Page MenuHomePhabricator

QubesProject
ActivePublic

Recent Activity

Mon, Feb 18

Patrick closed T463: Qubes-Whonix-Workstation DispVM Support as Resolved.

Looks like nothing more to do here.

Mon, Feb 18, 9:39 AM · Whonix, Qubes
Patrick closed T409: qubes-whonix-network.service doesn't provide helpful error message when !CONFIG_DUMMY as Invalid.

Since grsecurity is not a thing anymore, closing this as invalid.

Mon, Feb 18, 9:37 AM · grsecurity, Qubes, Whonix
Patrick updated the task description for T466: Qubes sys-whonix does not do its job as Qubes FirewallVM.
Mon, Feb 18, 9:30 AM · iptables, whonix-gw-firewall, Qubes, Whonix

Feb 16 2019

Patrick closed T894: Tor Browser in whonix-ws-14 based VMs sometimes blocks JavaScript on first start as Resolved.
Feb 16 2019, 1:56 PM · Whonix 15, Whonix 14, Qubes, tb-updater, Whonix
Patrick claimed T894: Tor Browser in whonix-ws-14 based VMs sometimes blocks JavaScript on first start.

I also noticed the file "~/.tb/first-boot-home-population.done" which suggests that whonix does something on first boot

Feb 16 2019, 1:54 PM · Whonix 15, Whonix 14, Qubes, tb-updater, Whonix
Patrick triaged T894: Tor Browser in whonix-ws-14 based VMs sometimes blocks JavaScript on first start as Normal priority.
Feb 16 2019, 9:50 AM · Whonix 15, Whonix 14, Qubes, tb-updater, Whonix

Feb 15 2019

marmarek added a comment to T709: port Whonix package build process to Qubes package build process.

To build a package with qubes-builder, you need to add Makefile.builder file with just one line: DEBIAN_BUILD_DIRS := debian. This will tell qubes-builder that given repository contains Debian package.
Alternatively, if that would be too much of a problem, it should be easy to add an option that do auto detection (probably just looks for debian directory).

Feb 15 2019, 12:20 AM · security, Qubes, build, Whonix

Feb 14 2019

Patrick added projects to T709: port Whonix package build process to Qubes package build process: build, Qubes, security.
Feb 14 2019, 8:01 PM · security, Qubes, build, Whonix

Jan 12 2019

Patrick triaged T888: change Qubes-Whonix default applications from KDE-ish to XFCE-ish as Normal priority.
Jan 12 2019, 7:50 AM · Whonix, Debian version 10 codename Buster, Whonix 15, anon-meta-packages, qubes-template-whonix, Qubes

Dec 9 2018

Patrick lowered the priority of T389: make sure Qubes-Whonix has no access to clocksource=xen from High to Normal.
Dec 9 2018, 6:53 AM · mgmt, research, security, Whonix, Qubes
Patrick lowered the priority of T879: qvm-service infrastructure does not work with whonix-gw-14 template from Normal to Wishlist.
Dec 9 2018, 5:52 AM · Qubes, onion-grater (Control Port Filter Proxy), Whonix

Dec 7 2018

Patrick removed a project from T530: CPU-induced latency Covert Channel Countermeasures: Whonix 15.
Dec 7 2018, 12:06 PM · virtualizer, VMware, VirtualBox, KVM, Qubes, security, Whonix, research
Patrick removed a project from T534: make sdwdate-gui Qubes friendly (sdwdate-gui-qubes): Whonix 15.
Dec 7 2018, 12:06 PM · Whonix, python, Qubes, usability, security, enhancement, sdwdate, sdwdate-gui
Patrick assigned T534: make sdwdate-gui Qubes friendly (sdwdate-gui-qubes) to troubadour.
Dec 7 2018, 12:06 PM · Whonix, python, Qubes, usability, security, enhancement, sdwdate, sdwdate-gui
Patrick removed a project from T466: Qubes sys-whonix does not do its job as Qubes FirewallVM: Whonix 15.
Dec 7 2018, 12:04 PM · iptables, whonix-gw-firewall, Qubes, Whonix
Patrick closed T545: apt-get Qubes instructions as Resolved.
Dec 7 2018, 11:57 AM · Whonix, Whonix 15, user documentation, Qubes
Patrick removed a project from T397: prevent dom0 telling Qubes-Whonix VMs the time by using the mgmt stack for that / disable Qubes dom0 /etc/qubes-rpc/qubes.SetDateTime: Whonix 15.
Dec 7 2018, 11:57 AM · mgmt, Whonix, Qubes, security, bug
Patrick removed a project from T387: Qubes-Whonix-Gateway as ClockVM: Whonix 15.
Dec 7 2018, 11:57 AM · enhancement, security, sdwdate, Qubes, Whonix

Nov 12 2018

Patrick closed T373: Qubes templates: graphical updater (Apper) broken as Resolved.

Apper no longer installed by default.

Nov 12 2018, 8:47 AM · Qubes, usability, enhancement, Whonix
Patrick placed T373: Qubes templates: graphical updater (Apper) broken up for grabs.
Nov 12 2018, 8:43 AM · Qubes, usability, enhancement, Whonix

Sep 20 2018

Patrick added a subtask for T387: Qubes-Whonix-Gateway as ClockVM: T856: whonix TemplateVM time fetching qrexec service.
Sep 20 2018, 11:45 AM · enhancement, security, sdwdate, Qubes, Whonix

Aug 7 2018

Patrick renamed T534: make sdwdate-gui Qubes friendly (sdwdate-gui-qubes) from make sdwdate-gui Qubes friendly to make sdwdate-gui Qubes friendly (sdwdate-gui-qubes).
Aug 7 2018, 6:45 PM · Whonix, python, Qubes, usability, security, enhancement, sdwdate, sdwdate-gui
Patrick renamed T397: prevent dom0 telling Qubes-Whonix VMs the time by using the mgmt stack for that / disable Qubes dom0 /etc/qubes-rpc/qubes.SetDateTime from prevent dom0 telling Qubes-Whonix VMs the time by using the mgmt stack for that to prevent dom0 telling Qubes-Whonix VMs the time by using the mgmt stack for that / disable Qubes dom0 /etc/qubes-rpc/qubes.SetDateTime.
Aug 7 2018, 6:43 PM · mgmt, Whonix, Qubes, security, bug
Patrick updated the task description for T389: make sure Qubes-Whonix has no access to clocksource=xen.
Aug 7 2018, 6:37 PM · mgmt, research, security, Whonix, Qubes

Aug 3 2018

Patrick added a project to T727: solve the Xen entropy scarcity problem / implement something like virtio-rng into Xen upstream: security.
Aug 3 2018, 11:22 AM · security, Qubes, Whonix
Patrick added a comment to T727: solve the Xen entropy scarcity problem / implement something like virtio-rng into Xen upstream.

Done. Asked about Xen too but they may not be familiar with its innards. You may want to contact the Xen devs directly using my message as a template.

https://lists.nongnu.org/archive/html/qemu-devel/2018-08/msg00368.html

Aug 3 2018, 11:21 AM · security, Qubes, Whonix
HulaHoop added a comment to T727: solve the Xen entropy scarcity problem / implement something like virtio-rng into Xen upstream.

Playing devil's advocate here: Ted Ts'o [0] expresses strong skepticism about the efficacy of RNGs that rely on CPU jitter. summary: CPU jitter may not be random as thought to someone who designed the CPU cache and know how its internals "tick" [1]. So while these RNGs may not harm, another solution for RNG-less platforms may be a good idea.

Aug 3 2018, 6:10 AM · security, Qubes, Whonix
HulaHoop added a comment to T727: solve the Xen entropy scarcity problem / implement something like virtio-rng into Xen upstream.

An interesting implementation to work around early boot entropy scarcity with havegedis to include it in the initrd. May be hackish but could be easier for Marmarek than writing something at the EFI level.

Aug 3 2018, 5:53 AM · security, Qubes, Whonix
HulaHoop added a comment to T727: solve the Xen entropy scarcity problem / implement something like virtio-rng into Xen upstream.

Done. Asked about Xen too but they may not be familiar with its innards. You may want to contact the Xen devs directly using my message as a template.

Aug 3 2018, 5:34 AM · security, Qubes, Whonix

Aug 2 2018

HulaHoop added a comment to T727: solve the Xen entropy scarcity problem / implement something like virtio-rng into Xen upstream.

I think its worth asking the hypervisor devs if this applies for the platforms we care about.

Aug 2 2018, 5:33 AM · security, Qubes, Whonix

Jul 31 2018

Patrick added a comment to T727: solve the Xen entropy scarcity problem / implement something like virtio-rng into Xen upstream.

jitterentropy-rng should solve this

Jul 31 2018, 6:38 AM · security, Qubes, Whonix
HulaHoop added a comment to T727: solve the Xen entropy scarcity problem / implement something like virtio-rng into Xen upstream.

jitterentropy-rng should solve this and is a mainline Linux solution that works the same way haveged does. Please see: https://phabricator.whonix.org/T817

Jul 31 2018, 4:23 AM · security, Qubes, Whonix

Jul 24 2018

Patrick closed T788: Qubes-Whonix 14 SaltStack state files required as Resolved.
Jul 24 2018, 11:40 AM · Whonix, Qubes, Whonix 14
Patrick closed T792: make sure qubes-core-admin-addon-whonix gets installed as Resolved.
Jul 24 2018, 11:39 AM · Whonix, Whonix 14, Qubes
Patrick closed T791: qubes-core-admin-addon-whonix / qvm-features-request whonix-ws=1 / add anon-vm tag to whonix-ws-based VMs as Resolved.
Jul 24 2018, 11:38 AM · Whonix, Qubes, Whonix 14

Jul 21 2018

Patrick added a comment to T534: make sdwdate-gui Qubes friendly (sdwdate-gui-qubes).

Created way to find out name of gateway from witin VM - qubesdb-read /qubes-gateway-name for it.

Jul 21 2018, 11:38 AM · Whonix, python, Qubes, usability, security, enhancement, sdwdate, sdwdate-gui

Jul 18 2018

marmarek added a comment to T534: make sdwdate-gui Qubes friendly (sdwdate-gui-qubes).

The easiest way would be to have a new entry for qubesdb-read, in addition to qubes-gateway which holds the IP address.
Something like qubesdb-read /qubes-gateway-name.

Jul 18 2018, 12:12 AM · Whonix, python, Qubes, usability, security, enhancement, sdwdate, sdwdate-gui

Jul 17 2018

troubadour added a comment to T534: make sdwdate-gui Qubes friendly (sdwdate-gui-qubes).

For the time being, the vm's whonix gateway is hard coded in two files, the one watching and sending sdwdate satus and the one sending the shutdown notification.

Jul 17 2018, 11:14 PM · Whonix, python, Qubes, usability, security, enhancement, sdwdate, sdwdate-gui
Patrick added a comment to T534: make sdwdate-gui Qubes friendly (sdwdate-gui-qubes).

What happens in case of multiple Whonix-Gateway ProxyVMs? I.e. in case of sys-whonix, sys-whonix-two, etc.? How would anon-whonix-two know it has to connect to sys-whonix-two?

Jul 17 2018, 9:19 AM · Whonix, python, Qubes, usability, security, enhancement, sdwdate, sdwdate-gui

Jul 15 2018

Patrick updated the task description for T811: document multiple Qubes TemplateVMs.
Jul 15 2018, 12:18 PM · Whonix, Qubes, user documentation
Patrick triaged T811: document multiple Qubes TemplateVMs as Normal priority.
Jul 15 2018, 12:16 PM · Whonix, Qubes, user documentation

Jul 7 2018

troubadour added a comment to T534: make sdwdate-gui Qubes friendly (sdwdate-gui-qubes).

Have run the fuzzer unit test simultaneously in sys-whonix and five anon-vm.

Jul 7 2018, 10:26 PM · Whonix, python, Qubes, usability, security, enhancement, sdwdate, sdwdate-gui

Jul 5 2018

troubadour added a comment to T534: make sdwdate-gui Qubes friendly (sdwdate-gui-qubes).

Update, after my post in the forum.
https://forums.whonix.org/t/testers-wanted-blocking-networking-until-sdwdate-finished-status-of-sdwdate-gui/5372/3

Jul 5 2018, 9:35 PM · Whonix, python, Qubes, usability, security, enhancement, sdwdate, sdwdate-gui

Jun 13 2018

Patrick updated the task description for T788: Qubes-Whonix 14 SaltStack state files required.
Jun 13 2018, 9:33 AM · Whonix, Qubes, Whonix 14

Jun 7 2018

Patrick updated the task description for T791: qubes-core-admin-addon-whonix / qvm-features-request whonix-ws=1 / add anon-vm tag to whonix-ws-based VMs.
Jun 7 2018, 4:37 AM · Whonix, Qubes, Whonix 14

May 30 2018

Patrick added a comment to T727: solve the Xen entropy scarcity problem / implement something like virtio-rng into Xen upstream.

That's technically too late during boot process. See ticket discussion
above.

May 30 2018, 10:29 AM · security, Qubes, Whonix
HulaHoop added a comment to T727: solve the Xen entropy scarcity problem / implement something like virtio-rng into Xen upstream.

Perhaps Qubes guys can have the entropybroker package communicate over the qrexec protocol to seed entropy from a reliable source like Dom0 to the other domains.

May 30 2018, 5:52 AM · security, Qubes, Whonix

May 22 2018

Patrick added a comment to T727: solve the Xen entropy scarcity problem / implement something like virtio-rng into Xen upstream.

Asked. Unfortunately not so.

May 22 2018, 4:32 AM · security, Qubes, Whonix

May 18 2018

HulaHoop added a comment to T727: solve the Xen entropy scarcity problem / implement something like virtio-rng into Xen upstream.

You can probably use virtio-rng since Qubes now runs on HVM mode and uses QEMU

May 18 2018, 3:20 PM · security, Qubes, Whonix

May 9 2018

Patrick renamed T792: make sure qubes-core-admin-addon-whonix gets installed from qubes-template-whonix-gw should depend on qubes-core-admin-addon-whonix to make sure qubes-core-admin-addon-whonix gets installed.
May 9 2018, 12:39 PM · Whonix, Whonix 14, Qubes