +qubes.NotifyUpdates * @anyvm dom0 allow + +# Open a file in a VM +qubes.OpenInVM * @anyvm @dispvm allow +qubes.OpenInVM * @anyvm @anyvm ask + +# Open URL in a VM +qubes.OpenURL * @anyvm @dispvm allow +qubes.OpenURL * @anyvm @anyvm ask + +# Start application using its menu entry (only applications with menu entries +# are allowed, no arbitrary command). Argument is an application name (in case +# of Linux, basename of .desktop file from /usr/share/applications or similar +# location). +qubes.StartApp * @anyvm @dispvm allow +qubes.StartApp * @anyvm @anyvm ask + +# Sends list of available applications - relevant for GUI being in dom0; +# otherwise earlier policy will redirect it +qubes.SyncAppMenus * @anyvm dom0 allow + +# notifications - relevant for GUI in dom0, otherwise earlier policy will +# redirect it +qubes.Notifications * @anyvm @default allow target=dom0 + +# HTTP proxy for downloading updates +# Upgrade all TemplateVMs through sys-whonix. +#qubes.UpdatesProxy * @type:TemplateVM @default allow target=sys-whonix +# Upgrade Whonix TemplateVMs through sys-whonix. +qubes.UpdatesProxy * @tag:whonix-updatevm @default allow target=sys-whonix +# Deny Whonix TemplateVMs using UpdatesProxy of any other VM. +qubes.UpdatesProxy * @tag:whonix-updatevm @anyvm deny +# Default rule for all TemplateVMs - direct the connection to sys-net +qubes.UpdatesProxy * @type:TemplateVM @default allow target=sys-net +qubes.UpdatesProxy * @anyvm @anyvm deny + +# WARNING: The qubes.VMShell service is dangerous and there are really few +# cases when it could be safely used. Especially when policy set to "ask" you +# have no way to know for sure what command(s) will be called. Compromissed +# source VM can substitute the command. Allowing one VM to execute +# qubes.VMShell over the other VM allows the former to TAKE FULL CONTROL over +# the later. In most cases this is not what we want! +# +# Instead we should be using task-specific qrexec services which provide +# assurance as to what program will be responding to the (untrusted) VM +# requests. +# +# It is, however, safe, in most cases, to allow ultimate control of the +# creating AppVM over the DisposableVM it creates as part of the qrexec service +# invocation. That's why by default we have "@anyvm @dispvm allow" rule. Note +# that it does _not_ allow any AppVM to execute qubes.VMShell service over any +# DispVM created in the system -- that would obviously be wrong. It only allows +# qubes.VMShell service access to the AppVM which creates the DispVM as part of +# this very service invocation. +# +# See e.g. this thread for some discussion: +# https://groups.google.com/d/msg/qubes-users/xnAByaL_bjI/3PjYdiTDW-0J +qubes.VMShell * @anyvm @dispvm allow +qubes.VMShell * @anyvm @anyvm deny + +# WARNING: qubes.VMRootShell has similar risks as qubes.VMExec +# Add "user=root" option to any ask or allow rules. +qubes.VMRootShell * @anyvm @anyvm deny + +# WARNING: The qubes.VMExec service is dangerous and there are really few +# cases when it could be safely used. Contrary to qubes.VMShell, when policy is +# set to "ask", the command to be executed is visible in the confirmation +# prompt. But once allowed, the source VM have full control over the command +# standard input/output. Allowing one VM to execute qubes.VMExec over the +# other VM allows the former to TAKE FULL CONTROL over the later. In most cases +# this is not what we want! +# +# Instead we should be using task-specific qrexec services which provide +# assurance as to what program will be responding to the (untrusted) VM +# requests. +# +# It is, however, safe, in most cases, to allow ultimate control of the +# creating AppVM over the DisposableVM it creates as part of the qrexec service +# invocation. That's why by default we have "@anyvm @dispvm allow" rule. Note +# that it does _not_ allow any AppVM to execute qubes.VMExec service over any +# DispVM created in the system -- that would obviously be wrong. It only allows +# qubes.VMExec service access to the AppVM which creates the DispVM as part of +# this very service invocation. +# +# See e.g. this thread for some discussion: +# https://groups.google.com/d/msg/qubes-users/xnAByaL_bjI/3PjYdiTDW-0J +qubes.VMExec * @anyvm @dispvm allow +qubes.VMExec * @anyvm @anyvm deny + +# WARNING: qubes.VMExecGUI has similar risks as qubes.VMExec +qubes.VMExecGUI * @anyvm @dispvm allow +qubes.VMExecGUI * @anyvm @anyvm deny + +--- /etc/qubes/policy.d/include --- + +--- /etc/qubes/policy.d/README --- +# This directory contains qrexec policy in new (Qubes R5.0) format. +# See https://www.qubes-os.org/doc/ for explanation. If you want to +# write your own policy, see the '30-user' file. + + +===== 10. Effective policy query (if tools exist) ===== + +$ command -v qrexec-policy-graph && qrexec-policy-graph --include-ask 2>&1 | grep -iE "signer|clipboard" | head -30 +/usr/bin/qrexec-policy-graph +qrexec.exc.PolicySyntaxError: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * + +$ command -v qvm-tags && qvm-tags dom0 2>/dev/null | head -20 +/usr/bin/qvm-tags + +===== 11. qrexec policy daemon status ===== + +$ systemctl status qrexec-policy-daemon --no-pager -l +Unit qrexec-policy-daemon.service could not be found. + +$ systemctl is-active qrexec-policy-daemon +inactive + +===== 12. Target qube info (nostr_signer) ===== + +$ qvm-ls --raw-data --fields NAME,STATE,CLASS,TEMPLATE,NETVM nostr_signer +nostr_signer|Running|StandaloneVM|-|sys-vpn-mullvad-app + +$ qvm-features nostr_signer +default-menu-items xfce4-terminal.desktop thunar.desktop firefox-esr.desktop xfce-settings-manager.desktop +menu-items brave-browser.desktop org.xfce.mousepad.desktop xfce-settings-manager.desktop thunar.desktop codium.desktop xfce4-terminal.desktop +netvm-menu-items debian-xterm.desktop +qrexec 1 +os Linux +supported-service.gui-agent-clipboard-wipe 1 +supported-service.qubes-updates-proxy 1 +supported-service.apparmor 1 +apparmor 1 +supported-service.crond 1 +supported-service.minimal-usbvm 1 +supported-service.pipewire 1 +supported-service.cups 1 +supported-service.minimal-netvm 1 +supported-service.qubes-firewall 1 +supported-service.qubes-network 1 +supported-service.modem-manager 1 +supported-service.no-qubesincoming-cleanup 1 +supported-service.updates-proxy-setup 1 +supported-service.clocksync 1 +supported-service.meminfo-writer 1 +supported-service.network-manager 1 +supported-service.qubes-update-check 1 +supported-rpc.qubes.OpenInVM 1 +supported-rpc.qubes.SuspendPostAll 1 +supported-rpc.qubes.RegisterBackupLocation 1 +supported-rpc.qubes.USB 1 +supported-rpc.qubes.SetDateTime 1 +supported-rpc.qubes.DetachPciDevice 1 +supported-rpc.qubes.WaitForSession 1 +supported-rpc.qubes.StartApp 1 +supported-rpc.qubes.Filecopy 1 +supported-rpc.qubes.InstallUpdatesGUI 1 +supported-rpc.qubes.SuspendPre 1 +supported-rpc.qubes.PdfConvert 1 +supported-rpc.qubes.SelectFile 1 +supported-rpc.qubes.TemplateSearch 1 +supported-rpc.qubes.PostInstall 1 +supported-rpc.qubes.Backup 1 +supported-rpc.qubes.TemplateDownload 1 +supported-rpc.qubes.VMShell 1 +supported-rpc.qubes.SetMonitorLayout 1 +supported-rpc.qubes.OpenURL 1 +supported-rpc.qubes.ShowInTerminal 1 +supported-rpc.qubes.GetAppmenus 1 +supported-rpc.qubes.Gpg 1 +supported-rpc.qubes.SuspendPost 1 +supported-rpc.qubes.ResizeDisk 1 +supported-rpc.qubes.SaltLinuxVM 1 +supported-rpc.qubes.USBAttach 1 +supported-rpc.qubes.Restore 1 +supported-rpc.qubes.GuiVMSession 1 +supported-rpc.qubes.GetDate 1 +supported-rpc.qubes.USBDetach 1 +supported-rpc.qubes.GpgImportKey 1 +supported-rpc.qubes.VMExec 1 +supported-rpc.qubes.WaitForNetworkUplink 1 +supported-rpc.qubes.GetImageRGBA 1 +supported-rpc.qubes.SuspendPreAll 1 +supported-rpc.qubes.VMRootExec 1 +supported-rpc.qubes.VMExecGUI 1 +supported-rpc.qubes.WaitForRunningSystem 1 +supported-rpc.qubes.VMRootShell 1 +supported-rpc.qubes.RestoreById 1 +supported-rpc.qubes.SelectDirectory 1 +supported-feature.memory-hotplug 1 +os-distribution debian +os-version 13 +os-eol 2028-08-09 +qubes-agent-version 4.3 +gui 1 +qubes-firewall 1 +vmexec 1 +template-name debian-13-xfce +template-epoch 0 +template-version 4.3.0 +template-release 202512040043 +template-reponame @commandline +template-buildtime 2025-12-04 01:03:33 +template-installtime 2026-03-23 23:42:36 +template-license GPLv3+ +template-url http://www.qubes-os.org +template-summary Qubes OS template for debian-13-xfce +template-description Qubes OS template for debian-13-xfce. +updates-available 1 +last-updates-check 2026-08-19 07:47:50 +last-update 2026-05-03 08:55:29 +supported-rpc.qubes.NsignerRpc 1 + +$ qvm-prefs nostr_signer +audiovm D dom0 +autostart D False +backup_timestamp U +bootmode D default +debug D False +default_dispvm D default-dvm +default_user D user +devices_denied D +dns D 10.139.1.1 10.139.1.2 +gateway D +gateway6 D +guivm D dom0 +icon D standalonevm-yellow +include_in_backups D True +installed_by_rpm D False +ip D 10.137.0.26 +ip6 D fd09:24ef:4179::a89:1a +kernel D 6.12.59-1.fc41 +kernelopts D swiotlb=2048 +keyboard_layout D us++ +klass D StandaloneVM +label - yellow +mac D 00:16:3e:5e:6c:00 +management_dispvm D default-mgmt-dvm +maxmem D 4000 +memory D 400 +name - nostr_signer +netvm - sys-vpn-mullvad-app +provides_network - False +qid - 26 +qrexec_timeout D 60 +shutdown_timeout D 60 +start_time D 1786966896.93 +stubdom_mem U +stubdom_uuid D +stubdom_xid D -1 +template_for_dispvms D False +updateable D True +uuid - 5e4cd87f-2bd2-4de3-a581-985abce50b04 +vcpus D 2 +virt_mode D pvh +visible_gateway D 10.137.0.20 +visible_gateway6 D fd09:24ef:4179::a89:14 +visible_ip D 10.137.0.26 +visible_ip6 D fd09:24ef:4179::a89:1a +visible_netmask D 255.255.255.255 +xid D 14 + +===== 13. Caller qube info (ai) ===== + +$ qvm-ls --raw-data --fields NAME,STATE,CLASS,TEMPLATE,NETVM ai +ai|Running|StandaloneVM|-|sys-vpn-mullvad-app + +$ qvm-features ai +default-menu-items xfce4-terminal.desktop thunar.desktop firefox-esr.desktop xfce-settings-manager.desktop +menu-items brave-browser.desktop xfce4-mime-settings.desktop firefox-esr.desktop org.gnumeric.gnumeric.desktop libreoffice-writer.desktop org.xfce.mousepad.desktop com.obsproject.Studio.desktop pgadmin4.desktop pavucontrol.desktop xfce-settings-manager.desktop thunar.desktop vlc.desktop codium.desktop xfce4-terminal.desktop +netvm-menu-items debian-xterm.desktop +qrexec 1 +os Linux +supported-service.gui-agent-clipboard-wipe 1 +supported-service.qubes-updates-proxy 1 +supported-service.apparmor 1 +apparmor 1 +supported-service.crond 1 +supported-service.minimal-usbvm 1 +supported-service.pipewire 1 +supported-service.cups 1 +supported-service.minimal-netvm 1 +supported-service.qubes-firewall 1 +supported-service.qubes-network 1 +supported-service.modem-manager 1 +supported-service.no-qubesincoming-cleanup 1 +supported-service.updates-proxy-setup 1 +supported-service.clocksync 1 +supported-service.meminfo-writer 1 +supported-service.network-manager 1 +supported-service.qubes-update-check 1 +supported-rpc.qubes.OpenInVM 1 +supported-rpc.qubes.SuspendPostAll 1 +supported-rpc.qubes.RegisterBackupLocation 1 +supported-rpc.qubes.USB 1 +supported-rpc.qubes.SetDateTime 1 +supported-rpc.qubes.DetachPciDevice 1 +supported-rpc.qubes.WaitForSession 1 +supported-rpc.qubes.StartApp 1 +supported-rpc.qubes.Filecopy 1 +supported-rpc.qubes.InstallUpdatesGUI 1 +supported-rpc.qubes.SuspendPre 1 +supported-rpc.qubes.PdfConvert 1 +supported-rpc.qubes.SelectFile 1 +supported-rpc.qubes.TemplateSearch 1 +supported-rpc.qubes.PostInstall 1 +supported-rpc.qubes.Backup 1 +supported-rpc.qubes.TemplateDownload 1 +supported-rpc.qubes.VMShell 1 +supported-rpc.qubes.SetMonitorLayout 1 +supported-rpc.qubes.OpenURL 1 +supported-rpc.qubes.ShowInTerminal 1 +supported-rpc.qubes.GetAppmenus 1 +supported-rpc.qubes.Gpg 1 +supported-rpc.qubes.SuspendPost 1 +supported-rpc.qubes.ResizeDisk 1 +supported-rpc.qubes.SaltLinuxVM 1 +supported-rpc.qubes.USBAttach 1 +supported-rpc.qubes.Restore 1 +supported-rpc.qubes.GuiVMSession 1 +supported-rpc.qubes.GetDate 1 +supported-rpc.qubes.USBDetach 1 +supported-rpc.qubes.GpgImportKey 1 +supported-rpc.qubes.VMExec 1 +supported-rpc.qubes.WaitForNetworkUplink 1 +supported-rpc.qubes.GetImageRGBA 1 +supported-rpc.qubes.SuspendPreAll 1 +supported-rpc.qubes.VMRootExec 1 +supported-rpc.qubes.VMExecGUI 1 +supported-rpc.qubes.WaitForRunningSystem 1 +supported-rpc.qubes.VMRootShell 1 +supported-rpc.qubes.RestoreById 1 +supported-rpc.qubes.SelectDirectory 1 +supported-feature.memory-hotplug 1 +os-distribution debian +os-version 13 +os-eol 2028-08-09 +qubes-agent-version 4.3 +gui 1 +qubes-firewall 1 +vmexec 1 +template-name debian-13-xfce +template-epoch 0 +template-version 4.3.0 +template-release 202512040043 +template-reponame @commandline +template-buildtime 2025-12-04 01:03:33 +template-installtime 2026-03-23 23:42:36 +template-license GPLv3+ +template-url http://www.qubes-os.org +template-summary Qubes OS template for debian-13-xfce +template-description Qubes OS template for debian-13-xfce. +updates-available 1 +last-updates-check 2026-08-18 17:25:14 +last-update 2026-08-02 07:16:44 +qubesmanager.maxmem_value 100000 +supported-service.guivm-gui-agent 1 +kvm true + +===== 14. Recent qrexec/policy journal errors ===== + +$ journalctl -b --no-pager 2>/dev/null | grep -iE "qrexec|policy|SignerRpc|NsignerRpc|clipboard" | tail -80 +Aug 20 14:10:57 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: denied: no matching rule found +Aug 20 14:11:11 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NsignerRpc+: ai -> nostr_signer: allowed to nostr_signer +Aug 20 14:12:09 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: denied: no matching rule found +Aug 20 14:12:09 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NsignerRpc+: ai -> nostr_signer: allowed to nostr_signer +Aug 20 14:12:24 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ConnectTCP: ai -> nostr_signer: denied: denied by policy /etc/qubes/policy.d/90-default.policy:22 +Aug 20 14:14:38 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: denied: no matching rule found +Aug 20 14:19:19 dom0 sudo[45983]: rubik : TTY=pts/18 ; PWD=/home/rubik/Desktop ; USER=root ; COMMAND=/usr/bin/mkdir -p /etc/qubes-rpc/policy/ +Aug 20 14:20:47 dom0 sudo[46015]: rubik : TTY=pts/18 ; PWD=/home/rubik/Desktop ; USER=root ; COMMAND=/usr/bin/tee /etc/qubes-rpc/policy/qubes.SignerRpc +Aug 20 14:21:07 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 14:21:07 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 14:22:08 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 14:22:08 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ClipboardPaste: dom0 -> ai: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 14:23:06 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 14:23:06 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ClipboardPaste: dom0 -> ai: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 14:23:55 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 14:23:55 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ClipboardPaste: dom0 -> ai: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 14:24:48 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 14:24:48 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ClipboardPaste: dom0 -> ai: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 14:32:15 dom0 sudo[46192]: rubik : TTY=pts/18 ; PWD=/etc/qubes-rpc/policy ; USER=root ; COMMAND=/usr/bin/nano /etc/qubes-rpc/policy +Aug 20 14:32:15 dom0 kernel: audit: type=1123 audit(1787250735.834:625): pid=46192 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes-rpc/policy" cmd=6E616E6F202F6574632F71756265732D7270632F706F6C696379 exe="/usr/bin/sudo" terminal=pts/18 res=success' +Aug 20 14:32:15 dom0 audit[46192]: USER_CMD pid=46192 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes-rpc/policy" cmd=6E616E6F202F6574632F71756265732D7270632F706F6C696379 exe="/usr/bin/sudo" terminal=pts/18 res=success' +Aug 20 14:35:41 dom0 kernel: audit: type=1123 audit(1787250941.718:631): pid=46228 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes-rpc/policy" cmd=61707420696E7374616C6C206C6F63617465 exe="/usr/bin/sudo" terminal=pts/18 res=failed' +Aug 20 14:35:41 dom0 audit[46228]: USER_CMD pid=46228 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes-rpc/policy" cmd=61707420696E7374616C6C206C6F63617465 exe="/usr/bin/sudo" terminal=pts/18 res=failed' +Aug 20 14:40:19 dom0 sudo[46247]: rubik : TTY=pts/18 ; PWD=/etc/qubes-rpc/policy ; USER=root ; COMMAND=/usr/bin/find / -iname *nsigner* +Aug 20 14:40:19 dom0 kernel: audit: type=1123 audit(1787251219.942:633): pid=46247 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes-rpc/policy" cmd=66696E64202F202D696E616D65202A6E7369676E65722A exe="/usr/bin/sudo" terminal=pts/18 res=success' +Aug 20 14:40:19 dom0 audit[46247]: USER_CMD pid=46247 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes-rpc/policy" cmd=66696E64202F202D696E616D65202A6E7369676E65722A exe="/usr/bin/sudo" terminal=pts/18 res=success' +Aug 20 14:46:48 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 14:46:48 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 14:46:59 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 14:46:59 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 14:46:59 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 14:46:59 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NsignerRpc: ai -> nostr_signer: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 14:50:43 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 14:50:43 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 14:57:00 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 14:57:00 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 14:58:43 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 14:58:43 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ClipboardPaste: dom0 -> ai: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 14:59:31 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 14:59:31 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ClipboardPaste: dom0 -> ai: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 15:02:59 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 15:02:59 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ClipboardPaste: dom0 -> ai: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 15:06:00 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 15:06:00 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ClipboardPaste: dom0 -> ai: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 15:18:18 dom0 sudo[46648]: rubik : TTY=pts/18 ; PWD=/etc/qubes/policy.d ; USER=root ; COMMAND=/usr/bin/chown --reference=/etc/qubes/policy.d/50-config-updates.policy /etc/qubes/policy.d/50-config-clipboard.policy +Aug 20 15:18:18 dom0 kernel: audit: type=1123 audit(1787253498.846:652): pid=46648 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes/policy.d" cmd=63686F776E202D2D7265666572656E63653D2F6574632F71756265732F706F6C6963792E642F35302D636F6E6669672D757064617465732E706F6C696379202F6574632F71756265732F706F6C6963792E642F35302D636F6E6669672D636C6970626F6172642E706F6C696379 exe="/usr/bin/sudo" terminal=pts/18 res=success' +Aug 20 15:18:18 dom0 audit[46648]: USER_CMD pid=46648 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes/policy.d" cmd=63686F776E202D2D7265666572656E63653D2F6574632F71756265732F706F6C6963792E642F35302D636F6E6669672D757064617465732E706F6C696379202F6574632F71756265732F706F6C6963792E642F35302D636F6E6669672D636C6970626F6172642E706F6C696379 exe="/usr/bin/sudo" terminal=pts/18 res=success' +Aug 20 15:19:35 dom0 sudo[46666]: rubik : TTY=pts/18 ; PWD=/etc/qubes/policy.d ; USER=root ; COMMAND=/usr/bin/chown --reference=/etc/qubes/policy.d/50-config-updates.policy /etc/qubes/policy.d/45-signer.policy +Aug 20 15:19:35 dom0 kernel: audit: type=1123 audit(1787253575.796:658): pid=46666 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes/policy.d" cmd=63686F776E202D2D7265666572656E63653D2F6574632F71756265732F706F6C6963792E642F35302D636F6E6669672D757064617465732E706F6C696379202F6574632F71756265732F706F6C6963792E642F34352D7369676E65722E706F6C696379 exe="/usr/bin/sudo" terminal=pts/18 res=success' +Aug 20 15:19:35 dom0 audit[46666]: USER_CMD pid=46666 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes/policy.d" cmd=63686F776E202D2D7265666572656E63653D2F6574632F71756265732F706F6C6963792E642F35302D636F6E6669672D757064617465732E706F6C696379202F6574632F71756265732F706F6C6963792E642F34352D7369676E65722E706F6C696379 exe="/usr/bin/sudo" terminal=pts/18 res=success' +Aug 20 15:21:08 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 15:21:08 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 17:16:08 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 17:16:08 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NotifyUpdates: sys-whonix -> dom0: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 17:16:24 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 17:16:24 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NotifyUpdates: sys-net -> dom0: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 17:17:36 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 17:17:36 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NotifyUpdates: sys-firewall -> dom0: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 17:17:38 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 17:17:38 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NotifyUpdates: sys-vpn-mullvad-app -> dom0: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 17:18:40 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 17:18:40 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NotifyUpdates: clearnet -> dom0: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 17:20:24 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 17:20:24 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.GetDate+nanoseconds: ai -> @default: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 17:22:40 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 17:22:40 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.GetDate+nanoseconds: sys-firewall -> @default: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 17:24:05 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 17:24:05 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.GetDate+nanoseconds: sys-usb -> @default: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 17:24:16 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 17:24:16 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.GetDate+nanoseconds: clearnet -> @default: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 17:25:13 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 17:25:13 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NotifyUpdates: ai -> dom0: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 17:25:33 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 17:25:33 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.GetDate+nanoseconds: sys-vpn-mullvad-app -> @default: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 17:25:57 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 17:25:57 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NotifyUpdates: nostr -> dom0: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 17:30:50 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 17:30:50 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.GetDate+nanoseconds: nostr -> @default: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * +Aug 20 17:58:59 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated +Aug 20 17:58:59 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.GetDate+nanoseconds: vault -> @default: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: * + +===== 15. qrexec service definitions in target qube (via qvm-run, read-only) ===== + +$ qvm-run -p nostr_signer "ls -la /etc/qubes-rpc/ 2>/dev/null; echo ---; ls -la /rw/config/qubes-rpc/ 2>/dev/null; echo ---; cat /rw/config/rc.local 2>/dev/null" 2>&1 | head -60 +total 172 +drwxr-xr-x 2 root root 4096 Jul 11 09:43 . +drwxr-xr-x 132 root root 12288 Aug 17 07:41 .. +lrwxrwxrwx 1 root root 32 Feb 19 22:38 policy.Ask -> /var/run/qubes/policy-agent.sock +lrwxrwxrwx 1 root root 32 Feb 19 22:38 policy.Notify -> /var/run/qubes/policy-agent.sock +-rwxr-xr-x 1 root root 734 Nov 24 2025 qubes.Backup +lrwxrwxrwx 1 root root 18 Jan 11 2026 qubes.ConnectTCP -> /dev/tcp/127.0.0.1 +-rwxr-xr-x 1 root root 92 Nov 24 2025 qubes.DetachPciDevice +-rwxr-xr-x 1 root root 304 Nov 24 2025 qubes.Filecopy +-rwxr-xr-x 1 root root 2183 Nov 24 2025 qubes.GetAppmenus +-rwxr-xr-x 1 root root 887 Nov 24 2025 qubes.GetDate +-rwxr-xr-x 1 root root 1529 Nov 24 2025 qubes.GetImageRGBA +-rwxr-xr-x 1 root root 1549 Oct 27 2025 qubes.Gpg +-rwxr-xr-x 1 root root 42 Oct 27 2025 qubes.GpgImportKey +lrwxrwxrwx 1 root root 27 Nov 23 2025 qubes.GuiVMSession -> /usr/bin/qubes-start-xephyr +-rwxr-xr-x 1 root root 1130 Nov 24 2025 qubes.InstallUpdatesGUI +-rwxr-xr-x 1 root root 65 Jul 11 09:44 qubes.NsignerRpc +-rwxr-xr-x 1 root root 45 Nov 24 2025 qubes.OpenInVM +-rwxr-xr-x 1 root root 195 Nov 24 2025 qubes.OpenURL +lrwxrwxrwx 1 root root 34 Oct 9 2025 qubes.PdfConvert -> /usr/lib/qubes/qpdf-convert-server +-rwxr-xr-x 1 root root 1006 Nov 24 2025 qubes.PostInstall +-rwxr-xr-x 1 root root 1027 Nov 24 2025 qubes.RegisterBackupLocation +-rwxr-xr-x 1 root root 439 Nov 24 2025 qubes.ResizeDisk +-rwxr-xr-x 1 root root 1393 Nov 24 2025 qubes.Restore +-rwxr-xr-x 1 root root 2620 Nov 24 2025 qubes.RestoreById +-rwxr-xr-x 1 root root 2059 Oct 4 2025 qubes.SaltLinuxVM +-rwxr-xr-x 1 root root 67 Nov 24 2025 qubes.SelectDirectory +-rwxr-xr-x 1 root root 55 Nov 24 2025 qubes.SelectFile +-rwxr-xr-x 1 root root 356 Nov 24 2025 qubes.SetDateTime +lrwxrwxrwx 1 root root 33 Nov 23 2025 qubes.SetMonitorLayout -> /usr/bin/qubes-set-monitor-layout +-rwxr-xr-x 1 root root 428 Nov 24 2025 qubes.ShowInTerminal +-rwxr-xr-x 1 root root 1799 Nov 24 2025 qubes.StartApp +-rwxr-xr-x 1 root root 48 Nov 24 2025 qubes.SuspendPost +-rwxr-xr-x 1 root root 1006 Nov 24 2025 qubes.SuspendPostAll +-rwxr-xr-x 1 root root 49 Nov 24 2025 qubes.SuspendPre +-rwxr-xr-x 1 root root 1005 Nov 24 2025 qubes.SuspendPreAll +-rwxr-xr-x 1 root root 70 Nov 24 2025 qubes.TemplateDownload +-rwxr-xr-x 1 root root 67 Nov 24 2025 qubes.TemplateSearch +lrwxrwxrwx 1 root root 23 Jan 11 2026 qubes.UpdatesProxy -> /dev/tcp/127.0.0.1/8082 +-rwxr-xr-x 1 root root 342 Aug 5 2025 qubes.USB +-rwxr-xr-x 1 root root 567 Aug 5 2025 qubes.USBAttach +-rwxr-xr-x 1 root root 1132 Aug 5 2025 qubes.USBDetach +-rwxr-xr-x 1 root root 43 Nov 24 2025 qubes.VMExec +lrwxrwxrwx 1 root root 12 Jan 11 2026 qubes.VMExecGUI -> qubes.VMExec +-rwxr-xr-x 1 root root 43 Nov 24 2025 qubes.VMRootExec +-rwxr-xr-x 1 root root 142 Nov 24 2025 qubes.VMRootShell +-rwxr-xr-x 1 root root 25 Nov 24 2025 qubes.VMShell +-rwxr-xr-x 1 root root 450 Nov 24 2025 qubes.WaitForNetworkUplink +-rwxr-xr-x 1 root root 68 Nov 24 2025 qubes.WaitForRunningSystem +-rwxr-xr-x 1 root root 304 Nov 24 2025 qubes.WaitForSession +--- +--- +#!/bin/sh + +# This script will be executed at every VM startup, you can place your own +# custom commands here. This includes overriding some configuration in /etc, +# starting services etc. +# +# Executable scripts located in /rw/config/rc.local.d with the extension +# '.rc' are executed immediately before this rc.local. + +===== 16. Test qrexec call to nostr_signer (read-only get_info) ===== + +$ echo "{\"id\":\"diag\",\"method\":\"get_info\",\"params\":[]}" | timeout 10 qrexec-client-vm nostr_signer qubes.SignerRpc 2>&1; echo "exit=$?" +timeout: failed to run command ‘qrexec-client-vm’: No such file or directory +exit=127 + +$ echo "{\"id\":\"diag\",\"method\":\"get_info\",\"params\":[]}" | timeout 10 qrexec-client-vm nostr_signer qubes.NsignerRpc 2>&1; echo "exit=$?" +timeout: failed to run command ‘qrexec-client-vm’: No such file or directory +exit=127 + +===== 17. Qubes global config files ===== + +$ ls -la /etc/qubes/ | head -30 +total 36 +drwxr-xr-x 7 root root 4096 Mar 23 19:24 . +drwxr-xr-x 112 root root 4096 Apr 27 07:31 .. +drwxrwx--- 2 root qubes 4096 Mar 31 19:45 backup +-rw-r--r-- 1 root root 3798 Oct 19 2025 guid.conf +drwxrwxr-x 3 root qubes 4096 Aug 20 15:12 policy.d +drwxr-xr-x 2 root root 4096 Mar 23 19:24 post-install.d +-rw-rw-r-- 1 root qubes 471 Nov 8 2025 qmemman.conf +drwxr-xr-x 3 root root 4096 Mar 23 19:23 repo-templates +drwxr-xr-x 2 root root 4096 Mar 23 19:24 rpc-config + +$ cat /etc/qubes/policy.d/50-config-input.policy 2>/dev/null +qubes.InputMouse * sys-usb dom0 allow +qubes.InputKeyboard * sys-usb dom0 allow +# not configurable by this state +qubes.InputTablet * sys-usb dom0 deny + +$ cat /etc/qubes/policy.d/50-config-updates.policy 2>/dev/null +qubes.UpdatesProxy * @tag:whonix-updatevm @default allow target=sys-whonix +qubes.UpdatesProxy * @tag:whonix-updatevm @anyvm deny + +===== DONE ===== diff --git a/qfix.sh b/qfix.sh new file mode 100755 index 0000000..e78ccfb --- /dev/null +++ b/qfix.sh @@ -0,0 +1,84 @@ +#!/bin/bash +# qfix.sh — repair dom0 qrexec policy + signer handler. Run as root in dom0: +# sudo bash qfix.sh +# Fixes (with backups saved to ~/qfix-backup-/): +# 1. Removes invalid old-format file /etc/qubes-rpc/policy/qubes.SignerRpc +# (its "* * * allow" content breaks ALL qrexec policy loading) +# 2. Rewrites /etc/qubes/policy.d/45-signer.policy with direct targets +# 3. Sets the signer-signer tag on nostr_signer (optional, for tag rules) +# 4. Creates /etc/qubes-rpc/qubes.SignerRpc handler inside nostr_signer +# (modeled on the existing qubes.NsignerRpc handler) +# 5. Verifies policy loads cleanly + +set -u +TS=$(date +%Y%m%d-%H%M%S) +BK=~/qfix-backup-$TS +mkdir -p "$BK" + +ok() { printf '\033[1;32m[OK]\033[0m %s\n' "$*"; } +info(){ printf '\033[1;34m[..]\033[0m %s\n' "$*"; } +err() { printf '\033[1;31m[ERR]\033[0m %s\n' "$*"; } + +[[ $EUID -eq 0 ]] || { err "Run as root: sudo bash qfix.sh"; exit 1; } + +# ── 1. Remove the invalid old-format policy file ───────────────────── +if [[ -f /etc/qubes-rpc/policy/qubes.SignerRpc ]]; then + cp /etc/qubes-rpc/policy/qubes.SignerRpc "$BK/" 2>/dev/null + rm -f /etc/qubes-rpc/policy/qubes.SignerRpc + ok "removed invalid /etc/qubes-rpc/policy/qubes.SignerRpc (backed up)" +else + ok "no invalid old-format file present" +fi + +# ── 2. Rewrite 45-signer.policy with direct target rules ───────────── +SIGNER_POLICY=/etc/qubes/policy.d/45-signer.policy +if [[ -f "$SIGNER_POLICY" ]]; then + cp "$SIGNER_POLICY" "$BK/45-signer.policy" +fi +cat > "$SIGNER_POLICY" <<'EOF' +# Qubes OS qrexec policy for signer (qubes.SignerRpc) +# Direct rules: caller -> nostr_signer +qubes.SignerRpc * ai nostr_signer allow +qubes.SignerRpc * nostr nostr_signer allow +qubes.SignerRpc * @anyvm @anyvm ask default_target=nostr_signer +EOF +chown root:root "$SIGNER_POLICY" +chmod 0644 "$SIGNER_POLICY" +ok "rewrote $SIGNER_POLICY" + +# ── 3. Tag nostr_signer (enables @tag:signer-signer rules if ever used) ── +qvm-tags nostr_signer add signer-signer 2>/dev/null \ + && ok "tagged nostr_signer with signer-signer" \ + || info "tag set skipped (non-fatal)" + +# ── 4. Create the qrexec handler inside nostr_signer ───────────────── +info "inspecting existing handlers in nostr_signer..." +qvm-run -p nostr_signer 'cat /etc/qubes-rpc/qubes.NsignerRpc 2>/dev/null' || true + +# Detect signer binary location in the target qube +BIN=$(qvm-run -p nostr_signer \ + 'for b in $HOME/.local/bin/signer /usr/local/bin/signer; do [ -x "$b" ] && echo "$b" && break; done' 2>/dev/null | tr -d '\r') +[[ -n "$BIN" ]] || { err "signer binary not found in nostr_signer (run install_signer.sh there first)"; BIN="/home/user/.local/bin/signer"; } +info "signer binary in nostr_signer: $BIN" + +qvm-run -u root -p nostr_signer "printf '#!/bin/sh\nexec $BIN bridge\n' > /etc/qubes-rpc/qubes.SignerRpc && chmod 0755 /etc/qubes-rpc/qubes.SignerRpc" \ + && ok "created /etc/qubes-rpc/qubes.SignerRpc in nostr_signer" \ + || err "handler creation failed (create manually)" + +# Show what we created +qvm-run -p nostr_signer 'ls -la /etc/qubes-rpc/qubes.SignerRpc; cat /etc/qubes-rpc/qubes.SignerRpc' || true + +# ── 5. Verify policy loads cleanly ─────────────────────────────────── +info "verifying policy syntax..." +if qrexec-policy-graph --include-ask >/dev/null 2>"$BK/policy-graph.err"; then + ok "policy loads cleanly (no syntax errors)" +else + err "policy still has errors:" + cat "$BK/policy-graph.err" +fi + +echo +ok "repair complete. Backups in $BK" +echo "Now test from the ai qube:" +echo " signer-client --qrexec nostr_signer:qubes.SignerRpc --role main --path \"m/44'/1237'/0'/0/0\" get-public-key" +echo "Clipboard (dom0 -> ai) should also work again: Ctrl+Shift+C in dom0, Ctrl+Shift+V in ai" diff --git a/src/lib.rs b/src/lib.rs index 00a226e..9daf21e 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -31,4 +31,4 @@ pub mod error; pub use error::SignerError; /// Version string (matches C NSIGNER_VERSION). -pub const VERSION: &str = "v0.0.16"; +pub const VERSION: &str = "v0.0.17"; diff --git a/src/server.rs b/src/server.rs index 02479b3..3d33164 100644 --- a/src/server.rs +++ b/src/server.rs @@ -159,7 +159,7 @@ impl ServerContext { // Read framed request. A connection with no data yet // (WouldBlock) or an empty/closed probe is not a handled // request — return Ok(None) so we don't log it as handled. - let request = match crate::transport::recv_framed(&mut reader) { + let mut request = match crate::transport::recv_framed(&mut reader) { Ok(r) => r, Err(e) if e.kind() == std::io::ErrorKind::WouldBlock => { return Ok(None); @@ -168,7 +168,31 @@ impl ServerContext { }; // Identify caller via SO_PEERCRED - let caller = identify_unix_caller(&reader); + let mut caller = identify_unix_caller(&reader); + + // Bridge preamble: `signer bridge` (qrexec relay) sends a + // {"qrexec_source":""} frame before the actual + // JSON-RPC request. Consume it, record the source qube, + // and read the real request that follows. + if let Ok(v) = serde_json::from_str::(&request) { + if v.get("qrexec_source").is_some() && v.get("method").is_none() { + caller.source_qube = v + .get("qrexec_source") + .and_then(|s| s.as_str()) + .unwrap_or("") + .to_string(); + if !caller.source_qube.is_empty() { + caller.caller_id = format!("qubes:{}", caller.source_qube); + } + request = match crate::transport::recv_framed(&mut reader) { + Ok(r) => r, + Err(e) if e.kind() == std::io::ErrorKind::WouldBlock => { + return Ok(None); + } + Err(_) => return Ok(None), + }; + } + } // Process request (role-name-as-password model: no authorization) let (response, activity) = self.process_request(dispatcher, &request, &caller);