Split GPG with Thunderbird+Enigmail - frequent qubes.Gpg dialog prompts

[mossy-nw]

Qubes OS version:

R4.0_rc3

Affected TemplateVMs:

fedora-26
debian-9
probably any others used with split-gpg

---

Steps to reproduce the behavior:

• Configure split-GPG for Thunderbird + Enigmail according to qubes-split-gpg
• save, send, read, or verify GPG encrypted or signed emails

Expected behavior:

• enter VM name/click to confirm operation on VM containing GPG private key

Actual behavior:

• dom0 qubes.Gpg dialog pops up repeatedly prompting for VM name containing GPG private key. Pops up at least once for each single email, and as many as 4-5 times in a row to send a signed and encrypted email.

General notes:

• it's still functional, but usability suffers greatly.

---

Related issues:

possibly related to recent deprecation of qvm-copy-to-vm/qvm-move-to-vm tools (now requiring entering destination VM in dom0 dialog)?

[tasket]

Discussion - https://groups.google.com/d/msgid/qubes-users/8e8080b9-8422-0dc3-eff5-097deb995be4%40posteo.net

---

I'd like to emphasize that merely browsing signed messages triggers multiple dialog prompts for each message. This makes Enigmail unbearable in its intended capacity as an overall guard against forgery.

Of course, you can enable it just for signing, but if other people similarly don't enable it for general reading then the utility of signing is diminished.

[tasket]

Discussion - https://groups.google.com/d/msgid/qubes-users/8e8080b9-8422-0dc3-eff5-097deb995be4%40posteo.net

---

I'd like to emphasize that merely browsing signed messages triggers multiple dialog prompts for each message. This makes Enigmail unbearable in its intended capacity as an overall guard against forgery.

Of course, you can enable it just for signing, but if other people similarly don't enable it for general reading then the utility of signing is diminished.

[mossy-nw]

not yet able to confirm but think this could be fixed in R4.0 using appropriate qrexec policy. See #3251 and https://www.qubes-os.org/news/2017/10/03/core3/

[mossy-nw]

not yet able to confirm but think this could be fixed in R4.0 using appropriate qrexec policy. See #3251 and https://www.qubes-os.org/news/2017/10/03/core3/

[mossy-nw]

OK this fixes it! Edit the file /etc/qubes-rpc/policy/qubes.Gpg to:

clientVM  keysVM  allow
$anyvm  $anyvm  ask

where client is your thunderbird+enigmail VM and keys is where your GPG private keys live. I'll update the docs and then close this issue.

[mossy-nw]

OK this fixes it! Edit the file /etc/qubes-rpc/policy/qubes.Gpg to:

clientVM  keysVM  allow
$anyvm  $anyvm  ask

where client is your thunderbird+enigmail VM and keys is where your GPG private keys live. I'll update the docs and then close this issue.

[mossy-nw]

tasket:

Discussion - https://groups.google.com/d/msgid/qubes-users/8e8080b9-8422-0dc3-eff5-097deb995be4%40posteo.net --- I'd like to emphasize that merely browsing signed messages triggers multiple dialog prompts for _each_ message. This makes Enigmail unbearable in its intended capacity as an overall guard against forgery. Of course, you can enable it just for _signing_, but if other people similarly don't enable it for general _reading_ then the utility of signing is diminished.

To restore R3.2 split-gpg behavior to R4.0,  edit the file /etc/qubes-rpc/policy/qubes.Gpg to: clientVM  keysVM  allow $anyvm  $anyvm  ask where client is your thunderbird+enigmail VM and keys is where your GPG private keys live.  I added this to the split-gpg documentation. HTH,

…

-m0ssy

[mossy-nw]

tasket:

Discussion - https://groups.google.com/d/msgid/qubes-users/8e8080b9-8422-0dc3-eff5-097deb995be4%40posteo.net --- I'd like to emphasize that merely browsing signed messages triggers multiple dialog prompts for _each_ message. This makes Enigmail unbearable in its intended capacity as an overall guard against forgery. Of course, you can enable it just for _signing_, but if other people similarly don't enable it for general _reading_ then the utility of signing is diminished.

To restore R3.2 split-gpg behavior to R4.0,  edit the file /etc/qubes-rpc/policy/qubes.Gpg to: clientVM  keysVM  allow $anyvm  $anyvm  ask where client is your thunderbird+enigmail VM and keys is where your GPG private keys live.  I added this to the split-gpg documentation. HTH,

…

-m0ssy

[tasket]

@mossy-nw OK, thanks!

[tasket]

@mossy-nw OK, thanks!

[mfc]

created pull request moving this content to appropriate section of documentation: QubesOS/qubes-doc#676

[mfc]

created pull request moving this content to appropriate section of documentation: QubesOS/qubes-doc#676