Still works for me, still not reproducible. Old ticket. Therefore closing. Please re-report in the new issue tracker (and link to this old ticket) should this still be an issue.

After running a bunch of tcp ping tests, the conclusion is this attack
is not really effective against TCP like ICMP. The latency is much lower
for TCP pings and though it slightly decreases with cpu stress it is not
consistent. Reloading pages in TBB with cpu stress
on/off does not impact latency readings while doing so with tc
attached has massive latency foot prints - implying it will ironically make such attacks much easier in addition to degrading performance.

Cyrus recommends adding delays per packet to disrupt inter-packet patterns that remain. The command can be fine tuned as such:

The good news is I think I've figured out the equivalent tc-netem command looking the slot parameter in the manual:

Ticket above closed and convo moved to tails-dev.

We should be able to create a drop-in file at /lib/systemd/system/user-.slice.d/ and add something such as

cgroups were mentioned by @madaidan

https://github.com/Whonix/apparmor-profile-everything/pull/7

Could you add to git please?

Works.

Try adding:

https://redmine.tails.boum.org/code/issues/17156

Analysis by Cyrus cited here for completion:

Reported build failures:

When an implementation is decided, let's decide if we can include this in security-misc for use on Linux hosts and Kicksecure. We would need some way in detecting the active NIC since on wireless systems wlan0 is the interface of choice and not eth0

tc-netem is a utility that is part of the iproute2 package in Debian. It leverages functionality already built into Linux and userspace utilities to simulate networks including packet delays and loss.

Looks like mine.

Work for me too in new build https://forums.whonix.org/t/qubes-whonix-15-templatevms-debian-buster-based-4-0-1-201906232114-testers-wanted/7601

I cannot reproduce. I've installed qubes-template-whonix-15-4.0.1-201905241112, updated it with qubes testing repository enabled and I see all the actions available in thunar.
But I do see some warnings on thunar's stderr, like this:

(Thunar:27375): Gtk-WARNING **: 01:41:41.317: Refusing to add non-unique action 'uca-action-1507455450991127-4' to action group 'ThunarActions'

Looks like actions are added multiple times to /etc/xdg/Thunar/uca.xml, which is later copied to /home/user/.cnfig/Thunar/uca.xml. Relevant code in https://github.com/QubesOS/qubes-core-agent-linux/blob/master/debian/qubes-core-agent-thunar.postinst

Any idea why these are missing? @marmarek

• Copy to VM
• Move to VM
• Create Archive...

Might be fixed with upgrades / (over) next Qubes-Whonix images.

Reducing the number of lingering, unrealistic tickets, therefore closing.

https://www.whonix.org/wiki/Multiple_Whonix-Workstations#Multiple_Qubes-Whonix_TemplateVMs

https://github.com/Whonix/anon-meta-packages/blob/master/debian/control

Looks like nothing more to do here.

Since grsecurity is not a thing anymore, closing this as invalid.

I also noticed the file "~/.tb/first-boot-home-population.done" which suggests that whonix does something on first boot

To build a package with qubes-builder, you need to add Makefile.builder file with just one line: DEBIAN_BUILD_DIRS := debian. This will tell qubes-builder that given repository contains Debian package.
Alternatively, if that would be too much of a problem, it should be easy to add an option that do auto detection (probably just looks for debian directory).

Apper no longer installed by default.

In T727#16540, @HulaHoop wrote:

Done. Asked about Xen too but they may not be familiar with its innards. You may want to contact the Xen devs directly using my message as a template.

https://lists.nongnu.org/archive/html/qemu-devel/2018-08/msg00368.html

Playing devil's advocate here: Ted Ts'o [0] expresses strong skepticism about the efficacy of RNGs that rely on CPU jitter. summary: CPU jitter may not be random as thought to someone who designed the CPU cache and know how its internals "tick" [1]. So while these RNGs may not harm, another solution for RNG-less platforms may be a good idea.

An interesting implementation to work around early boot entropy scarcity with havegedis to include it in the initrd. May be hackish but could be easier for Marmarek than writing something at the EFI level.

Done. Asked about Xen too but they may not be familiar with its innards. You may want to contact the Xen devs directly using my message as a template.

I think its worth asking the hypervisor devs if this applies for the platforms we care about.

jitterentropy-rng should solve this

jitterentropy-rng should solve this and is a mainline Linux solution that works the same way haveged does. Please see: https://phabricator.whonix.org/T817

Created way to find out name of gateway from witin VM - qubesdb-read /qubes-gateway-name for it.

In T534#16397, @troubadour wrote:

The easiest way would be to have a new entry for qubesdb-read, in addition to qubes-gateway which holds the IP address.
Something like qubesdb-read /qubes-gateway-name.

For the time being, the vm's whonix gateway is hard coded in two files, the one watching and sending sdwdate satus and the one sending the shutdown notification.

What happens in case of multiple Whonix-Gateway ProxyVMs? I.e. in case of sys-whonix, sys-whonix-two, etc.? How would anon-whonix-two know it has to connect to sys-whonix-two?

Have run the fuzzer unit test simultaneously in sys-whonix and five anon-vm.

Update, after my post in the forum.
https://forums.whonix.org/t/testers-wanted-blocking-networking-until-sdwdate-finished-status-of-sdwdate-gui/5372/3

That's technically too late during boot process. See ticket discussion
above.

Perhaps Qubes guys can have the entropybroker package communicate over the qrexec protocol to seed entropy from a reliable source like Dom0 to the other domains.

Asked. Unfortunately not so.

You can probably use virtio-rng since Qubes now runs on HVM mode and uses QEMU

In T641#15836, @unman wrote:

Installation of pulseaudio-qubes is now included in the 13-14 upgrade guide under Qubes-Whonix instructions.

@Patrick
Installation of pulseaudio-qubes is now included in the 13-14 upgrade guide under Qubes-Whonix instructions.

A new Tor controller GUI.

Added the relevant icon in show_message (after resizing the sdwdate icons from mediawiki, the original are huge).