qubes-core-agent 3.2.27-1 breaks sudo on debian template

[qubenix]

Qubes OS version:

R3.2

Affected component(s):

Debian stretch, Whonix 13, and debian jessie templates and appvms using these templates.

---

Steps to reproduce the behavior:

In a debian stretch template, with dom0 prompt for sudo, upgrade qubes-core-agent using the stretch-testing repo. Or in Whonix13/debian jessie upgrade from jessie-testing.

Expected behavior:

Upgrade successful.

Actual behavior:

In debian stretch template there is a qrexec-client-vm error at the end of the upgrade. After restart no sudo is allowed.

sudo apt-get update && sudo apt-get install qubes-core-agent
Get:1 http://deb.qubesos4rrrrz6n4.onion/r3.2/vm stretch-testing InRelease [2,513 B]
Get:2 http://sgvtcaew4bxjd7ln.onion stretch/updates InRelease [63.0 kB]        
Ign:3 http://vwakviie2ienjx6t.onion/debian stretch InRelease                   
Get:4 http://deb.qubesos4rrrrz6n4.onion/r3.2/vm stretch-testing/main amd64 Packages [13.1 kB]
Get:5 http://sgvtcaew4bxjd7ln.onion stretch/updates/main amd64 Packages [361 kB]
Hit:6 http://vwakviie2ienjx6t.onion/debian stretch Release
Get:8 http://sgvtcaew4bxjd7ln.onion stretch/updates/main Translation-en [158 kB]
Fetched 598 kB in 44s (13.4 kB/s)       
Reading package lists... Done
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages will be upgraded:
  qubes-core-agent
1 upgraded, 0 newly installed, 0 to remove and 12 not upgraded.
Need to get 93.2 kB of archives.
After this operation, 18.4 kB of additional disk space will be used.
Get:1 http://deb.qubesos4rrrrz6n4.onion/r3.2/vm stretch-testing/main amd64 qubes-core-agent amd64 3.2.27-1+deb9u1 [93.2 kB]
Fetched 93.2 kB in 41s (2,259 B/s)        
(Reading database ... 138860 files and directories currently installed.)
Preparing to unpack .../qubes-core-agent_3.2.27-1+deb9u1_amd64.deb ...
Unpacking qubes-core-agent (3.2.27-1+deb9u1) over (3.2.26-1+deb9u1) ...
Setting up qubes-core-agent (3.2.27-1+deb9u1) ...
Installing new version of config file /etc/NetworkManager/dispatcher.d/qubes-nmhook ...
Installing new version of config file /etc/systemd/system/haveged.service ...
Removed /etc/systemd/system/multi-user.target.wants/haveged.service.
Created symlink /etc/systemd/system/multi-user.target.wants/haveged.service → /etc/systemd/system/haveged.service.
Leaving 'diversion of /etc/init/plymouth-shutdown.conf to /etc/init/plymouth-shutdown.conf.qubes-disabled by qubes-core-agent'
Leaving 'diversion of /etc/init/prefdm.conf to /etc/init/prefdm.conf.qubes-disabled by qubes-core-agent'
Leaving 'diversion of /etc/init/splash-manager.conf to /etc/init/splash-manager.conf.qubes-disabled by qubes-core-agent'
Leaving 'diversion of /etc/init/start-ttys.conf to /etc/init/start-ttys.conf.qubes-disabled by qubes-core-agent'
Leaving 'diversion of /etc/init/tty.conf to /etc/init/tty.conf.qubes-disabled by qubes-core-agent'
Leaving 'diversion of /etc/init/serial.conf to /etc/init/serial.conf.qubes-orig by qubes-core-agent'
qubes-update-check.service is a disabled or a static unit, not starting it.
Processing triggers for libglib2.0-0:amd64 (2.50.3-2) ...
/usr/lib/qubes/qrexec-client-vm: invalid option -- 'c'
usage: /usr/lib/qubes/qrexec-client-vm [--buffer-size=BUFFER_SIZE] target_vmname program_ident [local_program [local program arguments]]
BUFFER_SIZE is minimum vchan buffer size (default: 64k)

After restarting the template or starting an appvm based on this template, will get this error:

user@host:~$ sudo su
/usr/lib/qubes/qrexec-client-vm failed: exit code 2
sudo: PAM authentication error: System error

General notes:

I set dom0 prompt for sudo on all my templates using the docs a year ago or more. I'm not sure if that's related to this and I see there is at least one new thing added to the dom0 policy in the current version of the guide, but it seems to be for r4.0 if I'm not mistaken.

Edited to add Whonix13 and debian jessie to affected list.

---

Related issues:

[qubenix]

Also affects Whonix13 and debian jessie templates/appvms upgraded from jessie-testing as they receive the same qubes-core-agent version.

[qubenix]

Also affects Whonix13 and debian jessie templates/appvms upgraded from jessie-testing as they receive the same qubes-core-agent version.

[marmarek]

The error message invalid option -- 'c' suggests you've done something different because that documentation page doesn't have -c anywhere. Anyway, this is irrelevant here,

For now a workaround: add -- after qubes.VMAuth in qrexec-client-vm.

[marmarek]

The error message invalid option -- 'c' suggests you've done something different because that documentation page doesn't have -c anywhere. Anyway, this is irrelevant here,

For now a workaround: add -- after qubes.VMAuth in qrexec-client-vm.

[qubenix]

I don't understand, that documentation I've followed a year ago and this just affects me now. I didn't issue a -c, that qrexec-client-vm is called as part of the upgrade. This affects about 10 of my templates all of a sudden with no changes on my part, especially no change that I spread to every one of my Debian and Whonix templates.

Where am I supposed to add the -- in your workaround?

[qubenix]

I don't understand, that documentation I've followed a year ago and this just affects me now. I didn't issue a -c, that qrexec-client-vm is called as part of the upgrade. This affects about 10 of my templates all of a sudden with no changes on my part, especially no change that I spread to every one of my Debian and Whonix templates.

Where am I supposed to add the -- in your workaround?

[marmarek]

In /etc/pam.d/system-auth, on pam_exec.so line

[marmarek]

In /etc/pam.d/system-auth, on pam_exec.so line

[qubenix]

Like this?

user@d9-comms:~$ cat /etc/pam.d/common-auth | grep pam_exec.so
auth       [success=done default=die]  pam_exec.so seteuid /usr/lib/qubes/qrexec-client-vm dom0 qubes.VMAuth -- /bin/grep -q ^1$
user@d9-comms:~$ sudo apt-mark unhold qubes-core-agent
Canceled hold on qubes-core-agent.
user@d9-comms:~$ sudo apt-get update && sudo apt-get dist-upgrade
Hit:1 https://updates.signal.org/desktop/apt xenial InRelease
Hit:2 http://deb.qubesos4rrrrz6n4.onion/r3.2/vm stretch-testing InRelease
Get:3 http://sgvtcaew4bxjd7ln.onion stretch/updates InRelease [63.0 kB]  
Ign:4 http://vwakviie2ienjx6t.onion/debian stretch InRelease
Hit:5 http://vwakviie2ienjx6t.onion/debian stretch Release                                   
Fetched 63.0 kB in 54s (1,147 B/s)                                                           
Reading package lists... Done
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Calculating upgrade... Done
The following packages will be upgraded:
  qubes-core-agent
1 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B/93.2 kB of archives.
After this operation, 18.4 kB of additional disk space will be used.
Do you want to continue? [Y/n] y
(Reading database ... 104113 files and directories currently installed.)
Preparing to unpack .../qubes-core-agent_3.2.27-1+deb9u1_amd64.deb ...
Unpacking qubes-core-agent (3.2.27-1+deb9u1) over (3.2.26-1+deb9u1) ...
Setting up qubes-core-agent (3.2.27-1+deb9u1) ...
Installing new version of config file /etc/NetworkManager/dispatcher.d/qubes-nmhook ...
Removed /etc/systemd/system/multi-user.target.wants/haveged.service.
Created symlink /etc/systemd/system/multi-user.target.wants/haveged.service → /etc/systemd/system/haveged.service.
Leaving 'diversion of /etc/init/plymouth-shutdown.conf to /etc/init/plymouth-shutdown.conf.qubes-disabled by qubes-core-agent'
Leaving 'diversion of /etc/init/prefdm.conf to /etc/init/prefdm.conf.qubes-disabled by qubes-core-agent'
Leaving 'diversion of /etc/init/splash-manager.conf to /etc/init/splash-manager.conf.qubes-disabled by qubes-core-agent'
Leaving 'diversion of /etc/init/start-ttys.conf to /etc/init/start-ttys.conf.qubes-disabled by qubes-core-agent'
Leaving 'diversion of /etc/init/tty.conf to /etc/init/tty.conf.qubes-disabled by qubes-core-agent'
Leaving 'diversion of /etc/init/serial.conf to /etc/init/serial.conf.qubes-orig by qubes-core-agent'
qubes-update-check.service is a disabled or a static unit, not starting it.
Processing triggers for libglib2.0-0:amd64 (2.50.3-2) ...
/usr/lib/qubes/qrexec-client-vm: invalid option -- 'c'
usage: /usr/lib/qubes/qrexec-client-vm [--buffer-size=BUFFER_SIZE] target_vmname program_ident [local_program [local program arguments]]
BUFFER_SIZE is minimum vchan buffer size (default: 64k)

[qubenix]

Like this?

user@d9-comms:~$ cat /etc/pam.d/common-auth | grep pam_exec.so
auth       [success=done default=die]  pam_exec.so seteuid /usr/lib/qubes/qrexec-client-vm dom0 qubes.VMAuth -- /bin/grep -q ^1$
user@d9-comms:~$ sudo apt-mark unhold qubes-core-agent
Canceled hold on qubes-core-agent.
user@d9-comms:~$ sudo apt-get update && sudo apt-get dist-upgrade
Hit:1 https://updates.signal.org/desktop/apt xenial InRelease
Hit:2 http://deb.qubesos4rrrrz6n4.onion/r3.2/vm stretch-testing InRelease
Get:3 http://sgvtcaew4bxjd7ln.onion stretch/updates InRelease [63.0 kB]  
Ign:4 http://vwakviie2ienjx6t.onion/debian stretch InRelease
Hit:5 http://vwakviie2ienjx6t.onion/debian stretch Release                                   
Fetched 63.0 kB in 54s (1,147 B/s)                                                           
Reading package lists... Done
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Calculating upgrade... Done
The following packages will be upgraded:
  qubes-core-agent
1 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B/93.2 kB of archives.
After this operation, 18.4 kB of additional disk space will be used.
Do you want to continue? [Y/n] y
(Reading database ... 104113 files and directories currently installed.)
Preparing to unpack .../qubes-core-agent_3.2.27-1+deb9u1_amd64.deb ...
Unpacking qubes-core-agent (3.2.27-1+deb9u1) over (3.2.26-1+deb9u1) ...
Setting up qubes-core-agent (3.2.27-1+deb9u1) ...
Installing new version of config file /etc/NetworkManager/dispatcher.d/qubes-nmhook ...
Removed /etc/systemd/system/multi-user.target.wants/haveged.service.
Created symlink /etc/systemd/system/multi-user.target.wants/haveged.service → /etc/systemd/system/haveged.service.
Leaving 'diversion of /etc/init/plymouth-shutdown.conf to /etc/init/plymouth-shutdown.conf.qubes-disabled by qubes-core-agent'
Leaving 'diversion of /etc/init/prefdm.conf to /etc/init/prefdm.conf.qubes-disabled by qubes-core-agent'
Leaving 'diversion of /etc/init/splash-manager.conf to /etc/init/splash-manager.conf.qubes-disabled by qubes-core-agent'
Leaving 'diversion of /etc/init/start-ttys.conf to /etc/init/start-ttys.conf.qubes-disabled by qubes-core-agent'
Leaving 'diversion of /etc/init/tty.conf to /etc/init/tty.conf.qubes-disabled by qubes-core-agent'
Leaving 'diversion of /etc/init/serial.conf to /etc/init/serial.conf.qubes-orig by qubes-core-agent'
qubes-update-check.service is a disabled or a static unit, not starting it.
Processing triggers for libglib2.0-0:amd64 (2.50.3-2) ...
/usr/lib/qubes/qrexec-client-vm: invalid option -- 'c'
usage: /usr/lib/qubes/qrexec-client-vm [--buffer-size=BUFFER_SIZE] target_vmname program_ident [local_program [local program arguments]]
BUFFER_SIZE is minimum vchan buffer size (default: 64k)

[marmarek]

Looks like sudo is working again for you after this.

[marmarek]

Looks like sudo is working again for you after this.

[qubenix]

Yes, you're right. Even though the upgrade shows the same error, sudo works.

[qubenix]

Yes, you're right. Even though the upgrade shows the same error, sudo works.

[qubesos-bot]

Automated announcement from builder-github

The component core-agent-linux (including package python2-dnf-plugins-qubes-hooks-3.2.28-1.fc26) has been pushed to the r3.2 testing repository for the Fedora template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.2-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component core-agent-linux (including package python2-dnf-plugins-qubes-hooks-3.2.28-1.fc26) has been pushed to the r3.2 testing repository for the Fedora template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.2-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_3.2.28-1+deb9u1 has been pushed to the r3.2 testing repository for the Debian template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing (or appropriate equivalent for your template version), then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_3.2.28-1+deb9u1 has been pushed to the r3.2 testing repository for the Debian template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing (or appropriate equivalent for your template version), then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_3.2.28-1+deb9u1 has been pushed to the r3.2 stable repository for the Debian template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_3.2.28-1+deb9u1 has been pushed to the r3.2 stable repository for the Debian template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component core-agent-linux (including package python2-dnf-plugins-qubes-hooks-3.2.28-1.fc26) has been pushed to the r3.2 stable repository for the Fedora template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component core-agent-linux (including package python2-dnf-plugins-qubes-hooks-3.2.28-1.fc26) has been pushed to the r3.2 stable repository for the Fedora template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component core-agent-linux (including package python2-dnf-plugins-qubes-hooks-4.0.25-1.fc26) has been pushed to the r4.0 testing repository for the Fedora template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component core-agent-linux (including package python2-dnf-plugins-qubes-hooks-4.0.25-1.fc26) has been pushed to the r4.0 testing repository for the Fedora template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_4.0.25-1+deb9u1 has been pushed to the r4.0 testing repository for the Debian template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing (or appropriate equivalent for your template version), then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_4.0.25-1+deb9u1 has been pushed to the r4.0 testing repository for the Debian template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing (or appropriate equivalent for your template version), then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package core-agent-linux has been pushed to the r4.0 testing repository for the CentOS centos7 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package core-agent-linux has been pushed to the r4.0 testing repository for the CentOS centos7 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component core-agent-linux (including package python2-dnf-plugins-qubes-hooks-4.0.28-1.fc26) has been pushed to the r4.0 stable repository for the Fedora template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component core-agent-linux (including package python2-dnf-plugins-qubes-hooks-4.0.28-1.fc26) has been pushed to the r4.0 stable repository for the Fedora template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package core-agent-linux has been pushed to the r4.0 stable repository for the Fedora centos7 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package core-agent-linux has been pushed to the r4.0 stable repository for the Fedora centos7 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_4.0.28-1+deb9u1 has been pushed to the r4.0 stable repository for the Debian template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_4.0.28-1+deb9u1 has been pushed to the r4.0 stable repository for the Debian template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update