qubes-core-agent /etc/qubes/post-install.d mechanism / qvm-features-request broken

[adrelanos]

Qubes OS version:

R4

Affected component(s):

all templates

Steps to reproduce the behavior:

Upgrade qubes core agent.

When qubesdb is being upgraded (i.e. not running) and at the same time https://github.com/QubesOS/qubes-core-agent-linux/blob/master/qubes-rpc/qubes.PostInstall is processing a /etc/qubes/post-install.d/ trigger,

Expected behavior:

Functional.

Actual behavior:

For example qvm-features-request whonix-ws=1 won't work, because qubesdb not running.

Other things from https://github.com/QubesOS/qubes-core-agent-linux/tree/master/post-install.d will also not work.

Leaving 'diversion of /etc/init/tty.conf to /etc/init/tty.conf.qubes-disabled by qubes-core-agent'
Leaving 'diversion of /etc/init/serial.conf to /etc/init/serial.conf.qubes-orig by qubes-core-agent'
No such key 'auto-update-type' in schema 'org.gnome.settings-daemon.plugins.updates' as specified in override file '/usr/share/glib-2.0/schemas/20_org.gnome.settings-daemon.plugins.updates.qubes.gschema.override'; ignoring override for this key.
Failed connect to local daemon
Traceback (most recent call last):
  File "/usr/bin/qvm-features-request", line 81, in <module>
    sys.exit(main())
  File "/usr/bin/qvm-features-request", line 70, in main
    qdb = qubesdb.QubesDB()
qubesdb.Error: (2, 'No such file or directory')
Traceback (most recent call last):
  File "/usr/bin/qvm-features-request", line 81, in <module>
    sys.exit(main())
  File "/usr/bin/qvm-features-request", line 70, in main
    qdb = qubesdb.QubesDB()
qubesdb.Error: (2, 'No such file or directory')
Traceback (most recent call last):
  File "/usr/bin/qvm-features-request", line 81, in <module>
    sys.exit(main())
  File "/usr/bin/qvm-features-request", line 70, in main
    qdb = qubesdb.QubesDB()
qubesdb.Error: (2, 'No such file or directory')
Traceback (most recent call last):
  File "/usr/bin/qvm-features-request", line 81, in <module>
    sys.exit(main())
  File "/usr/bin/qvm-features-request", line 70, in main
    qdb = qubesdb.QubesDB()
qubesdb.Error: (2, 'No such file or directory')
Setting up qubes-core-agent-networking (4.0.28-1+deb8u1) ...

General notes:

I think the current /etc/qubes/post-install.d implementation is fragile.

Related issues:

Affects Whonix anon-vm tag implementation.

https://www.whonix.org/wiki/Dev/Qubes#anon-vm_tag

#3765
#3595

[marmarek]

@adrelanos could qubes-core-agent-linux have some dependency that its postinst script is called after qubes-db service is started again?

[marmarek]

@adrelanos could qubes-core-agent-linux have some dependency that its postinst script is called after qubes-db service is started again?

[adrelanos]

Dunno. Not sure.

---

A)
Easy, and clean, if it works:
If qubes-core-agent-linux had Depends: qubesdb-vm perhaps?

---

B)
More hacky:
Trigger somehow?

---

C)
Slightly less hacky:
Trigger and only do the /etc/qubes-rpc/qubes.PostInstall || true call?

---

D)
Another hacky option:
Run /var/lib/dpkg/info/qubes-core-agent.postinst from qubes-core-qubesdb postinst?

## Set environment variables for deb-systemd-helper.
export DPKG_MAINTSCRIPT_PACKAGE="qubes-core-agent"
export DPKG_MAINTSCRIPT_NAME="postinst"
/var/lib/dpkg/info/qubes-core-agent.postinst configure

---

E)
Another hacky option:
Run /etc/qubes-rpc/qubes.PostInstall || true from qubes-core-qubesdb postinst but after #DEBHELPER#. (To ensure systemd restart actions are already done.)

---

(This is interesting to fix for other purposes as well. Saw qubesdb not running errors even before (but then the impact was low).)

[adrelanos]

Dunno. Not sure.

---

A)
Easy, and clean, if it works:
If qubes-core-agent-linux had Depends: qubesdb-vm perhaps?

---

B)
More hacky:
Trigger somehow?

---

C)
Slightly less hacky:
Trigger and only do the /etc/qubes-rpc/qubes.PostInstall || true call?

---

D)
Another hacky option:
Run /var/lib/dpkg/info/qubes-core-agent.postinst from qubes-core-qubesdb postinst?

## Set environment variables for deb-systemd-helper.
export DPKG_MAINTSCRIPT_PACKAGE="qubes-core-agent"
export DPKG_MAINTSCRIPT_NAME="postinst"
/var/lib/dpkg/info/qubes-core-agent.postinst configure

---

E)
Another hacky option:
Run /etc/qubes-rpc/qubes.PostInstall || true from qubes-core-qubesdb postinst but after #DEBHELPER#. (To ensure systemd restart actions are already done.)

---

(This is interesting to fix for other purposes as well. Saw qubesdb not running errors even before (but then the impact was low).)

[adrelanos]

This is a blocker for the release of Whonix 14.

[adrelanos]

This is a blocker for the release of Whonix 14.

[marmarek]

@adrelanos can you provide exact steps (versions etc) to reproduce? I've tried updating both qubesdb and qubes-core-agent at the same time in debian-9 template it it worked just fine. Was that during whonix-13 -> whonix-14 update?
Note that if you see those messages during template build, it doesn't matter, since qubes.PostInstall is also called at template installation time.

[marmarek]

@adrelanos can you provide exact steps (versions etc) to reproduce? I've tried updating both qubesdb and qubes-core-agent at the same time in debian-9 template it it worked just fine. Was that during whonix-13 -> whonix-14 update?
Note that if you see those messages during template build, it doesn't matter, since qubes.PostInstall is also called at template installation time.

[marmarek]

Debian policy:

Depends

This declares an absolute dependency. A package will not be configured unless all of the packages listed in its Depends field have been correctly configured (unless there is a circular dependency as described above).

So, Depends: qubesdb-vm should fix it. But since I can't reproduce the problem, cannot reliably test it. Will push the update to testing anyway.

[marmarek]

Debian policy:

Depends

This declares an absolute dependency. A package will not be configured unless all of the packages listed in its Depends field have been correctly configured (unless there is a circular dependency as described above).

So, Depends: qubesdb-vm should fix it. But since I can't reproduce the problem, cannot reliably test it. Will push the update to testing anyway.

[adrelanos]

Marek Marczykowski-Górecki:

@adrelanos can you provide exact steps (versions etc) to reproduce?

If you have a Qubes-Whonix 14 template and upgrade it, this should be reproducible.

I've tried updating both qubesdb and qubes-core-agent at the same time in debian-9 template it it worked just fine. Was that during whonix-13 -> whonix-14 update?

Didn't test whonix-13 -> whonix-14 upgrade to reproduce this. No major upgrade required. This was happening during Whonix 14 package upgrades.

So, `Depends: qubesdb-vm` should fix it. But since I can't reproduce

the problem, cannot reliably test it. Will push the update to testing anyway. Very good! :) Once in testing, I will test. Will let you know in case I spot this issue again.

[adrelanos]

Marek Marczykowski-Górecki:

@adrelanos can you provide exact steps (versions etc) to reproduce?

If you have a Qubes-Whonix 14 template and upgrade it, this should be reproducible.

I've tried updating both qubesdb and qubes-core-agent at the same time in debian-9 template it it worked just fine. Was that during whonix-13 -> whonix-14 update?

Didn't test whonix-13 -> whonix-14 upgrade to reproduce this. No major upgrade required. This was happening during Whonix 14 package upgrades.

So, `Depends: qubesdb-vm` should fix it. But since I can't reproduce

the problem, cannot reliably test it. Will push the update to testing anyway. Very good! :) Once in testing, I will test. Will let you know in case I spot this issue again.

[qubesos-bot]

Automated announcement from builder-github

The package core-agent-linux has been pushed to the r4.0 testing repository for the CentOS centos7 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package core-agent-linux has been pushed to the r4.0 testing repository for the CentOS centos7 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_4.0.31-1+deb9u1 has been pushed to the r4.0 testing repository for the Debian template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing (or appropriate equivalent for your template version), then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_4.0.31-1+deb9u1 has been pushed to the r4.0 testing repository for the Debian template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing (or appropriate equivalent for your template version), then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component core-agent-linux (including package python2-dnf-plugins-qubes-hooks-4.0.31-1.fc26) has been pushed to the r4.0 testing repository for the Fedora template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component core-agent-linux (including package python2-dnf-plugins-qubes-hooks-4.0.31-1.fc26) has been pushed to the r4.0 testing repository for the Fedora template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component core-agent-linux (including package python2-dnf-plugins-qubes-hooks-4.0.31-1.fc26) has been pushed to the r4.0 stable repository for the Fedora template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component core-agent-linux (including package python2-dnf-plugins-qubes-hooks-4.0.31-1.fc26) has been pushed to the r4.0 stable repository for the Fedora template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package core-agent-linux has been pushed to the r4.0 stable repository for the Fedora centos7 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package core-agent-linux has been pushed to the r4.0 stable repository for the Fedora centos7 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_4.0.31-1+deb9u1 has been pushed to the r4.0 stable repository for the Debian template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_4.0.31-1+deb9u1 has been pushed to the r4.0 stable repository for the Debian template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component core-agent-linux (including package python2-dnf-plugins-qubes-hooks-3.2.31-1.fc26) has been pushed to the r3.2 testing repository for the Fedora template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.2-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component core-agent-linux (including package python2-dnf-plugins-qubes-hooks-3.2.31-1.fc26) has been pushed to the r3.2 testing repository for the Fedora template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.2-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_3.2.31-1+deb9u1 has been pushed to the r3.2 testing repository for the Debian template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing (or appropriate equivalent for your template version), then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_3.2.31-1+deb9u1 has been pushed to the r3.2 testing repository for the Debian template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing (or appropriate equivalent for your template version), then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update