Display a privacy risk warning when attempting to change anon-whonix's default_dispvm value

[andrewdavidwong]

Qubes OS version:

R4.0-rc4

Affected TemplateVMs:

whonix-ws

---

Steps to reproduce the behavior:

In a default R4.0-rc4 installation, launch a DispVM from anon-whonix.

Change anon-whonix's default_dispvm setting to something other than whonix-ws-dvm.

Expected behavior:

The DispVM uses sys-whonix as its NetVM so that its traffic is Torified.

The user is warned about the privacy implications of doing this.

Actual behavior:

The DispVM uses sys-net as its NetVM, resulting in a high risk of deanonymization.

No warning is given.

General notes:

See: QubesOS/qubes-doc#538 (comment)

---

CC: @adrelanos

[andrewdavidwong]

Looks like we might need confirmation about whether the reported behavior is actually the default:

QubesOS/qubes-doc#538 (comment)

Even if it's not the default, however, it might be worth considering having some kind of warning in case the user gets themselves into this situation.

[andrewdavidwong]

Looks like we might need confirmation about whether the reported behavior is actually the default:

QubesOS/qubes-doc#538 (comment)

Even if it's not the default, however, it might be worth considering having some kind of warning in case the user gets themselves into this situation.

[awokd]

Fresh install of R4.0rc4 and anon-whonix's default_dispvm is set to whonix-ws-dvm. netvm on both is set to sys-whonix, so out of the box this is not an issue.
Changing the system default dispvm with qubes-prefs does NOT change default_dispvm in anon-whonix or whonix-ws-dvm.
So it's not a default/out of the box concern, but the system does let people shoot themselves in the foot if they start changing anon-whonix or whonix-ws-dvm values around. I'll revise the the doc PR accordingly.

[awokd]

Fresh install of R4.0rc4 and anon-whonix's default_dispvm is set to whonix-ws-dvm. netvm on both is set to sys-whonix, so out of the box this is not an issue.
Changing the system default dispvm with qubes-prefs does NOT change default_dispvm in anon-whonix or whonix-ws-dvm.
So it's not a default/out of the box concern, but the system does let people shoot themselves in the foot if they start changing anon-whonix or whonix-ws-dvm values around. I'll revise the the doc PR accordingly.

[awokd]

However @andrewdavidwong , the Qube Setting GUI is a bit buggy. If I use it to view anon-whonix's default_dispvm on the advanced tab, it claims it's set to the qubes-prefs' default_dispvm, even though it's actually using the value in qvm-prefs anon-whonix default_dispvm. I think there might be a similar issue out there too about the kernel value on this tab.
Also, hitting the drop-down for dispvm only lists default and (none), when I'd expect it to list all templates where template_for_dispvms = true.

[awokd]

However @andrewdavidwong , the Qube Setting GUI is a bit buggy. If I use it to view anon-whonix's default_dispvm on the advanced tab, it claims it's set to the qubes-prefs' default_dispvm, even though it's actually using the value in qvm-prefs anon-whonix default_dispvm. I think there might be a similar issue out there too about the kernel value on this tab.
Also, hitting the drop-down for dispvm only lists default and (none), when I'd expect it to list all templates where template_for_dispvms = true.

[andrewdavidwong]

Thanks for checking and documenting, @awokd. I'll update this issue to be one about footgun protection and open another one for the general Qube Setting GUI buginess.

[andrewdavidwong]

Thanks for checking and documenting, @awokd. I'll update this issue to be one about footgun protection and open another one for the general Qube Setting GUI buginess.

[andrewdavidwong]

In #3595 (comment), @mirrorway reports that the one whonix-ws-based VM that happens to be pre-made with the name anon-whonix does not exhibit this problem, but all the subsequent use-created ones do.

[andrewdavidwong]

In #3595 (comment), @mirrorway reports that the one whonix-ws-based VM that happens to be pre-made with the name anon-whonix does not exhibit this problem, but all the subsequent use-created ones do.