Page MenuHomePhabricator

improve whonixcheck output in Qubes
Closed, ResolvedPublic

Description

Usability questions:

  1. If running in TemplateVM, ProxyVM or AppVM: Perhaps add this info to window title? [1]
  1. If running in StandaloneVM or TemplateBasedVM: Perhaps add this info to window title? [2]
  1. If running in a TemplateBasedVM, and if there are updates available: Explain how to start a TemplateVM to update. [3]

Technical questions:

[1] (output of qubesdb-read /qubes-vm-type) [no question]

[2] Is it possible to read from within a script if it is running within a StandaloneVM or TemplateBasedVM using qubesdb-read or so?

[3] From within a TemplateBasedVM... Can a script find out the name of the TemplateVM it is based on using qubesdb-read or so?

Details

Impact
Normal

Event Timeline

Patrick created this task.Jul 3 2015, 6:45 PM
Patrick raised the priority of this task from to Normal.
Patrick updated the task description. (Show Details)
Patrick set Impact to Normal.
Patrick added subscribers: Patrick, nrgaway, marmarek and 2 others.

Yes to all the questions

# QUBESDB and PREFIX are used to access data in Qubes database.  The interfaces
# to the database has changed in Release 3, so these vars will contain the proper
# program and syntax to use when accessing the database.

    # Qubes R3
    if which qubesdb-read > /dev/null; then
        QUBESDB=qubesdb
        PREFIX='/'

    # Qubes R2
    else
        QUBESDB=xenstore
        PREFIX=''
    fi

To read host name in R3:

qubesdb-read /name

To read VM type in R3:

qubesdb-read /qubes-vm-type

There are two technical questions still open. I'll restate/clarify those.

[2] Is it possible to read from within a script if it is running within a StandaloneVM or TemplateBasedVM using qubesdb-read or so? I mean something like qubesdb-read /standalone -> yes, no or qubesdb-read /template-based -> yes, no.

[3] From within a TemplateBasedVM... Can a script find out the name of the TemplateVM it is based on using qubesdb-read or so? qubesdb-read /name -> my-whonix-gw-proxyvm is fine, but not what I am asking here. More like this... qubesdb-read /parent-template -> whonix-gw-experimental.

In T371#5858, @Patrick wrote:

There are two technical questions still open. I'll restate/clarify those.
[2] Is it possible to read from within a script if it is running within a StandaloneVM or TemplateBasedVM using qubesdb-read or so? I mean something like qubesdb-read /standalone -> yes, no or qubesdb-read /template-based -> yes, no.

I don't know if I understand the question. Are you trying to read from another VM from the one you are currently in? For example, if your are in the Whonix Gateway ProxyVM, are you trying to read something from the TemplateVM? If thats what you mean, no

If you mean you have a script running in the ProxyVM and are trying to figure out its hostname or type, the example I posted above is how you accomplish this.

qubes-whonix has code in /usr/lib/qubes-whonix/utility_functions.sh, replace-ips, and in the init directory a few of the scripts read as well.

Check out /usr/lib/qubes/init for examples as well.

[3] From within a TemplateBasedVM... Can a script find out the name of the TemplateVM it is based on using qubesdb-read or so? qubesdb-read /name -> my-whonix-gw-proxyvm is fine, but not what I am asking here. More like this... qubesdb-read /parent-template -> whonix-gw-experimental.

I don't know this.

In T371#5861, @nrgaway wrote:

I don't know if I understand the question. Are you trying to read from another VM from the one you are currently in?

From the VM the script is currently running in.

For example, if your are in the Whonix Gateway ProxyVM, are you trying to read something from the TemplateVM?

No.


I'll rephrase question [2]...:

some script running inside an some AppVM and asks: "Am I a TemplateVM or StandaloneVM?"
qubesdb-read: replies "You are a TemplateVM."
or qubesdb-read: replies "You are a StandaloneVM."

In T371#5865, @Patrick wrote:
In T371#5861, @nrgaway wrote:

I don't know if I understand the question. Are you trying to read from another VM from the one you are currently in?

From the VM the script is currently running in.

For example, if your are in the Whonix Gateway ProxyVM, are you trying to read something from the TemplateVM?

No.

I'll rephrase question [2]...:
some script running inside an some AppVM and asks: "Am I a TemplateVM or StandaloneVM?"
qubesdb-read: replies "You are a TemplateVM."
or qubesdb-read: replies "You are a StandaloneVM."

In that case, Yes, example above state how to read what type of VM it is

Doesn't work for me. Testing from inside a Standalone ProxyVM.

qubesdb-read /qubes-vm-type -> ProxyVM

But I am looking for the info StandaloneVM (or TemplateBasedVM respectively).

Does for me:
qubesdb-read /qubes-vm-type ->TemplateVM

I don't have a standalone VM to test with, but I assume if it as a ProxyVM it reported properly.

I don't know if you can identify if it's a standlone type or not.

Here are available commands paths (qubesdb-list /):

.
name
qubes-block-devices
qubes-debug-mode
qubes-gateway
qubes-ip
qubes-keyboard
qubes-netmask
qubes-secondary-dns
qubes-service/meminfo-writer
qubes-timezone
qubes-usb-devices
qubes-vm-type
qubes-vm-updateable

I have tried all of them. None reveals standalone or not.

Qubes upstream feature request...
qubesdb-read /qubes-template-type -> StandaloneVM / TemplateBasedVM:
https://github.com/QubesOS/qubes-issues/issues/1084

Take a look here:
https://www.qubes-os.org/doc/SystemDoc/VMInterface/
Especially qubes-vm-updatable is almost what you are looking for. It
is True for StandaloneVMs and TemplateVMs. Later you can use
qubes-vm-type to differentiate TemplateVM. In case of R3, you need '/'
in front of those names.

There is no way to know template name from VM based on it. Ok, there are
some hacky way for that, not not something we want to use. Is there any
use case for such information?

Patrick added a subscriber: bnvk.Jul 27 2015, 6:02 PM
In T371#6039, @marmarek wrote:

Take a look here:
https://www.qubes-os.org/doc/SystemDoc/VMInterface/
Especially qubes-vm-updatable is almost what you are looking for. It
is True for StandaloneVMs and TemplateVMs. Later you can use
qubes-vm-type to differentiate TemplateVM.

This will do.

There is no way to know template name from VM based on it. Ok, there are
some hacky way for that, not not something we want to use. Is there any
use case for such information?

Yes. This is the existing whonixcheck update notification (which is sufficient for non-Qubes-Whonix):

Debian Package Update Result: apt-get reports that 15 packages can be updated.
Please update Whonix-Gateway and Whonix-Workstation:
(Open a terminal, Start Menu -> Applications -> System -> Terminal.)
sudo apt-get update && sudo apt-get dist-upgrade

I would like to update the Qubes specific update notification to improve usability. Something like this:

Debian Package Update Result: apt-get reports that 15 packages can be updated.
Please update your Whonix-Gateway TemplateVM whonix-gw-experimental.

  1. Open a terminal, dom0 -> Start Menu -> whonix-gw-experimental -> Terminal.
  2. Update. (sudo apt-get update && sudo apt-get dist-upgrade)
  3. Shutdown the Whonix-Gateway TemplateVM whonix-gw-experimental. (dom 0 -> Qubes VM Manager -> right click whonix-gw-experimental -> Shutdown VM)
  4. Shutdown and restart this TemplateBased ProxyVM sys-whonix.

(dom 0 -> Qubes VM Manager -> right click sys-whonix -> Shutdown VM)

(Using underline for the ProxyVM sys-whonix, because that name can vary [can be freely choose by the user]. And using underline for the name of the template whonix-gw-experimental, because it differs from whonix-ws)

(Maybe @bnvk has any advice for better wording of this message?)

Current window title of whonixcheck for non-Qubes-Whonix:

whonixcheck | Whonix-Gateway | $whonix_deb_package_version | $(date)

That I would like to change for Qubes to something like.

whonixcheck | Whonix-Gateway (ProxyVM) (sys-whonix) (based on TemplateVM whonix-gw-experimental) | $whonix_deb_package_version | $(date)

Or respectively.

whonixcheck | Whonix-Gateway (ProxyVM) (sys-whonix) (StandaloneVM) | $whonix_deb_package_version | $(date)

improved whonixcheck update notification output in Qubes:
https://github.com/Whonix/whonixcheck/commit/efb3f399548d20d739bf7a8a10aa1ff562c53e42

screenshot:

  • /qubes-vm-persistence
  • /qubes-base-template

Add template-related info to qubesdb:
https://github.com/QubesOS/qubes-issues/issues/1101

Patrick closed this task as Resolved.Aug 19 2015, 7:47 PM
Patrick claimed this task.

No more can be done here, before...

In T371#6207, @Patrick wrote:

Add template-related info to qubesdb:
https://github.com/QubesOS/qubes-issues/issues/1101

...gets implemented.

improved output in Qubes by using 'qubesdb-read /qubes-base-template' :
https://github.com/Whonix/whonixcheck/commit/1d1ebc4ed98982d2dcfe396153c12a429b62887a

refactoring, ported from old 'qubesdb-read /qubes-vm-updateable' to new (https://github.com/QubesOS/qubes-issues/issues/1101) more readable 'qubesdb-read /qubes-vm-persistence':
https://github.com/Whonix/whonixcheck/commit/442e94257bd3e3a07bb0f9f9d6ecbd1e8b5e5856