UX issues with qrexec service confirmation dialogs - missing target default value #3251

na-- · Oct 28, 2017

Qubes OS version:

R4.0 RC2

Affected TemplateVMs:

all (dom0 issue)

Steps to reproduce the behavior:

Try to execute a simple Qubes RPC call, for example try to copy a file from one VM to another with qvm-copy-to-vm, plug in an external keyboard/mouse, use VMAuth (yeah, I know...:) ), sign a git commit with split gpg, etc. - most RPC actions with an ask policy.

Expected behavior:

A simple dialog opens and with minimum friction the user chooses whether to allow the requested action or not.

Actual behavior:

The "Operation execution" dialog is missing a default target value and it always has to be chosen from the dropdown. This leads to significantly more friction (instead of "escape or enter" / "yes or no" quick choice by the user), first the dropdown value has to be populated.

General notes:

That behavior is ok for calls like qvm-copy that do not specify the destination VM initially, but it's annoying for:

actions like VMAuth and InputMouse/InputKeyboard have only one possible target in the dropdown and it should be pre-populated or missing altogether.
actions like qvm-move-to-vm, qvm-copy-to-vm for which I have to write the destination VM twice - once in the command itself and once in the dom0 dialog
automation related stuff like signing git commits with split-gpg - what's the point of specifying /rw/config/gpg-split-domain if I have to enter it again every time anyway

Related issues:

None that I could find

I believe this is intentional, as explained here:
https://www.qubes-os.org/news/2017/10/03/core3/

@marmarek, what do you think?

andrewdavidwong · Oct 28, 2017

I believe this is intentional, as explained here:
https://www.qubes-os.org/news/2017/10/03/core3/

@marmarek, what do you think?

Yes, this is intentional. If for some particular service it is desired to have some default value there, the qrexec policy needs to be adjusted for that, adding default_target= option. For example:

$anyvm sys-usb ask,default_target=sys-usb

As for qvm-copy-to-qvm, in default policy the target parameter is redundant. But it is left there for compatibility reasons. There are friendly wrappers without this argument: qvm-copy, qvm-move - there you provide target VM only once - in confirmation window.

So, I think documentation for some services needs to be adjusted (qubes.VMAuth, split gpg etc), to include default_target= if desired.

marmarek · Oct 28, 2017

Yes, this is intentional. If for some particular service it is desired to have some default value there, the qrexec policy needs to be adjusted for that, adding default_target= option. For example:

$anyvm sys-usb ask,default_target=sys-usb

As for qvm-copy-to-qvm, in default policy the target parameter is redundant. But it is left there for compatibility reasons. There are friendly wrappers without this argument: qvm-copy, qvm-move - there you provide target VM only once - in confirmation window.

So, I think documentation for some services needs to be adjusted (qubes.VMAuth, split gpg etc), to include default_target= if desired.

Thanks, that solves a lot of my issues. The qrexec documentation also needs to be adjusted, there is no mention of default_target= there.

na-- · Oct 28, 2017

Thanks, that solves a lot of my issues. The qrexec documentation also needs to be adjusted, there is no mention of default_target= there.

I think the solution could be to have qvm-copy-to-vm and qvm-move-to-vm print a warning that they are deprecated and that qvm-copy and qvm-move should be used instead.

For instance, I just learned that by reading this bug.

qubesuser · Oct 28, 2017

I think the solution could be to have qvm-copy-to-vm and qvm-move-to-vm print a warning that they are deprecated and that qvm-copy and qvm-move should be used instead.

For instance, I just learned that by reading this bug.

And ideally some help text in the confirmation dialog that says "if you want to specify a target in the VM issuing the request, add a specific allow rule in the Qubes RPC policy for that specific source and target VM combination before the ask rule" (perhaps only shown after clicking on a "I want to specify a target from the VM" hyperlink to avoid polluting the dialog too much).

qubesuser · Oct 28, 2017

And ideally some help text in the confirmation dialog that says "if you want to specify a target in the VM issuing the request, add a specific allow rule in the Qubes RPC policy for that specific source and target VM combination before the ask rule" (perhaps only shown after clicking on a "I want to specify a target from the VM" hyperlink to avoid polluting the dialog too much).

That would encourage such configuration, which not what we want to achieve. In fact this change is especially to take out control over target domain from the source domain, where possible/sensible. But including such cases in documentation (where we have more space, also for recommendations) is a good idea.

marmarek · Oct 28, 2017

That would encourage such configuration, which not what we want to achieve. In fact this change is especially to take out control over target domain from the source domain, where possible/sensible. But including such cases in documentation (where we have more space, also for recommendations) is a good idea.

Added default_target= to documentation: QubesOS/qubes-doc@1fb4b57

marmarek · Dec 13, 2017

Added default_target= to documentation: QubesOS/qubes-doc@1fb4b57

Automated announcement from builder-github

The package qubes-core-agent_4.0.14-1+deb8u1 has been pushed to the r4.0 testing repository for the Debian jessie template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing jessie-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

QubesOS/qubes-issues

Join GitHub today

UX issues with qrexec service confirmation dialogs - missing target default value #3251

Comments

na-- commented Oct 28, 2017

Qubes OS version:

Affected TemplateVMs:

Steps to reproduce the behavior:

Expected behavior:

Actual behavior:

General notes:

Related issues:

This comment has been minimized.

andrewdavidwong commented Oct 28, 2017

andrewdavidwong added C: core UX labels Oct 28, 2017

andrewdavidwong added this to the Release 4.0 milestone Oct 28, 2017

This comment has been minimized.

marmarek commented Oct 28, 2017

This comment has been minimized.

na-- commented Oct 28, 2017

This comment has been minimized.

qubesuser commented Oct 28, 2017

andrewdavidwong added C: doc P: major task and removed C: core UX labels Oct 28, 2017

andrewdavidwong modified the milestones: Release 4.0, Documentation/website Oct 28, 2017

This comment has been minimized.

qubesuser commented Oct 28, 2017 • edited Edited 1 time qubesuser edited Oct 28, 2017 (most recent)

This comment has been minimized.

marmarek commented Oct 28, 2017 • edited Edited 2 times marmarek edited Oct 28, 2017 (most recent) marmarek edited Oct 28, 2017

This comment has been minimized.

marmarek commented Dec 13, 2017

marmarek closed this in marmarek/qubes-core-agent-linux@362e193 Dec 13, 2017

This comment has been minimized.

qubesos-bot commented Dec 15, 2017

qubesos-bot added the r4.0-jessie-cur-test label Dec 15, 2017

qubesos-bot referenced this issue in QubesOS/updates-status Dec 15, 2017

This comment has been minimized.

qubesos-bot commented Dec 15, 2017

qubesos-bot added the r4.0-stretch-cur-test label Dec 15, 2017

This comment has been minimized.

qubesos-bot commented Dec 15, 2017

qubesos-bot added the r4.0-centos7-cur-test label Dec 15, 2017

This comment has been minimized.

qubesos-bot commented Dec 15, 2017

qubesos-bot added the r4.0-fc24-cur-test label Dec 15, 2017

This comment has been minimized.

qubesos-bot commented Dec 15, 2017

qubesos-bot added the r4.0-fc25-cur-test label Dec 15, 2017

This comment has been minimized.

qubesos-bot commented Dec 15, 2017

qubesos-bot added the r4.0-fc26-cur-test label Dec 15, 2017

This comment has been minimized.

qubesos-bot commented Jan 4, 2018

qubesos-bot added r4.0-centos7-stable and removed r4.0-centos7-cur-test labels Jan 4, 2018

This comment has been minimized.

qubesos-bot commented Jan 4, 2018

qubesos-bot added r4.0-fc24-stable and removed r4.0-fc24-cur-test labels Jan 4, 2018

This comment has been minimized.

qubesos-bot commented Jan 5, 2018

qubesos-bot removed the r4.0-jessie-cur-test label Jan 5, 2018

qubesos-bot added the r4.0-jessie-stable label Jan 5, 2018

This comment has been minimized.

qubesos-bot commented Jan 5, 2018

qubesos-bot added r4.0-stretch-stable and removed r4.0-stretch-cur-test labels Jan 5, 2018

This was referenced Jan 19, 2018

qubesos-bot added r4.0-fc25-stable and removed r4.0-fc25-cur-test labels Feb 6, 2018

This comment has been minimized.

qubesos-bot commented Feb 6, 2018

qubesos-bot added r4.0-fc26-stable and removed r4.0-fc26-cur-test labels Feb 6, 2018

andrewdavidwong referenced this issue Feb 14, 2018

qubesuser commented Oct 28, 2017 •

edited

Edited 1 time

qubesuser edited Oct 28, 2017 (most recent)

marmarek commented Oct 28, 2017 •

edited

Edited 2 times

marmarek edited Oct 28, 2017 (most recent)

marmarek edited Oct 28, 2017

marmarek closed this in `marmarek/qubes-core-agent-linux@362e193` Dec 13, 2017