/qubes-issues

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

/var/run/qubes-service qvm-sevice available too late breaks systemd services #1985

Closed
adrelanos opened this Issue May 11, 2016 · 14 comments

Comments

Assignees
No one assigned
Labels
Projects
None yet
Milestone
  Release 3.0 updates
3 participants
@adrelanos @marmarek @andrewdavidwong
@adrelanos
Member

adrelanos commented May 11, 2016

Qubes OS version

R3.1

Affected TemplateVMs

debian-8 (standalone)

Steps to reproduce the behavior:

Qubes VM Manager -> right click on VM -> services -> enter (without the single quotes) 'netfilter-persistent' -> click on + -> OK

Start VM.

user@sys-vpn:~$ sudo service netfilter-persistent status
● netfilter-persistent.service - netfilter persistent configuration
   Loaded: loaded (/lib/systemd/system/netfilter-persistent.service; enabled)
  Drop-In: /lib/systemd/system/netfilter-persistent.service.d
           └─30_qubes.conf
   Active: inactive (dead)
           start condition failed at Wed 2016-05-11 23:45:35 CEST; 25s ago
           ConditionPathExists=/var/run/qubes-service/netfilter-persistent was not met

May 11 23:45:35 localhost systemd[1]: Started netfilter persistent configuration.

user@sys-vpn:~$ ls /var/run/qubes-service/netfilter-persistent
/var/run/qubes-service/netfilter-persistent

Expected behavior:

/var/run/qubes-service files should be readable before netfilter-persistent (or any other) systemd service starts.

Actual behavior:

/var/run/qubes-service is available too late.

General notes:

This breaks VPN-Firewall. (A project maintained by me that could theoretically in future provide a bulletproof sys-vpn implementation, that (in development branch) would also defeat fixed shared VPN/Tor server leak bug (adrelanos/vpn-firewall#12) and solve #1941.

Related issues:

#1941

@adrelanos adrelanos referenced this issue May 11, 2016

Closed

Qubes VPN documentation limitations #1941

@andrewdavidwong andrewdavidwong added bug C: Debian labels May 11, 2016

@adrelanos adrelanos referenced this issue in adrelanos/vpn-firewall May 11, 2016

Closed

Qubes AppVMs support #13

marmarek added a commit to marmarek/old-qubes-core-agent-linux that referenced this issue May 11, 2016

@marmarek
systemd: order units checking for qubes-service after qubes-sysinit 
Files in /var/run/qubes-service are created by qubes-sysinit.service. So
defer that condition check after that service start.

Fixes QubesOS/qubes-issues#1985
Verified
This commit was signed with a verified signature.
@marmarek marmarek Marek Marczykowski-Górecki
GPG key ID: 063938BA42CFA724 Learn about signing commits
1cf4fd3

marmarek added a commit to marmarek/old-qubes-core-agent-linux that referenced this issue May 11, 2016

@marmarek
systemd: order units checking for qubes-service after qubes-sysinit 
Files in /var/run/qubes-service are created by qubes-sysinit.service. So
defer that condition check after that service start.

Thanks @adrelanos for the report.

Fixes QubesOS/qubes-issues#1985
Verified
This commit was signed with a verified signature.
@marmarek marmarek Marek Marczykowski-Górecki
GPG key ID: 063938BA42CFA724 Learn about signing commits
5e08e2b

@marmarek marmarek referenced this issue in marmarek/old-qubes-core-agent-linux May 11, 2016

Merged

systemd: order units checking for qubes-service after qubes-sysinit #72

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek May 11, 2016

Member

Take a look at attached PR. Does it fix the problem for you (you can check for that service only)?
Member

marmarek commented May 11, 2016

Take a look at attached PR. Does it fix the problem for you (you can check for that service only)?
@adrelanos

This comment has been minimized.

Show comment
Hide comment
@adrelanos

adrelanos May 11, 2016

Member

This was quick. Awesome. Works for me.

(I will be shipping a separate drop-in file as workaround for vpn-firewall until this ends up in stable. Should not matter.)
Member

adrelanos commented May 11, 2016

This was quick. Awesome. Works for me.

(I will be shipping a separate drop-in file as workaround for vpn-firewall until this ends up in stable. Should not matter.)

adrelanos added a commit to adrelanos/vpn-firewall that referenced this issue May 11, 2016

@adrelanos
workaround for Qubes bug 
/var/run/qubes-service qvm-sevice available too late breaks systemd services
QubesOS/qubes-issues#1985
Verified
This commit was signed with a verified signature.
@adrelanos adrelanos Patrick Schleizer
GPG key ID: CB8D50BB77BB3C48 Learn about signing commits
b2243b5

@marmarek marmarek added this to the Release 3.0 updates milestone May 17, 2016

@marmarek marmarek closed this in marmarek/old-qubes-core-agent-linux#72 May 18, 2016

marmarek added a commit to QubesOS/qubes-core-agent-linux that referenced this issue Jun 25, 2016

@marmarek
systemd: order units checking for qubes-service after qubes-sysinit 
Files in /var/run/qubes-service are created by qubes-sysinit.service. So
defer that condition check after that service start.

Thanks @adrelanos for the report.

Fixes QubesOS/qubes-issues#1985

(cherry picked from commit 5e08e2b)
Verified
This commit was signed with a verified signature.
@marmarek marmarek Marek Marczykowski-Górecki
GPG key ID: 063938BA42CFA724 Learn about signing commits
5c1ba0b
@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Jun 25, 2016

Member

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.1.17-1.fc21 has been pushed to the r3.1 testing repository for the Fedora fc21 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.1-current-testing

Changes included in this update
Member

marmarek commented Jun 25, 2016

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.1.17-1.fc21 has been pushed to the r3.1 testing repository for the Fedora fc21 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.1-current-testing

Changes included in this update

@marmarek marmarek added the r3.1-fc21-cur-test label Jun 25, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Jun 25, 2016

Member

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.1.17-1.fc22 has been pushed to the r3.1 testing repository for the Fedora fc22 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.1-current-testing

Changes included in this update
Member

marmarek commented Jun 25, 2016

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.1.17-1.fc22 has been pushed to the r3.1 testing repository for the Fedora fc22 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.1-current-testing

Changes included in this update

@marmarek marmarek added the r3.1-fc22-cur-test label Jun 25, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Jun 25, 2016

Member

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.1.17-1.fc23 has been pushed to the r3.1 testing repository for the Fedora fc23 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.1-current-testing

Changes included in this update
Member

marmarek commented Jun 25, 2016

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.1.17-1.fc23 has been pushed to the r3.1 testing repository for the Fedora fc23 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.1-current-testing

Changes included in this update

@marmarek marmarek added the r3.1-fc23-cur-test label Jun 25, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Jun 25, 2016

Member

Automated announcement from builder-github

The package qubes-core-agent_3.1.17-1+deb8u1 has been pushed to the r3.1 testing repository for the Debian jessie template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing jessie-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update
Member

marmarek commented Jun 25, 2016

Automated announcement from builder-github

The package qubes-core-agent_3.1.17-1+deb8u1 has been pushed to the r3.1 testing repository for the Debian jessie template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing jessie-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

@marmarek marmarek added the r3.1-jessie-cur-test label Jun 25, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Jun 25, 2016

Member

Automated announcement from builder-github

The package qubes-core-agent_3.1.17-1+deb9u1 has been pushed to the r3.1 testing repository for the Debian stretch template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update
Member

marmarek commented Jun 25, 2016

Automated announcement from builder-github

The package qubes-core-agent_3.1.17-1+deb9u1 has been pushed to the r3.1 testing repository for the Debian stretch template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

@marmarek marmarek added the r3.1-stretch-cur-test label Jun 25, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Jun 25, 2016

Member

Automated announcement from builder-github

The package qubes-core-agent_3.1.17-1+deb7u1 has been pushed to the r3.1 testing repository for the Debian wheezy template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing wheezy-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update
Member

marmarek commented Jun 25, 2016

Automated announcement from builder-github

The package qubes-core-agent_3.1.17-1+deb7u1 has been pushed to the r3.1 testing repository for the Debian wheezy template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing wheezy-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

@marmarek marmarek added the r3.1-wheezy-cur-test label Jun 25, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Jul 25, 2016

Member

Automated announcement from builder-github

The package qubes-upgrade-vm-3.1-1.fc21 has been pushed to the r3.1 stable repository for the Fedora fc21 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update
Member

marmarek commented Jul 25, 2016

Automated announcement from builder-github

The package qubes-upgrade-vm-3.1-1.fc21 has been pushed to the r3.1 stable repository for the Fedora fc21 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

@marmarek marmarek added r3.1-fc21-stable and removed r3.1-fc21-cur-test labels Jul 25, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Jul 25, 2016

Member

Automated announcement from builder-github

The package qubes-upgrade-vm-3.1-1.fc22 has been pushed to the r3.1 stable repository for the Fedora fc22 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update
Member

marmarek commented Jul 25, 2016

Automated announcement from builder-github

The package qubes-upgrade-vm-3.1-1.fc22 has been pushed to the r3.1 stable repository for the Fedora fc22 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

@marmarek marmarek added r3.1-fc22-stable and removed r3.1-fc22-cur-test labels Jul 25, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Jul 25, 2016

Member

Automated announcement from builder-github

The package qubes-upgrade-vm-3.1-1.fc23 has been pushed to the r3.1 stable repository for the Fedora fc23 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update
Member

marmarek commented Jul 25, 2016

Automated announcement from builder-github

The package qubes-upgrade-vm-3.1-1.fc23 has been pushed to the r3.1 stable repository for the Fedora fc23 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

@marmarek marmarek added r3.1-fc23-stable and removed r3.1-fc23-cur-test labels Jul 25, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Jul 25, 2016

Member

Automated announcement from builder-github

The package qubes-core-agent_3.1.17-1+deb8u1 has been pushed to the r3.1 stable repository for the Debian jessie template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update
Member

marmarek commented Jul 25, 2016

Automated announcement from builder-github

The package qubes-core-agent_3.1.17-1+deb8u1 has been pushed to the r3.1 stable repository for the Debian jessie template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

@marmarek marmarek added r3.1-jessie-stable and removed r3.1-jessie-cur-test labels Jul 25, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Jul 25, 2016

Member

Automated announcement from builder-github

The package qubes-core-agent_3.1.17-1+deb9u1 has been pushed to the r3.1 stable repository for the Debian stretch template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update
Member

marmarek commented Jul 25, 2016

Automated announcement from builder-github

The package qubes-core-agent_3.1.17-1+deb9u1 has been pushed to the r3.1 stable repository for the Debian stretch template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

@marmarek marmarek added r3.1-stretch-stable and removed r3.1-stretch-cur-test labels Jul 25, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Jul 25, 2016

Member

Automated announcement from builder-github

The package qubes-core-agent_3.1.17-1+deb7u1 has been pushed to the r3.1 stable repository for the Debian wheezy template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update
Member

marmarek commented Jul 25, 2016

Automated announcement from builder-github

The package qubes-core-agent_3.1.17-1+deb7u1 has been pushed to the r3.1 stable repository for the Debian wheezy template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

@marmarek marmarek added r3.1-wheezy-stable and removed r3.1-wheezy-cur-test labels Jul 25, 2016

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment