Qubes Global Settings crash when updating default netVM

[micahflee]

Qubes OS version:

R4.0

Steps to reproduce the behavior:

Open the Qubes Global Settings program, change the default netVM to something else, and click OK.

Expected behavior:

It should save and update the default netVM.

Actual behavior:

Crash, and the default netVM doesn't get updated.

[donob4n]

It seems that your 'sys-vpn-mullvad' netVM is set to default netVM so changing the default netVM is causing a loop. Try setting it to sys-net or sys-firewall before editing default netVM.

[donob4n]

It seems that your 'sys-vpn-mullvad' netVM is set to default netVM so changing the default netVM is causing a loop. Try setting it to sys-net or sys-firewall before editing default netVM.

[micahflee]

When I open Qubes Global Settings the UI says my default netVM is sys-firewall. I can change it to sys-net and save, and that works fine. When I open it again, the UI says it's sys-net. But if I then change it to sys-vpn-mullvad, I get the same crash. But I can successfully change it back to sys-firewall -- so apparently it's just changing it to my custom proxyVM that's causes it.

After trying (and failing) to set it to sys-vpn-mullvad, when I open fedora-26 dispVM its netVM is sys-firewall, so apparently it's not actually set.

What are the terminal commands for adjusting the global settings?

[micahflee]

When I open Qubes Global Settings the UI says my default netVM is sys-firewall. I can change it to sys-net and save, and that works fine. When I open it again, the UI says it's sys-net. But if I then change it to sys-vpn-mullvad, I get the same crash. But I can successfully change it back to sys-firewall -- so apparently it's just changing it to my custom proxyVM that's causes it.

After trying (and failing) to set it to sys-vpn-mullvad, when I open fedora-26 dispVM its netVM is sys-firewall, so apparently it's not actually set.

What are the terminal commands for adjusting the global settings?

[donob4n]

@micahflee I meant to change sys-vpn-mullvad to sys-net or sys-firewall before changing the default netVM, have you tried?

[donob4n]

@micahflee I meant to change sys-vpn-mullvad to sys-net or sys-firewall before changing the default netVM, have you tried?

[micahflee]

I'm not sure what you mean. In Qubes Global Settings I can change the default netVM to either sys-net or sys-firewall, and saving works fine. If I try changing it to sys-vpn-mullvad, I get that crash (no matter what it was before). And sys-vpn-mullvad's netVM is sys-firewall.

[micahflee]

I'm not sure what you mean. In Qubes Global Settings I can change the default netVM to either sys-net or sys-firewall, and saving works fine. If I try changing it to sys-vpn-mullvad, I get that crash (no matter what it was before). And sys-vpn-mullvad's netVM is sys-firewall.

[micahflee]

I've also reproduced this problem on two separate computers with different hardware running Qubes 4.0.

[micahflee]

I've also reproduced this problem on two separate computers with different hardware running Qubes 4.0.

[marmarek]

Make sure sys-vpn-mullvad's netvm is set to "sys-firewall", not "default (sys-firewall)".

[marmarek]

Make sure sys-vpn-mullvad's netvm is set to "sys-firewall", not "default (sys-firewall)".

[micahflee]

Excellent, that fixed it.

Maybe this step could be automatic, because it's not immediately intuitive that there's a difference between "default (sys-firewall)" and "sys-firewall".

[micahflee]

Excellent, that fixed it.

Maybe this step could be automatic, because it's not immediately intuitive that there's a difference between "default (sys-firewall)" and "sys-firewall".

[marmarek]

Maybe some tooltip/help text there? @marmarta @andrewdavidwong

[marmarek]

Maybe some tooltip/help text there? @marmarta @andrewdavidwong

[micahflee]

Or maybe Qubes Global Settings can catch this error and display some sort of instructions if a user hits it.

[micahflee]

Or maybe Qubes Global Settings can catch this error and display some sort of instructions if a user hits it.

[andrewdavidwong]

Maybe some tooltip/help text there?

Sounds like a great candidate for #2211.

Perhaps something like:

"default (<vm-name>) denotes the NetVM currently set as the system-wide default. If you change the system-wide default to a different NetVM, then any VM currently set to use default (<vm-name>) will use the new NetVM. If you want a VM to keep using the currently displayed <vm-name> even if the system-wide default changes, select <vm-name> (without the word default in front of it) directly from the list."

This could be clearer, but it's a start.

[andrewdavidwong]

Maybe some tooltip/help text there?

Sounds like a great candidate for #2211.

Perhaps something like:

"default (<vm-name>) denotes the NetVM currently set as the system-wide default. If you change the system-wide default to a different NetVM, then any VM currently set to use default (<vm-name>) will use the new NetVM. If you want a VM to keep using the currently displayed <vm-name> even if the system-wide default changes, select <vm-name> (without the word default in front of it) directly from the list."

This could be clearer, but it's a start.

[donob4n]

What do you think about changing the behavior of 'default netVM'? I think that it would be better to use it only for 'default netVM' selection when doing new domains.

Currently, apart of problems like this, it has too wide side effects. It's pretty easy to change the NetVM of a domain (or more) that you didn't want to.

[donob4n]

What do you think about changing the behavior of 'default netVM'? I think that it would be better to use it only for 'default netVM' selection when doing new domains.

Currently, apart of problems like this, it has too wide side effects. It's pretty easy to change the NetVM of a domain (or more) that you didn't want to.

[marmarta]

I don't think this change is a good idea - in practice, this would mean eliminating 'default' as a setting for VM's netVM, because otherwise it would produce inconsistent results ('default' for one VM would mean something different than for another VM). And the possibility of changing netVM for a bunch of VMs like that is - I think - pretty useful. What can be done (and I'll do it in a moment) is making clearer in the Qube Manager (and, hopefully qvm-ls) that a VM has the 'default' netVM set.

[marmarta]

I don't think this change is a good idea - in practice, this would mean eliminating 'default' as a setting for VM's netVM, because otherwise it would produce inconsistent results ('default' for one VM would mean something different than for another VM). And the possibility of changing netVM for a bunch of VMs like that is - I think - pretty useful. What can be done (and I'll do it in a moment) is making clearer in the Qube Manager (and, hopefully qvm-ls) that a VM has the 'default' netVM set.