qubes-firewall should output errors to X

[3hhh]

Qubes OS version:

4.0

Affected component(s):

qubes-firewall

Steps to reproduce the behavior:

E.g.

1. Allow access for an AppVM to a non-existent domain [a] and an existent domain [b] via qubes-firewall.

2. Try to access [b] from the AppVM.

Expected behavior:

You cannot access [b] because the firewall rules are in an invalid state.

An error (e.g. notification) is presented to the user explaining that the rule for [a] is causing issues.

Actual behavior:

You cannot access [b] because the firewall rules are in an invalid state.

No error is shown. There might be something in the log in the respective firewall VM.

General notes:

In 3.2. FW errors were shown via notify-send. This was apparently dropped for 4.0.

It can become rather annoying when you have > 20 domains in the firewall rules for a VM and need to go through all of them to find out which one is not used anymore.

Related issues:

none that I'm aware of

[tasket]

I would consider extending the solution for this into a general facility for reporting failures of critical qubes guest services, including qubes-gui-agent. This would mean it has to work even if the guest GUI isn't working (it would use only dom0 GUI).

[tasket]

I would consider extending the solution for this into a general facility for reporting failures of critical qubes guest services, including qubes-gui-agent. This would mean it has to work even if the guest GUI isn't working (it would use only dom0 GUI).