qubes-firewall-user-script is only executed in sys-net and sys-firewall

[gasull]

Qubes OS version:

Qubes release 4.0 (R4.0)

Affected component(s):

---

Steps to reproduce the behavior:

• Create a new qube.
• In the new qube, edit /rw/config/qubes-firewall-user-script and add the following line:

  echo hi | systemd-cat -t qubes-firewall

• Shutdown the qube in the Qube Manager.
• Open the terminal for the qube and enter this command:

  journalctl -t qubes-firewall

Expected behavior:

The output of journalctl -t qubes-firewall should be this:

-- Logs begin at (...)
Jul 24 01:28:06 my-new-qube qubes-firewall[871]: hi

Or maybe /rw/config/qubes-firewall-user-script shouldn't confusingly exist in the TemplateVMs if there is a reason why we don't execute it.

Actual behavior:

The output of journalctl -t qubes-firewall is this:

-- No entries --

General notes:

I tried with iptables commands, but I wanted to prove the commands are not ignored for some resaon, but they are not even executed.

sys-net and sys-firewall do execute /rw/config/qubes-firewall-user-script, but the other qubes do not. This is true for both Fedora and Debian templates.

---

Related issues:

[marmarek]

This is expected behavior, see https://www.qubes-os.org/doc/config-files/
Specifically, you can enable qubes-firewall service (even in template, but that wouldn't make sense). Note that qubes-firewall service is about guarding traffic from connected VMs, so it this VM doesn't provide network to any other, there is no need for qubes-firewall service (which matches default configuration).
In non-network-providing VMs you can use /rw/config/rc.local for own firewall rules, there is no dynamic firewall updates, so nothing will override them.

[marmarek]

This is expected behavior, see https://www.qubes-os.org/doc/config-files/
Specifically, you can enable qubes-firewall service (even in template, but that wouldn't make sense). Note that qubes-firewall service is about guarding traffic from connected VMs, so it this VM doesn't provide network to any other, there is no need for qubes-firewall service (which matches default configuration).
In non-network-providing VMs you can use /rw/config/rc.local for own firewall rules, there is no dynamic firewall updates, so nothing will override them.

[andrewdavidwong]

Or maybe /rw/config/qubes-firewall-user-script shouldn't confusingly exist in the TemplateVMs if there is a reason why we don't execute it.

I guess they have to exist in TemplateVMs so that they can exist in the ProxyVMs based on those TemplateVMs.

[andrewdavidwong]

Or maybe /rw/config/qubes-firewall-user-script shouldn't confusingly exist in the TemplateVMs if there is a reason why we don't execute it.

I guess they have to exist in TemplateVMs so that they can exist in the ProxyVMs based on those TemplateVMs.