Qubes-Whonix whonixcheck sanity test for 'prevent dom0 telling Qubes-Whonix VMs the time'
Closed, ResolvedPublic
Actions

Description

When prevent dom0 telling Qubes-Whonix VMs the time T397 is implemented, whonixcheck should add a sanity test to see if that won't break over time.

Implementation:

qubes-whonix 12's /etc/qubes-rpc/qubes.SetDateTime[.anondist] can forward everything dom0 is [not] telling to a file.
From there whonixcheck can check if that file exists. If it exists, then T397 is either broken or not yet implemented.

Mentioned Here: T397: prevent dom0 telling Qubes-Whonix VMs the time by using the mgmt stack for that / disable Qubes dom0 /etc/qubes-rpc/qubes.SetDateTime

Patrick updated the task description. (Show Details)

Patrick raised the priority of this task from to Normal.

Patrick claimed this task.

Patrick set Impact to Normal.

/etc/qubes-rpc/qubes.SetDateTime.anondist: dom0 should not tell us its time. But if it does, create a file /var/run/qubes-whonix/qubes.SetDateTime so whonixcheck could warn in case this file exists. - https://phabricator.whonix.org/T398:
https://github.com/Whonix/qubes-whonix/commit/300d09b2514019e67fec16403177092f14504ba2

Added an info level message when running with --verbose if dom0 is telling us the time. As long as https://phabricator.whonix.org/T397 is unsolved. - https://phabricator.whonix.org/T398:
https://github.com/Whonix/whonixcheck/commit/0019e00e28ef85cdd95937d4d1e134335a03af18