
===== 1. Identity / versions =====

$ hostname
dom0

$ id
uid=0(root) gid=0(root) groups=0(root)

$ uname -a
Linux dom0 6.12.59-1.qubes.fc41.x86_64 #1 SMP PREEMPT_DYNAMIC Sun Nov 30 10:39:00 UTC 2025 x86_64 GNU/Linux

$ cat /etc/qubes-release
Qubes release 4.3.0 (R4.3)

$ qubesctl --version
usage: qubesctl [-h] [--show-output] [--force-color] [--skip-dom0]
                [--max-concurrency MAX_CONCURRENCY] [--skip-top-check]
                [--sync-extmods] [--targets TARGETS | --all] [--templates]
                [--standalones] [--app]
                ...
qubesctl: error: unrecognized arguments: --version

$ rpm -q qubes-core-admin-linux qubes-core-qrexec
package qubes-core-admin-linux is not installed
qubes-core-qrexec-4.3.11-1.fc41.x86_64

===== 2. Qubes version detail =====

$ qvm-ls --raw-data --fields NAME,STATE,CLASS,TEMPLATE
ai|Running|StandaloneVM|-
anon-whonix|Running|AppVM|whonix-workstation-18
clearnet|Running|StandaloneVM|-
corn-whonix|Running|AppVM|whonix-workstation-18
debian-13-xfce|Halted|TemplateVM|-
default-dvm|Halted|AppVM|debian-13-xfce
default-mgmt-dvm|Halted|AppVM|debian-13-xfce
disp870|Paused|DispVM|default-dvm
disp9124|Paused|DispVM|default-dvm
dom0|Running|AdminVM|-
fedora-42-xfce|Halted|TemplateVM|-
n-os-tr|Halted|StandaloneVM|-
nostr|Running|StandaloneVM|-
nostr_signer|Running|StandaloneVM|-
sys-fips|Halted|StandaloneVM|-
sys-firewall|Running|DispVM|default-dvm
sys-net|Running|AppVM|debian-13-xfce
sys-usb|Running|DispVM|default-dvm
sys-vpn-mullvad-app|Running|StandaloneVM|-
sys-whonix|Running|AppVM|whonix-gateway-18
vault|Running|AppVM|debian-13-xfce
whonix-gateway-18|Halted|TemplateVM|-
whonix-workstation-18|Halted|TemplateVM|-
whonix-workstation-18-dvm|Halted|AppVM|whonix-workstation-18

$ qvm-ls --running
please wait... ................................................................................
NAME                 STATE    CLASS         LABEL   TEMPLATE               NETVM
ai                   Running  StandaloneVM  orange  -                      sys-vpn-mullvad-app
anon-whonix          Running  AppVM         red     whonix-workstation-18  sys-whonix
clearnet             Running  StandaloneVM  purple  -                      sys-firewall
corn-whonix          Running  AppVM         red     whonix-workstation-18  sys-whonix
dom0                 Running  AdminVM       black   -                      -
nostr                Running  StandaloneVM  gray    -                      sys-vpn-mullvad-app
nostr_signer         Running  StandaloneVM  yellow  -                      sys-vpn-mullvad-app
sys-firewall         Running  DispVM        green   default-dvm            sys-net
sys-net              Running  AppVM         red     debian-13-xfce         -
sys-usb              Running  DispVM        red     default-dvm            -
sys-vpn-mullvad-app  Running  StandaloneVM  red     -                      sys-firewall
sys-whonix           Running  AppVM         black   whonix-gateway-18      sys-firewall
vault                Running  AppVM         black   debian-13-xfce         -

===== 3. Policy directories inventory =====

$ ls -la /etc/qubes/policy.d/
total 80
drwxrwxr-x 3 root qubes 4096 Aug 20 15:12 .
drwxr-xr-x 7 root root  4096 Mar 23 19:24 ..
-rw-rw-r-- 1 root root   674 Aug 30  2025 35-compat.policy
-rw-r--r-- 1 root root   284 Aug 20 14:45 45-signer.policy
-rw-r--r-- 1 root root     3 Aug 20 15:12 50-config-clipboard.policy
-rw-r--r-- 1 root root   150 Mar 23 20:00 50-config-input.policy
-rw-r--r-- 1 root root   129 Mar 23 19:59 50-config-updates.policy
-rw-rw-r-- 1 root qubes 2961 Dec  9  2025 80-whonix.policy
-rw-rw-r-- 1 root qubes 2261 Nov  8  2025 85-admin-backup-restore.policy
-rw-rw-r-- 1 root qubes 9075 Nov  8  2025 90-admin-default.policy
-rw-rw-r-- 1 root root  1197 Aug 30  2025 90-admin-policy-default.policy
-rw-r--r-- 1 root root   563 Oct 19  2025 90-default-gui-daemon.policy
-rw-rw-r-- 1 root qubes  227 Nov  4  2025 90-default-linux.policy
-rw-rw-r-- 1 root qubes  227 Oct  9  2025 90-default-pdf-convert.policy
-rw-rw-r-- 1 root qubes 6690 Nov  8  2025 90-default.policy
drwxrwxr-x 2 root qubes 4096 Mar 23 19:24 include
-rw-rw-r-- 1 root root   185 Aug 30  2025 README

$ ls -la /etc/qubes-rpc/policy/
total 24
drwxrwsr-x 3 root qubes  4096 Aug 20 14:20 .
drwxr-xr-x 3 root root  12288 Aug 16 17:10 ..
drwxrwxr-x 2 root root   4096 Aug 30  2025 include
-rw-r--r-- 1 root qubes    12 Aug 20 14:20 qubes.SignerRpc

$ ls -la /usr/share/qubes/policy.d/
ls: cannot access '/usr/share/qubes/policy.d/': No such file or directory

$ ls -la /etc/qubes-rpc/
total 88
drwxr-xr-x   3 root root  12288 Aug 16 17:10 .
drwxr-xr-x 112 root root   4096 Apr 27 07:31 ..
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.backup.Cancel -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.backup.Execute -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.backup.Info -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.deviceclass.List -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.Events -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.label.Create -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.label.Get -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.label.Index -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.label.List -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.label.Remove -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.pool.Add -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.pool.Info -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.pool.List -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.pool.ListDrivers -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.pool.Remove -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.pool.Set.ephemeral_volatile -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.pool.Set.revisions_to_keep -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.pool.UsageDetails -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.pool.volume.Info -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.pool.volume.List -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.pool.volume.ListSnapshots -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.pool.volume.Resize -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.pool.volume.Revert -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.pool.volume.Set.ephemeral -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.pool.volume.Set.revisions_to_keep -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.pool.volume.Set.rw -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.pool.volume.Snapshot -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.property.Get -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.property.GetAll -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.property.GetDefault -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.property.Help -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.property.HelpRst -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.property.List -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.property.Reset -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.property.Set -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vmclass.List -> ../../var/run/qubesd.sock
-rwxr-xr-x   1 root root    705 Nov  8  2025 admin.vm.Console
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.Create.AppVM -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.CreateDisposable -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.Create.DispVM -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.CreateInPool.AppVM -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.CreateInPool.DispVM -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.CreateInPool.StandaloneVM -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.CreateInPool.TemplateVM -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.Create.StandaloneVM -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.Create.TemplateVM -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.CurrentState -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.block.Assign -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.block.Assigned -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.block.Attach -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.block.Attached -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.block.Available -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.block.Detach -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.block.Set.assignment -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.block.Unassign -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.denied.Add -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.denied.List -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.denied.Remove -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.mic.Assign -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.mic.Assigned -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.mic.Attach -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.mic.Attached -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.mic.Available -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.mic.Detach -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.mic.Set.assignment -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.mic.Unassign -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.pci.Assign -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.pci.Assigned -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.pci.Attach -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.pci.Attached -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.pci.Available -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.pci.Detach -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.pci.Set.assignment -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.pci.Unassign -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.usb.Assign -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.usb.Assigned -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.usb.Attach -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.usb.Attached -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.usb.Available -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.usb.Detach -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.usb.Set.assignment -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.device.usb.Unassign -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.feature.CheckWithAdminVM -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.feature.CheckWithNetvm -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.feature.CheckWithTemplate -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.feature.CheckWithTemplateAndAdminVM -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.feature.Get -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.feature.List -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.feature.Remove -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.feature.Set -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.firewall.Flush -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.firewall.Get -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.firewall.GetPolicy -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.firewall.Reload -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.firewall.Set -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.firewall.SetPolicy -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.Kill -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.List -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.notes.Get -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.notes.Set -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.Pause -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.property.Get -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.property.GetAll -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.property.GetDefault -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.property.Help -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.property.HelpRst -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.property.List -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.property.Reset -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.property.Set -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.Remove -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.Shutdown -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.Start -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.Stats -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.tag.Get -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.tag.List -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.tag.Remove -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.tag.Set -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.Unpause -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.volume.Clear -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.volume.CloneFrom -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.volume.CloneTo -> ../../var/run/qubesd.sock
-rwxr-xr-x   1 root root   3543 Nov  8  2025 admin.vm.volume.Import
lrwxrwxrwx   1 root root     22 Nov  8  2025 admin.vm.volume.ImportWithSize -> admin.vm.volume.Import
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.volume.Info -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.volume.List -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.volume.ListSnapshots -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.volume.Resize -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.volume.Revert -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.volume.Set.ephemeral -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.volume.Set.revisions_to_keep -> ../../var/run/qubesd.sock
lrwxrwxrwx   1 root root     25 Nov  8  2025 admin.vm.volume.Set.rw -> ../../var/run/qubesd.sock
drwxrwsr-x   3 root qubes  4096 Aug 20 14:20 policy
lrwxrwxrwx   1 root root     32 Aug 30  2025 policy.Ask -> /var/run/qubes/policy-agent.sock
srw-rw----   1 root qubes     0 Aug 16 17:10 policy.EvalGUI
srw-rw----   1 root qubes     0 Aug 16 17:10 policy.EvalSimple
lrwxrwxrwx   1 root root     27 Aug 30  2025 policy.Get -> /usr/bin/qubes-policy-admin
lrwxrwxrwx   1 root root     27 Aug 30  2025 policy.GetFiles -> /usr/bin/qubes-policy-admin
lrwxrwxrwx   1 root root     27 Aug 30  2025 policy.include.Get -> /usr/bin/qubes-policy-admin
lrwxrwxrwx   1 root root     27 Aug 30  2025 policy.include.List -> /usr/bin/qubes-policy-admin
lrwxrwxrwx   1 root root     27 Aug 30  2025 policy.include.Remove -> /usr/bin/qubes-policy-admin
lrwxrwxrwx   1 root root     27 Aug 30  2025 policy.include.Replace -> /usr/bin/qubes-policy-admin
lrwxrwxrwx   1 root root     27 Aug 30  2025 policy.List -> /usr/bin/qubes-policy-admin
lrwxrwxrwx   1 root root     32 Aug 30  2025 policy.Notify -> /var/run/qubes/policy-agent.sock
-rwxr-xr-x   1 root root   5217 Aug 30  2025 policy.RegisterArgument
lrwxrwxrwx   1 root root     27 Aug 30  2025 policy.Remove -> /usr/bin/qubes-policy-admin
lrwxrwxrwx   1 root root     27 Aug 30  2025 policy.Replace -> /usr/bin/qubes-policy-admin
-rwxr-xr-x   1 root root    234 Nov  8  2025 qubes.ConnectTCP
-rwxr-xr-x   1 root root    162 Nov  8  2025 qubes.FeaturesRequest
-rwxr-xr-x   1 root root   1780 Nov  8  2025 qubes.GetDate
-rwxr-xr-x   1 root root   2165 Nov  8  2025 qubes.GetRandomizedTime
-rwxr-xr-x   1 root root     63 Nov 12  2025 qubes.InputKeyboard
-rwxr-xr-x   1 root root     52 Nov 12  2025 qubes.InputMouse
-rwxr-xr-x   1 root root     61 Nov 12  2025 qubes.InputTablet
lrwxrwxrwx   1 root root     45 Dec  2  2025 qubes.Notifications -> ../../usr/bin/qubes-notification-proxy-server
-rwxr-xr-x   1 root root    158 Nov  8  2025 qubes.NotifyTools
-rwxr-xr-x   1 root root    157 Nov  8  2025 qubes.NotifyUpdates
lrwxrwxrwx   1 root root     45 Nov  4  2025 qubes.ReceiveUpdates -> ../../usr/libexec/qubes/qubes-receive-updates
-rwxr-xr-x   1 root root    377 Oct  9  2025 qubes.RemoveAppMenusFor
lrwxrwxrwx   1 root root     49 Nov  4  2025 qubes.repos.Disable -> ../../usr/lib/qubes/qubes-rpc/qubes.repos.Disable
lrwxrwxrwx   1 root root     48 Nov  4  2025 qubes.repos.Enable -> ../../usr/lib/qubes/qubes-rpc/qubes.repos.Enable
lrwxrwxrwx   1 root root     46 Nov  4  2025 qubes.repos.List -> ../../usr/lib/qubes/qubes-rpc/qubes.repos.List
-rwxr-xr-x   1 root root    258 Oct  9  2025 qubes.SyncAppMenus
-rwxr-xr-x   1 root root    393 Oct  9  2025 qubes.UpdateAppMenusFor
-rwxr-xr-x   1 root root    921 Aug 30  2025 qubes.WaitForSession
lrwxrwxrwx   1 root root     33 Oct 19  2025 qubes.WindowIconUpdater -> /var/run/qubes/icon-receiver.sock

===== 4. Policy file ownership/permissions =====

$ find /etc/qubes/policy.d /etc/qubes-rpc/policy /usr/share/qubes/policy.d -maxdepth 1 -type f -printf "%M %u:%g %s %p\n" 2>/dev/null | sort
-rw-r--r-- root:qubes 12 /etc/qubes-rpc/policy/qubes.SignerRpc
-rw-r--r-- root:root 129 /etc/qubes/policy.d/50-config-updates.policy
-rw-r--r-- root:root 150 /etc/qubes/policy.d/50-config-input.policy
-rw-r--r-- root:root 284 /etc/qubes/policy.d/45-signer.policy
-rw-r--r-- root:root 3 /etc/qubes/policy.d/50-config-clipboard.policy
-rw-r--r-- root:root 563 /etc/qubes/policy.d/90-default-gui-daemon.policy
-rw-rw-r-- root:qubes 2261 /etc/qubes/policy.d/85-admin-backup-restore.policy
-rw-rw-r-- root:qubes 227 /etc/qubes/policy.d/90-default-linux.policy
-rw-rw-r-- root:qubes 227 /etc/qubes/policy.d/90-default-pdf-convert.policy
-rw-rw-r-- root:qubes 2961 /etc/qubes/policy.d/80-whonix.policy
-rw-rw-r-- root:qubes 6690 /etc/qubes/policy.d/90-default.policy
-rw-rw-r-- root:qubes 9075 /etc/qubes/policy.d/90-admin-default.policy
-rw-rw-r-- root:root 1197 /etc/qubes/policy.d/90-admin-policy-default.policy
-rw-rw-r-- root:root 185 /etc/qubes/policy.d/README
-rw-rw-r-- root:root 674 /etc/qubes/policy.d/35-compat.policy

===== 5. Symlinks in policy dirs =====

$ find /etc/qubes/policy.d /etc/qubes-rpc /etc/qubes-rpc/policy -maxdepth 2 -type l -printf "%p -> %l\n" 2>/dev/null
/etc/qubes-rpc/admin.vm.device.usb.Available -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.volume.Set.ephemeral -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.mic.Attach -> ../../var/run/qubesd.sock
/etc/qubes-rpc/policy.List -> /usr/bin/qubes-policy-admin
/etc/qubes-rpc/admin.vm.device.mic.Unassign -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.property.Help -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.label.List -> ../../var/run/qubesd.sock
/etc/qubes-rpc/policy.Notify -> /var/run/qubes/policy-agent.sock
/etc/qubes-rpc/policy.include.List -> /usr/bin/qubes-policy-admin
/etc/qubes-rpc/admin.vm.CreateInPool.DispVM -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.pool.volume.Set.rw -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.pool.volume.List -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.backup.Execute -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.property.List -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.pci.Unassign -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.Start -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.label.Get -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.pci.Attached -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.CurrentState -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.pool.volume.Set.revisions_to_keep -> ../../var/run/qubesd.sock
/etc/qubes-rpc/qubes.repos.Enable -> ../../usr/lib/qubes/qubes-rpc/qubes.repos.Enable
/etc/qubes-rpc/qubes.repos.Disable -> ../../usr/lib/qubes/qubes-rpc/qubes.repos.Disable
/etc/qubes-rpc/admin.property.List -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.label.Create -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.usb.Unassign -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.volume.Info -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.firewall.GetPolicy -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.volume.ImportWithSize -> admin.vm.volume.Import
/etc/qubes-rpc/admin.vm.feature.CheckWithNetvm -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.Create.StandaloneVM -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.block.Assign -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.volume.Clear -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.usb.Set.assignment -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.block.Available -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.Remove -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.usb.Assign -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.Create.DispVM -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.property.Reset -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.CreateInPool.StandaloneVM -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.pool.Set.revisions_to_keep -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.Pause -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.firewall.SetPolicy -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.volume.List -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.CreateInPool.AppVM -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.notes.Get -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.volume.Resize -> ../../var/run/qubesd.sock
/etc/qubes-rpc/policy.GetFiles -> /usr/bin/qubes-policy-admin
/etc/qubes-rpc/qubes.ReceiveUpdates -> ../../usr/libexec/qubes/qubes-receive-updates
/etc/qubes-rpc/admin.pool.volume.Info -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.pci.Assign -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.property.GetDefault -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.pool.volume.Resize -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.pool.Info -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.Kill -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.property.HelpRst -> ../../var/run/qubesd.sock
/etc/qubes-rpc/policy.include.Remove -> /usr/bin/qubes-policy-admin
/etc/qubes-rpc/admin.property.HelpRst -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.tag.Get -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.feature.Get -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.property.Set -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.property.GetDefault -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.tag.Set -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.usb.Detach -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.mic.Detach -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.backup.Cancel -> ../../var/run/qubesd.sock
/etc/qubes-rpc/policy.include.Get -> /usr/bin/qubes-policy-admin
/etc/qubes-rpc/admin.vm.volume.Set.rw -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.volume.Set.revisions_to_keep -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.property.Set -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.CreateInPool.TemplateVM -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.property.Get -> ../../var/run/qubesd.sock
/etc/qubes-rpc/policy.Ask -> /var/run/qubes/policy-agent.sock
/etc/qubes-rpc/admin.vm.Shutdown -> ../../var/run/qubesd.sock
/etc/qubes-rpc/policy.Remove -> /usr/bin/qubes-policy-admin
/etc/qubes-rpc/admin.pool.Remove -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.property.GetAll -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.property.GetAll -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.Stats -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.pool.volume.ListSnapshots -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.mic.Assign -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.notes.Set -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.pci.Attach -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.firewall.Set -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.usb.Attach -> ../../var/run/qubesd.sock
/etc/qubes-rpc/qubes.WindowIconUpdater -> /var/run/qubes/icon-receiver.sock
/etc/qubes-rpc/admin.vm.feature.Remove -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.usb.Assigned -> ../../var/run/qubesd.sock
/etc/qubes-rpc/qubes.repos.List -> ../../usr/lib/qubes/qubes-rpc/qubes.repos.List
/etc/qubes-rpc/admin.vm.firewall.Get -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.feature.CheckWithTemplateAndAdminVM -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.pool.ListDrivers -> ../../var/run/qubesd.sock
/etc/qubes-rpc/policy.include.Replace -> /usr/bin/qubes-policy-admin
/etc/qubes-rpc/admin.Events -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.mic.Set.assignment -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.pool.volume.Set.ephemeral -> ../../var/run/qubesd.sock
/etc/qubes-rpc/qubes.Notifications -> ../../usr/bin/qubes-notification-proxy-server
/etc/qubes-rpc/admin.vm.device.mic.Attached -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.backup.Info -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.volume.CloneFrom -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.List -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.volume.CloneTo -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.pool.Add -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.pool.List -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.denied.Remove -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.volume.Revert -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.feature.List -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.pool.Set.ephemeral_volatile -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.property.Reset -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.block.Attach -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.tag.Remove -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.feature.Set -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.mic.Assigned -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.block.Set.assignment -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.mic.Available -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vmclass.List -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.pool.volume.Snapshot -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.pci.Assigned -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.label.Index -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.denied.List -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.deviceclass.List -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.CreateDisposable -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.pool.volume.Revert -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.denied.Add -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.feature.CheckWithTemplate -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.tag.List -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.Unpause -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.feature.CheckWithAdminVM -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.block.Detach -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.block.Unassign -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.property.Get -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.firewall.Reload -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.block.Assigned -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.pci.Available -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.usb.Attached -> ../../var/run/qubesd.sock
/etc/qubes-rpc/policy.Get -> /usr/bin/qubes-policy-admin
/etc/qubes-rpc/admin.property.Help -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.label.Remove -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.pci.Detach -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.Create.AppVM -> ../../var/run/qubesd.sock
/etc/qubes-rpc/policy.Replace -> /usr/bin/qubes-policy-admin
/etc/qubes-rpc/admin.pool.UsageDetails -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.block.Attached -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.firewall.Flush -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.Create.TemplateVM -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.volume.ListSnapshots -> ../../var/run/qubesd.sock
/etc/qubes-rpc/admin.vm.device.pci.Set.assignment -> ../../var/run/qubesd.sock

===== 6. Search for SignerRpc / nsigner / signer policy files =====

$ find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -iname "*signer*" -print 2>/dev/null | grep -vi "^/home" | head -50
/var/log/qubes/qubesdb.n_signer.log
/var/log/qubes/qrexec.n_signer.log
/var/log/qubes/qubesdb.nostr_signer.log
/var/log/qubes/update-nostr_signer.log
/var/log/qubes/guid.n_signer.log
/var/log/qubes/guid.nostr_signer.log
/var/log/qubes/qrexec.nostr_signer.log
/var/log/qubes/guid.nostr_signer.log.old
/var/log/libvirt/libxl/n_signer.log
/var/log/libvirt/libxl/nostr_signer.log
/var/log/xen/console/guest-nostr_signer.log
/var/log/xen/console/guest-n_signer.log-20260510.gz
/var/log/xen/console/guest-nostr_signer.log-20260816.gz
/var/log/xen/console/guest-nostr_signer.log-20260809.gz
/var/log/xen/console/guest-n_signer.log
/var/log/xen/console/guest-nostr_signer.log-20260726.gz
/var/log/xen/console/guest-nostr_signer.log-20260802.gz
/var/lib/qubes/appvms/nostr_signer
/usr/lib64/python3.13/site-packages/PyQt6/QtDesigner.pyi
/usr/lib64/python3.13/site-packages/PyQt6/lupdate/designer_source.py
/usr/lib64/python3.13/site-packages/PyQt6/lupdate/__pycache__/designer_source.cpython-313.pyc
/usr/lib64/python3.13/site-packages/PyQt6/lupdate/__pycache__/designer_source.cpython-313.opt-1.pyc
/usr/lib64/python3.13/site-packages/PyQt6/QtDesigner.abi3.so
/usr/lib64/cmake/Qt6Designer
/usr/lib64/libQt6Designer.so.6.8.3
/usr/lib64/qt6/plugins/designer
/usr/lib64/qt6/qml/QtQuick3D/AssetUtils/designer
/usr/lib64/qt6/qml/QtQuick3D/ParticleEffects/designer
/usr/lib64/qt6/qml/QtQuick3D/Effects/designer
/usr/lib64/qt6/qml/QtQuick3D/Helpers/designer
/usr/lib64/qt6/qml/QtQuick3D/Particles3D/designer
/usr/lib64/qt6/qml/QtQuick3D/designer
/usr/lib64/qt6/qml/QtQuick/Controls/designer
/usr/lib64/libQt6Designer.so.6
/usr/share/mime/application/x-designer.xml
/usr/share/icons/Mint-X/mimetypes/24/application-x-designer.png
/usr/share/icons/Mint-X/mimetypes/24/gnome-mime-application-x-designer.png
/usr/share/icons/Mint-X/mimetypes/16/application-x-designer.png
/usr/share/icons/Mint-X/mimetypes/16/gnome-mime-application-x-designer.png
/usr/share/icons/Mint-X/mimetypes/32/application-x-designer.png
/usr/share/icons/Mint-X/mimetypes/32/gnome-mime-application-x-designer.png
/usr/share/icons/Mint-X/mimetypes/48/application-x-designer.png
/usr/share/icons/Mint-X/mimetypes/48/gnome-mime-application-x-designer.png
/usr/share/icons/Mint-X/mimetypes/96/application-x-designer.svg
/usr/share/icons/Mint-X/mimetypes/96/gnome-mime-application-x-designer.svg
/usr/share/icons/Mint-X/mimetypes/22/application-x-designer.png
/usr/share/icons/Mint-X/mimetypes/22/gnome-mime-application-x-designer.png
/usr/share/icons/Mint-X/apps/24/qtdesigner.png
/usr/share/icons/Mint-X/apps/24/designer.png
/usr/share/icons/Mint-X/apps/16/qtdesigner.png

$ grep -RIl "SignerRpc\|NsignerRpc\|nsigner" /etc/qubes /usr/share/qubes 2>/dev/null | head -30
/etc/qubes/policy.d/45-signer.policy

===== 7. Policy contents (signer-related) =====

$ for f in $(grep -RIl "SignerRpc\|NsignerRpc\|nsigner\|signer" /etc/qubes/policy.d /etc/qubes-rpc/policy /usr/share/qubes/policy.d 2>/dev/null); do echo "--- $f ---"; cat "$f"; echo; done
--- /etc/qubes/policy.d/45-signer.policy ---
# Qubes OS qrexec policy for signer
qubes.SignerRpc * ai @tag:signer-signer allow target=nostr_signer
qubes.SignerRpc * nostr @tag:signer-signer allow target=nostr_signer
qubes.SignerRpc * @anyvm @tag:signer-signer ask default_target=nostr_signer
qubes.SignerRpc * @anyvm @anyvm deny


===== 8. Clipboard policy contents =====

$ for f in $(grep -RIl "ClipboardPaste" /etc/qubes/policy.d /etc/qubes-rpc/policy /usr/share/qubes/policy.d 2>/dev/null); do echo "--- $f ---"; cat "$f"; echo; done
--- /etc/qubes/policy.d/90-default-gui-daemon.policy ---
## Note that policy parsing stops at the first match,
## so adding anything below "@anyvm @anyvm action" line will have no effect
##
## Clipboard paste (Ctrl-Shift-V) will treat "ask" as "allow" but only when
## called by this keyboard shortcut. "deny" always denies the operation.

## Please use a single # to start your custom comments

qubes.ClipboardPaste * @adminvm	@anyvm	ask
qubes.ClipboardPaste * @anyvm	@anyvm	ask

# The default policy handles only GUI in dom0. GUIVM needs similar line in its
# policy too.
qubes.WindowIconUpdater *   @anyvm dom0 allow


===== 9. Full policy.d listing with contents (all files) =====

$ for f in /etc/qubes/policy.d/*; do echo "--- $f ---"; cat "$f" 2>/dev/null; echo; done
--- /etc/qubes/policy.d/35-compat.policy ---
#
# NOTE:
#
# The following line enables compatibility mode. It reads files in old directory
# (/etc/qubes-rpc/policy). It also generates deny rules that were previously
# implicit after each file, but they are added only after policies for specific
# arguments, that is, for files with '+' in the name. For generic files, without
# '+', no such rules are generated and the control "falls through", which is
# a departure from previous semantics. It is done that way not to shadow the
# default rules.
#
# The "!compat-4.0" directive is transitional only and will be unavailable in
# next major release (R5.0). This file will be removed in that release also.
#

!compat-4.0

--- /etc/qubes/policy.d/45-signer.policy ---
# Qubes OS qrexec policy for signer
qubes.SignerRpc * ai @tag:signer-signer allow target=nostr_signer
qubes.SignerRpc * nostr @tag:signer-signer allow target=nostr_signer
qubes.SignerRpc * @anyvm @tag:signer-signer ask default_target=nostr_signer
qubes.SignerRpc * @anyvm @anyvm deny

--- /etc/qubes/policy.d/50-config-clipboard.policy ---
#


--- /etc/qubes/policy.d/50-config-input.policy ---
qubes.InputMouse * sys-usb dom0 allow
qubes.InputKeyboard * sys-usb dom0 allow
# not configurable by this state
qubes.InputTablet * sys-usb dom0 deny

--- /etc/qubes/policy.d/50-config-updates.policy ---
qubes.UpdatesProxy * @tag:whonix-updatevm @default allow target=sys-whonix
qubes.UpdatesProxy * @tag:whonix-updatevm @anyvm deny

--- /etc/qubes/policy.d/80-whonix.policy ---
## Do not modify this file, create a new policy file with a lower number in the
## filename instead. For example `30-user.policy`.

# service            arg source                  target                  action params

sdwdate-gui.Connect      *   @tag:sdwdate-gui-client @tag:sdwdate-gui-server allow  autostart=no notify=no
sdwdate-gui.ConnectCheck *   @tag:sdwdate-gui-client @tag:sdwdate-gui-server allow  autostart=no notify=no

sdwdate-gui.Connect      *   @anyvm                  @anyvm                  deny
sdwdate-gui.ConnectCheck *   @anyvm                  @anyvm                  deny

# Legacy, all of these services should effectively be no-ops for fully updated
# Whonix-Gateway and Whonix-Workstation qubes.
sdwdate.Connect      *   @tag:sdwdate-gui-client @tag:sdwdate-gui-server allow  autostart=no notify=no
sdwdate.ConnectCheck *   @tag:sdwdate-gui-client @tag:sdwdate-gui-server allow  autostart=no notify=no

sdwdate.Connect      *   @anyvm                  @anyvm                  deny
sdwdate.ConnectCheck *   @anyvm                  @anyvm                  deny

whonix.SdwdateStatus +         @tag:anon-gateway @tag:anon-vm      allow  autostart=no notify=no
whonix.SdwdateStatus +         @tag:anon-gateway @default          deny   notify=no
whonix.SdwdateStatus +         @anyvm            @anyvm            deny

whonix.NewStatus     *         @tag:anon-vm      @tag:anon-gateway allow  autostart=no
whonix.NewStatus     *         @anyvm            @anyvm            deny

whonix.GatewayCommand +restart @tag:anon-gateway @tag:anon-vm      allow  autostart=no
whonix.GatewayCommand +stop    @tag:anon-gateway @tag:anon-vm      allow  autostart=no
whonix.GatewayCommand +showlog @tag:anon-gateway @tag:anon-vm      allow  autostart=no
whonix.GatewayCommand *        @anyvm            @anyvm            deny

# Harden against potential IP leaks by not allowing a compromised
# Whonix-Workstation to open files, URLs, or applications in VMs other than
# Whonix-Workstation VMs (typically DispVMs).
qubes.OpenInVM        *        @tag:anon-vm      @dispvm           ask    default_target=@dispvm
qubes.OpenInVM        *        @tag:anon-vm      @tag:anon-vm      ask
qubes.OpenInVM        *        @tag:anon-vm      @default          ask
qubes.OpenInVM        *        @tag:anon-vm      @anyvm            deny

qubes.OpenURL         *        @tag:anon-vm      @dispvm           ask    default_target=@dispvm
qubes.OpenURL         *        @tag:anon-vm      @tag:anon-vm      ask
qubes.OpenURL         *        @tag:anon-vm      @default          ask
qubes.OpenURL         *        @tag:anon-vm      @anyvm            deny

qubes.StartApp        *        @tag:anon-vm      @dispvm           ask    default_target=@dispvm
qubes.StartApp        *        @tag:anon-vm      @tag:anon-vm      ask
qubes.StartApp        *        @tag:anon-vm      @default          ask
qubes.StartApp        *        @tag:anon-vm      @anyvm            deny

--- /etc/qubes/policy.d/85-admin-backup-restore.policy ---
## File format:
## service-name|*       +argument|* source                   destination                     action  [options]

## Allow selected DisposableVM perform "paranoid backup restore"
admin.vm.Create.AppVM                      *   @tag:backup-restore-mgmt dom0                 allow target=dom0
admin.vm.Create.StandaloneVM               *   @tag:backup-restore-mgmt dom0                 allow target=dom0
admin.vm.Create.TemplateVM                 *   @tag:backup-restore-mgmt dom0                 allow target=dom0
admin.vm.List                              *   @tag:backup-restore-mgmt dom0                 allow target=dom0
## Allow checking some basic info about all the VMs, to propose conflicts resolution
admin.vm.List                              *   @tag:backup-restore-mgmt @anyvm               allow target=dom0
admin.vm.property.Get  +provides_network       @tag:backup-restore-mgmt @anyvm               allow target=dom0
admin.vm.property.Get  +template_for_dispvms   @tag:backup-restore-mgmt @anyvm               allow target=dom0

## Allow it to configure just created qubes
admin.vm.feature.Set            *   @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0
admin.vm.firewall.Set           *   @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0
admin.vm.property.Set           *   @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0
admin.vm.tag.Set                *   @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0
admin.vm.volume.Import          *   @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0
admin.vm.volume.ImportWithSize  *   @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0
admin.vm.volume.Info            *   @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0
admin.vm.volume.List            *   @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0
admin.vm.volume.Set.revisions_to_keep   *	@tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0

## And finally, allow it to retrieve the actual backup
qubes.RestoreById               *   @tag:backup-restore-mgmt @tag:backup-restore-storage     allow


--- /etc/qubes/policy.d/90-admin-default.policy ---
## Do not modify this file, create a new policy file with a lower number in the
## filename instead. For example `30-admin-user.policy`.

###
### Default Admin API qrexec policy
###

## WARNING: most qrexec services here allows a qube to control system
## configuration. It should be allowed only to trusted qubes.

## Remember to add "target=dom0" option to any (allow/ask) entry you create.

## For convenience of maintaining this policy, all services include one of:
##  - include/admin-local-rwx (services to modify a specific qube configuration)
##  - include/admin-local-ro (services to read a specific qube configuration)
##  - include/admin-global-rwx (services to modify global parameters)
##  - include/admin-global-ro (services to read global parameters)

!include-service admin.vm.Console       * include/admin-local-rwx
!include-service admin.vm.volume.Import * include/admin-local-rwx
!include-service admin.vm.volume.ImportWithSize * include/admin-local-rwx

!include-service admin.vm.device.mic.Assign * include/admin-local-rwx
!include-service admin.vm.device.mic.Assigned * include/admin-local-ro
!include-service admin.vm.device.mic.Attach * include/admin-local-rwx
!include-service admin.vm.device.mic.Attached * include/admin-local-ro
!include-service admin.vm.device.mic.Available * include/admin-local-ro
!include-service admin.vm.device.mic.Detach * include/admin-local-rwx
!include-service admin.vm.device.mic.Set.assignment * include/admin-local-rwx
!include-service admin.vm.device.mic.Unassign * include/admin-local-rwx
!include-service admin.vm.device.usb.Assign * include/admin-local-rwx
!include-service admin.vm.device.usb.Assigned * include/admin-local-ro
!include-service admin.vm.device.usb.Attach * include/admin-local-rwx
!include-service admin.vm.device.usb.Attached * include/admin-local-ro
!include-service admin.vm.device.usb.Available * include/admin-local-ro
!include-service admin.vm.device.usb.Detach * include/admin-local-rwx
!include-service admin.vm.device.usb.Set.assignment * include/admin-local-rwx
!include-service admin.vm.device.usb.Unassign * include/admin-local-rwx

!include-service admin.backup.Cancel * include/admin-global-rwx
!include-service admin.backup.Execute * include/admin-global-rwx
!include-service admin.backup.Info * include/admin-local-ro
!include-service admin.vm.CreateDisposable * include/admin-global-rwx
!include-service admin.deviceclass.List * include/admin-global-ro
!include-service admin.Events * include/admin-global-ro
!include-service admin.label.Create * include/admin-global-rwx
!include-service admin.label.Get * include/admin-global-ro
!include-service admin.label.Index * include/admin-global-ro
!include-service admin.label.List * include/admin-global-ro
!include-service admin.label.Remove * include/admin-global-rwx
!include-service admin.pool.Add * include/admin-global-rwx
!include-service admin.pool.Info * include/admin-global-ro
!include-service admin.pool.List * include/admin-global-ro
!include-service admin.pool.ListDrivers * include/admin-global-ro
!include-service admin.pool.Remove * include/admin-global-rwx
!include-service admin.pool.Set.ephemeral_volatile * include/admin-global-rwx
!include-service admin.pool.Set.revisions_to_keep * include/admin-global-rwx
!include-service admin.pool.UsageDetails * include/admin-global-ro
!include-service admin.pool.volume.List * include/admin-global-ro
!include-service admin.property.Get * include/admin-global-ro
!include-service admin.property.GetAll * include/admin-global-ro
!include-service admin.property.GetDefault * include/admin-global-ro
!include-service admin.property.Help * include/admin-global-ro
!include-service admin.property.List * include/admin-global-ro
!include-service admin.property.Reset * include/admin-global-rwx
!include-service admin.property.Set * include/admin-global-rwx
!include-service admin.vm.Console * include/admin-local-rwx
!include-service admin.vm.Create.AppVM * include/admin-global-rwx
!include-service admin.vm.Create.DispVM * include/admin-global-rwx
!include-service admin.vm.Create.RemoteVM * include/admin-global-rwx
!include-service admin.vm.Create.StandaloneVM * include/admin-global-rwx
!include-service admin.vm.Create.TemplateVM * include/admin-global-rwx
!include-service admin.vm.CreateInPool.AppVM * include/admin-global-rwx
!include-service admin.vm.CreateInPool.DispVM * include/admin-global-rwx
!include-service admin.vm.CreateInPool.RemoteVM * include/admin-global-rwx
!include-service admin.vm.CreateInPool.StandaloneVM * include/admin-global-rwx
!include-service admin.vm.CreateInPool.TemplateVM * include/admin-global-rwx
!include-service admin.vm.CurrentState * include/admin-local-ro
!include-service admin.vm.device.block.Assign * include/admin-local-rwx
!include-service admin.vm.device.pci.Assign * include/admin-local-rwx
!include-service admin.vm.device.block.Attach * include/admin-local-rwx
!include-service admin.vm.device.pci.Attach * include/admin-local-rwx
!include-service admin.vm.device.block.Attached * include/admin-local-ro
!include-service admin.vm.device.pci.Attached * include/admin-local-ro
!include-service admin.vm.device.block.Available * include/admin-local-ro
!include-service admin.vm.device.pci.Available * include/admin-local-ro
!include-service admin.vm.device.denied.Add * include/admin-local-rwx
!include-service admin.vm.device.denied.List * include/admin-local-ro
!include-service admin.vm.device.denied.Remove * include/admin-local-rwx
!include-service admin.vm.device.block.Detach * include/admin-local-rwx
!include-service admin.vm.device.pci.Detach * include/admin-local-rwx
!include-service admin.vm.device.block.Assigned * include/admin-local-ro
!include-service admin.vm.device.pci.Assigned * include/admin-local-ro
!include-service admin.vm.device.block.Set.assignment * include/admin-local-rwx
!include-service admin.vm.device.pci.Set.assignment * include/admin-local-rwx
!include-service admin.vm.device.block.Unassign * include/admin-local-rwx
!include-service admin.vm.device.pci.Unassign * include/admin-local-rwx
!include-service admin.vm.feature.CheckWithAdminVM * include/admin-local-ro
!include-service admin.vm.feature.CheckWithNetvm * include/admin-local-ro
!include-service admin.vm.feature.CheckWithTemplate * include/admin-local-ro
!include-service admin.vm.feature.CheckWithTemplateAndAdminVM * include/admin-local-ro
!include-service admin.vm.feature.Get * include/admin-local-ro
!include-service admin.vm.feature.List * include/admin-local-ro
!include-service admin.vm.feature.Remove * include/admin-local-rwx
!include-service admin.vm.feature.Set * include/admin-local-rwx
!include-service admin.vm.firewall.Get * include/admin-local-ro
!include-service admin.vm.firewall.Reload * include/admin-local-rwx
!include-service admin.vm.firewall.Set * include/admin-local-rwx
!include-service admin.vm.Kill * include/admin-local-rwx
!include-service admin.vm.List * include/admin-global-ro
!include-service admin.vm.notes.Get * include/admin-local-ro
!include-service admin.vm.notes.Set * include/admin-local-rwx
!include-service admin.vm.Pause * include/admin-local-rwx
!include-service admin.vm.property.Get * include/admin-local-ro
!include-service admin.vm.property.GetAll * include/admin-local-ro
!include-service admin.vm.property.GetDefault * include/admin-local-ro
!include-service admin.vm.property.Help * include/admin-local-ro
!include-service admin.vm.property.List * include/admin-local-ro
!include-service admin.vm.property.Reset * include/admin-local-rwx
!include-service admin.vm.property.Set * include/admin-local-rwx
!include-service admin.vm.Remove * include/admin-global-rwx
!include-service admin.vm.Resume * include/admin-local-rwx
!include-service admin.vm.Shutdown * include/admin-local-rwx
!include-service admin.vm.Start * include/admin-local-rwx
!include-service admin.vm.Stats * include/admin-global-ro
!include-service admin.vm.Suspend * include/admin-local-rwx
!include-service admin.vm.tag.Get * include/admin-local-ro
!include-service admin.vm.tag.List * include/admin-local-ro
!include-service admin.vm.tag.Remove * include/admin-local-rwx
!include-service admin.vm.tag.Set * include/admin-local-rwx
!include-service admin.vm.Unpause * include/admin-local-rwx
!include-service admin.vm.volume.Clear * include/admin-local-rwx
!include-service admin.vm.volume.CloneFrom * include/admin-local-rwx
!include-service admin.vm.volume.CloneTo * include/admin-local-rwx
!include-service admin.vm.volume.Info * include/admin-local-ro
!include-service admin.vm.volume.List * include/admin-local-ro
!include-service admin.vm.volume.ListSnapshots * include/admin-local-ro
!include-service admin.vm.volume.Resize * include/admin-local-rwx
!include-service admin.vm.volume.Revert * include/admin-local-rwx
!include-service admin.vm.volume.Set.ephemeral * include/admin-local-rwx
!include-service admin.vm.volume.Set.revisions_to_keep * include/admin-local-rwx
!include-service admin.vm.volume.Set.rw * include/admin-local-rwx
!include-service admin.vmclass.List * include/admin-global-ro

--- /etc/qubes/policy.d/90-admin-policy-default.policy ---
## Do not modify this file, create a new policy file with a lower number in the
## filename instead. For example `30-admin-policy.policy`.

###
### Policy Admin API qrexec policy
###

## WARNING: the services here allow viewing and changing the Qubes RPC policy,
## which effectively gives the caller full control over the system. You should
## allow them only to trusted qubes.

## For convenience of maintaining this policy, all services include one of:
##  - include/admin-policy-rwx (services to modify the policy)
##  - include/admin-policy-ro (services to read the policy)

!include-service policy.List             *  include/admin-policy-ro
!include-service policy.include.List     *  include/admin-policy-ro
!include-service policy.Get              *  include/admin-policy-ro
!include-service policy.include.Get      *  include/admin-policy-ro
!include-service policy.GetFiles         *  include/admin-policy-ro

!include-service policy.Replace          *  include/admin-policy-rwx
!include-service policy.include.Replace  *  include/admin-policy-rwx
!include-service policy.Remove           *  include/admin-policy-rwx
!include-service policy.include.Remove   *  include/admin-policy-rwx

--- /etc/qubes/policy.d/90-default-gui-daemon.policy ---
## Note that policy parsing stops at the first match,
## so adding anything below "@anyvm @anyvm action" line will have no effect
##
## Clipboard paste (Ctrl-Shift-V) will treat "ask" as "allow" but only when
## called by this keyboard shortcut. "deny" always denies the operation.

## Please use a single # to start your custom comments

qubes.ClipboardPaste * @adminvm	@anyvm	ask
qubes.ClipboardPaste * @anyvm	@anyvm	ask

# The default policy handles only GUI in dom0. GUIVM needs similar line in its
# policy too.
qubes.WindowIconUpdater *   @anyvm dom0 allow

--- /etc/qubes/policy.d/90-default-linux.policy ---
# qubes-dom0-update
qubes.ReceiveUpdates    * @anyvm	dom0	allow

# This used to define policies for:
# - qubes.repos.List
# - qubes.repos.Enable
# - qubes.repos.Disable
# but since those are "deny" by default anyway, skip them

--- /etc/qubes/policy.d/90-default-pdf-convert.policy ---
## Note that policy parsing stops at the first match,
## so adding anything below "@anyvm @anyvm action" line will have no effect

## Please use a single # to start your custom comments

qubes.PdfConvert * @anyvm @dispvm allow

--- /etc/qubes/policy.d/90-default.policy ---
## Do not modify this file, create a new policy file with a lower number in the
## filename instead. For example `30-user.policy`.

###
### Default qrexec policy
###

## File format:
## service-name|*       +argument|* source          destination action  [options]

## Note that policy parsing stops at the first match.

# policy.RegisterArgument should be allowed only for specific arguments.
policy.RegisterArgument *           @anyvm          @anyvm      deny
policy.RegisterArgument *           @anyvm          dom0        deny

# WARNING: The qubes.ConnectTCP service is dangerous and allows any
# qube to access any other qube TCP port. It should be restricted
# only to restricted qubes. This is why the default policy is 'deny'

# Example of policy: qubes.ConnectTCP +22 mytcp-client @default allow target=mytcp-server
qubes.ConnectTCP        *           @anyvm          @anyvm      deny

# VM advertise its supported features
qubes.FeaturesRequest   *           @anyvm	        dom0	    allow

# Windows VM advertise installed Qubes Windows Tools
qubes.NotifyTools       *           @anyvm          dom0        allow

# File copy/move
qubes.Filecopy          *           @anyvm          @anyvm      ask

# Get current date/time
qubes.GetDate           *           @tag:anon-vm    @anyvm      deny
qubes.GetDate           *           @anyvm          @anyvm      allow target=dom0

# Get slightly randomized date/time
qubes.GetRandomizedTime *           @anyvm          dom0        allow

# Convert image to a safe format, also, allows to get an image (icon) file from a VM
qubes.GetImageRGBA      *           @anyvm          @dispvm     allow
qubes.GetImageRGBA      *           @anyvm          @anyvm      ask

# Notify about available updates
qubes.NotifyUpdates     *           @anyvm          dom0        allow

# Open a file in a VM
qubes.OpenInVM          *           @anyvm          @dispvm     allow
qubes.OpenInVM          *           @anyvm          @anyvm      ask

# Open URL in a VM
qubes.OpenURL           *           @anyvm          @dispvm     allow
qubes.OpenURL           *           @anyvm          @anyvm      ask

# Start application using its menu entry (only applications with menu entries
# are allowed, no arbitrary command). Argument is an application name (in case
# of Linux, basename of .desktop file from /usr/share/applications or similar
# location).
qubes.StartApp          *           @anyvm          @dispvm     allow
qubes.StartApp          *           @anyvm          @anyvm      ask

# Sends list of available applications - relevant for GUI being in dom0;
# otherwise earlier policy will redirect it
qubes.SyncAppMenus      *           @anyvm          dom0        allow

# notifications - relevant for GUI in dom0, otherwise earlier policy will
# redirect it
qubes.Notifications     *           @anyvm          @default    allow target=dom0

# HTTP proxy for downloading updates
# Upgrade all TemplateVMs through sys-whonix.
#qubes.UpdatesProxy     *    @type:TemplateVM        @default    allow target=sys-whonix
# Upgrade Whonix TemplateVMs through sys-whonix.
qubes.UpdatesProxy      *   @tag:whonix-updatevm    @default    allow target=sys-whonix
# Deny Whonix TemplateVMs using UpdatesProxy of any other VM.
qubes.UpdatesProxy      *   @tag:whonix-updatevm    @anyvm      deny
# Default rule for all TemplateVMs - direct the connection to sys-net
qubes.UpdatesProxy      *   @type:TemplateVM        @default    allow target=sys-net
qubes.UpdatesProxy      *   @anyvm                  @anyvm      deny

# WARNING: The qubes.VMShell service is dangerous and there are really few
# cases when it could be safely used. Especially when policy set to "ask" you
# have no way to know for sure what command(s) will be called. Compromissed
# source VM can substitute the command. Allowing one VM to execute
# qubes.VMShell over the other VM allows the former to TAKE FULL CONTROL over
# the later. In most cases this is not what we want!
#
# Instead we should be using task-specific qrexec services which provide
# assurance as to what program will be responding to the (untrusted) VM
# requests.
#
# It is, however, safe, in most cases, to allow ultimate control of the
# creating AppVM over the DisposableVM it creates as part of the qrexec service
# invocation. That's why by default we have "@anyvm  @dispvm allow" rule. Note
# that it does _not_ allow any AppVM to execute qubes.VMShell service over any
# DispVM created in the system -- that would obviously be wrong. It only allows
# qubes.VMShell service access to the AppVM which creates the DispVM as part of
# this very service invocation.
#
# See e.g. this thread for some discussion:
# https://groups.google.com/d/msg/qubes-users/xnAByaL_bjI/3PjYdiTDW-0J
qubes.VMShell           *           @anyvm          @dispvm     allow
qubes.VMShell           *           @anyvm          @anyvm      deny

# WARNING: qubes.VMRootShell has similar risks as qubes.VMExec
# Add "user=root" option to any ask or allow rules.
qubes.VMRootShell       *           @anyvm          @anyvm      deny

# WARNING: The qubes.VMExec service is dangerous and there are really few
# cases when it could be safely used. Contrary to qubes.VMShell, when policy is
# set to "ask", the command to be executed is visible in the confirmation
# prompt. But once allowed, the source VM have full control over the command
# standard input/output. Allowing one VM to execute qubes.VMExec over the
# other VM allows the former to TAKE FULL CONTROL over the later. In most cases
# this is not what we want!
#
# Instead we should be using task-specific qrexec services which provide
# assurance as to what program will be responding to the (untrusted) VM
# requests.
#
# It is, however, safe, in most cases, to allow ultimate control of the
# creating AppVM over the DisposableVM it creates as part of the qrexec service
# invocation. That's why by default we have "@anyvm  @dispvm allow" rule. Note
# that it does _not_ allow any AppVM to execute qubes.VMExec service over any
# DispVM created in the system -- that would obviously be wrong. It only allows
# qubes.VMExec service access to the AppVM which creates the DispVM as part of
# this very service invocation.
#
# See e.g. this thread for some discussion:
# https://groups.google.com/d/msg/qubes-users/xnAByaL_bjI/3PjYdiTDW-0J
qubes.VMExec            *           @anyvm          @dispvm     allow
qubes.VMExec            *           @anyvm          @anyvm      deny

# WARNING: qubes.VMExecGUI has similar risks as qubes.VMExec
qubes.VMExecGUI         *           @anyvm          @dispvm     allow
qubes.VMExecGUI         *           @anyvm          @anyvm      deny

--- /etc/qubes/policy.d/include ---

--- /etc/qubes/policy.d/README ---
# This directory contains qrexec policy in new (Qubes R5.0) format.
# See https://www.qubes-os.org/doc/ for explanation. If you want to
# write your own policy, see the '30-user' file.


===== 10. Effective policy query (if tools exist) =====

$ command -v qrexec-policy-graph && qrexec-policy-graph --include-ask 2>&1 | grep -iE "signer|clipboard" | head -30
/usr/bin/qrexec-policy-graph
qrexec.exc.PolicySyntaxError: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *

$ command -v qvm-tags && qvm-tags dom0 2>/dev/null | head -20
/usr/bin/qvm-tags

===== 11. qrexec policy daemon status =====

$ systemctl status qrexec-policy-daemon --no-pager -l
Unit qrexec-policy-daemon.service could not be found.

$ systemctl is-active qrexec-policy-daemon
inactive

===== 12. Target qube info (nostr_signer) =====

$ qvm-ls --raw-data --fields NAME,STATE,CLASS,TEMPLATE,NETVM nostr_signer
nostr_signer|Running|StandaloneVM|-|sys-vpn-mullvad-app

$ qvm-features nostr_signer
default-menu-items                          xfce4-terminal.desktop thunar.desktop firefox-esr.desktop xfce-settings-manager.desktop
menu-items                                  brave-browser.desktop org.xfce.mousepad.desktop xfce-settings-manager.desktop thunar.desktop codium.desktop xfce4-terminal.desktop
netvm-menu-items                            debian-xterm.desktop
qrexec                                      1
os                                          Linux
supported-service.gui-agent-clipboard-wipe  1
supported-service.qubes-updates-proxy       1
supported-service.apparmor                  1
apparmor                                    1
supported-service.crond                     1
supported-service.minimal-usbvm             1
supported-service.pipewire                  1
supported-service.cups                      1
supported-service.minimal-netvm             1
supported-service.qubes-firewall            1
supported-service.qubes-network             1
supported-service.modem-manager             1
supported-service.no-qubesincoming-cleanup  1
supported-service.updates-proxy-setup       1
supported-service.clocksync                 1
supported-service.meminfo-writer            1
supported-service.network-manager           1
supported-service.qubes-update-check        1
supported-rpc.qubes.OpenInVM                1
supported-rpc.qubes.SuspendPostAll          1
supported-rpc.qubes.RegisterBackupLocation  1
supported-rpc.qubes.USB                     1
supported-rpc.qubes.SetDateTime             1
supported-rpc.qubes.DetachPciDevice         1
supported-rpc.qubes.WaitForSession          1
supported-rpc.qubes.StartApp                1
supported-rpc.qubes.Filecopy                1
supported-rpc.qubes.InstallUpdatesGUI       1
supported-rpc.qubes.SuspendPre              1
supported-rpc.qubes.PdfConvert              1
supported-rpc.qubes.SelectFile              1
supported-rpc.qubes.TemplateSearch          1
supported-rpc.qubes.PostInstall             1
supported-rpc.qubes.Backup                  1
supported-rpc.qubes.TemplateDownload        1
supported-rpc.qubes.VMShell                 1
supported-rpc.qubes.SetMonitorLayout        1
supported-rpc.qubes.OpenURL                 1
supported-rpc.qubes.ShowInTerminal          1
supported-rpc.qubes.GetAppmenus             1
supported-rpc.qubes.Gpg                     1
supported-rpc.qubes.SuspendPost             1
supported-rpc.qubes.ResizeDisk              1
supported-rpc.qubes.SaltLinuxVM             1
supported-rpc.qubes.USBAttach               1
supported-rpc.qubes.Restore                 1
supported-rpc.qubes.GuiVMSession            1
supported-rpc.qubes.GetDate                 1
supported-rpc.qubes.USBDetach               1
supported-rpc.qubes.GpgImportKey            1
supported-rpc.qubes.VMExec                  1
supported-rpc.qubes.WaitForNetworkUplink    1
supported-rpc.qubes.GetImageRGBA            1
supported-rpc.qubes.SuspendPreAll           1
supported-rpc.qubes.VMRootExec              1
supported-rpc.qubes.VMExecGUI               1
supported-rpc.qubes.WaitForRunningSystem    1
supported-rpc.qubes.VMRootShell             1
supported-rpc.qubes.RestoreById             1
supported-rpc.qubes.SelectDirectory         1
supported-feature.memory-hotplug            1
os-distribution                             debian
os-version                                  13
os-eol                                      2028-08-09
qubes-agent-version                         4.3
gui                                         1
qubes-firewall                              1
vmexec                                      1
template-name                               debian-13-xfce
template-epoch                              0
template-version                            4.3.0
template-release                            202512040043
template-reponame                           @commandline
template-buildtime                          2025-12-04 01:03:33
template-installtime                        2026-03-23 23:42:36
template-license                            GPLv3+
template-url                                http://www.qubes-os.org
template-summary                            Qubes OS template for debian-13-xfce
template-description                        Qubes OS template for debian-13-xfce.
updates-available                           1
last-updates-check                          2026-08-19 07:47:50
last-update                                 2026-05-03 08:55:29
supported-rpc.qubes.NsignerRpc              1

$ qvm-prefs nostr_signer
audiovm               D  dom0
autostart             D  False
backup_timestamp      U
bootmode              D  default
debug                 D  False
default_dispvm        D  default-dvm
default_user          D  user
devices_denied        D  
dns                   D  10.139.1.1 10.139.1.2
gateway               D  
gateway6              D  
guivm                 D  dom0
icon                  D  standalonevm-yellow
include_in_backups    D  True
installed_by_rpm      D  False
ip                    D  10.137.0.26
ip6                   D  fd09:24ef:4179::a89:1a
kernel                D  6.12.59-1.fc41
kernelopts            D  swiotlb=2048
keyboard_layout       D  us++
klass                 D  StandaloneVM
label                 -  yellow
mac                   D  00:16:3e:5e:6c:00
management_dispvm     D  default-mgmt-dvm
maxmem                D  4000
memory                D  400
name                  -  nostr_signer
netvm                 -  sys-vpn-mullvad-app
provides_network      -  False
qid                   -  26
qrexec_timeout        D  60
shutdown_timeout      D  60
start_time            D  1786966896.93
stubdom_mem           U
stubdom_uuid          D  
stubdom_xid           D  -1
template_for_dispvms  D  False
updateable            D  True
uuid                  -  5e4cd87f-2bd2-4de3-a581-985abce50b04
vcpus                 D  2
virt_mode             D  pvh
visible_gateway       D  10.137.0.20
visible_gateway6      D  fd09:24ef:4179::a89:14
visible_ip            D  10.137.0.26
visible_ip6           D  fd09:24ef:4179::a89:1a
visible_netmask       D  255.255.255.255
xid                   D  14

===== 13. Caller qube info (ai) =====

$ qvm-ls --raw-data --fields NAME,STATE,CLASS,TEMPLATE,NETVM ai
ai|Running|StandaloneVM|-|sys-vpn-mullvad-app

$ qvm-features ai
default-menu-items                          xfce4-terminal.desktop thunar.desktop firefox-esr.desktop xfce-settings-manager.desktop
menu-items                                  brave-browser.desktop xfce4-mime-settings.desktop firefox-esr.desktop org.gnumeric.gnumeric.desktop libreoffice-writer.desktop org.xfce.mousepad.desktop com.obsproject.Studio.desktop pgadmin4.desktop pavucontrol.desktop xfce-settings-manager.desktop thunar.desktop vlc.desktop codium.desktop xfce4-terminal.desktop
netvm-menu-items                            debian-xterm.desktop
qrexec                                      1
os                                          Linux
supported-service.gui-agent-clipboard-wipe  1
supported-service.qubes-updates-proxy       1
supported-service.apparmor                  1
apparmor                                    1
supported-service.crond                     1
supported-service.minimal-usbvm             1
supported-service.pipewire                  1
supported-service.cups                      1
supported-service.minimal-netvm             1
supported-service.qubes-firewall            1
supported-service.qubes-network             1
supported-service.modem-manager             1
supported-service.no-qubesincoming-cleanup  1
supported-service.updates-proxy-setup       1
supported-service.clocksync                 1
supported-service.meminfo-writer            1
supported-service.network-manager           1
supported-service.qubes-update-check        1
supported-rpc.qubes.OpenInVM                1
supported-rpc.qubes.SuspendPostAll          1
supported-rpc.qubes.RegisterBackupLocation  1
supported-rpc.qubes.USB                     1
supported-rpc.qubes.SetDateTime             1
supported-rpc.qubes.DetachPciDevice         1
supported-rpc.qubes.WaitForSession          1
supported-rpc.qubes.StartApp                1
supported-rpc.qubes.Filecopy                1
supported-rpc.qubes.InstallUpdatesGUI       1
supported-rpc.qubes.SuspendPre              1
supported-rpc.qubes.PdfConvert              1
supported-rpc.qubes.SelectFile              1
supported-rpc.qubes.TemplateSearch          1
supported-rpc.qubes.PostInstall             1
supported-rpc.qubes.Backup                  1
supported-rpc.qubes.TemplateDownload        1
supported-rpc.qubes.VMShell                 1
supported-rpc.qubes.SetMonitorLayout        1
supported-rpc.qubes.OpenURL                 1
supported-rpc.qubes.ShowInTerminal          1
supported-rpc.qubes.GetAppmenus             1
supported-rpc.qubes.Gpg                     1
supported-rpc.qubes.SuspendPost             1
supported-rpc.qubes.ResizeDisk              1
supported-rpc.qubes.SaltLinuxVM             1
supported-rpc.qubes.USBAttach               1
supported-rpc.qubes.Restore                 1
supported-rpc.qubes.GuiVMSession            1
supported-rpc.qubes.GetDate                 1
supported-rpc.qubes.USBDetach               1
supported-rpc.qubes.GpgImportKey            1
supported-rpc.qubes.VMExec                  1
supported-rpc.qubes.WaitForNetworkUplink    1
supported-rpc.qubes.GetImageRGBA            1
supported-rpc.qubes.SuspendPreAll           1
supported-rpc.qubes.VMRootExec              1
supported-rpc.qubes.VMExecGUI               1
supported-rpc.qubes.WaitForRunningSystem    1
supported-rpc.qubes.VMRootShell             1
supported-rpc.qubes.RestoreById             1
supported-rpc.qubes.SelectDirectory         1
supported-feature.memory-hotplug            1
os-distribution                             debian
os-version                                  13
os-eol                                      2028-08-09
qubes-agent-version                         4.3
gui                                         1
qubes-firewall                              1
vmexec                                      1
template-name                               debian-13-xfce
template-epoch                              0
template-version                            4.3.0
template-release                            202512040043
template-reponame                           @commandline
template-buildtime                          2025-12-04 01:03:33
template-installtime                        2026-03-23 23:42:36
template-license                            GPLv3+
template-url                                http://www.qubes-os.org
template-summary                            Qubes OS template for debian-13-xfce
template-description                        Qubes OS template for debian-13-xfce.
updates-available                           1
last-updates-check                          2026-08-18 17:25:14
last-update                                 2026-08-02 07:16:44
qubesmanager.maxmem_value                   100000
supported-service.guivm-gui-agent           1
kvm                                         true

===== 14. Recent qrexec/policy journal errors =====

$ journalctl -b --no-pager 2>/dev/null | grep -iE "qrexec|policy|SignerRpc|NsignerRpc|clipboard" | tail -80
Aug 20 14:10:57 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: denied: no matching rule found
Aug 20 14:11:11 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NsignerRpc+: ai -> nostr_signer: allowed to nostr_signer
Aug 20 14:12:09 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: denied: no matching rule found
Aug 20 14:12:09 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NsignerRpc+: ai -> nostr_signer: allowed to nostr_signer
Aug 20 14:12:24 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ConnectTCP: ai -> nostr_signer: denied: denied by policy /etc/qubes/policy.d/90-default.policy:22
Aug 20 14:14:38 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: denied: no matching rule found
Aug 20 14:19:19 dom0 sudo[45983]:    rubik : TTY=pts/18 ; PWD=/home/rubik/Desktop ; USER=root ; COMMAND=/usr/bin/mkdir -p /etc/qubes-rpc/policy/
Aug 20 14:20:47 dom0 sudo[46015]:    rubik : TTY=pts/18 ; PWD=/home/rubik/Desktop ; USER=root ; COMMAND=/usr/bin/tee /etc/qubes-rpc/policy/qubes.SignerRpc
Aug 20 14:21:07 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 14:21:07 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 14:22:08 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 14:22:08 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ClipboardPaste: dom0 -> ai: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 14:23:06 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 14:23:06 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ClipboardPaste: dom0 -> ai: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 14:23:55 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 14:23:55 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ClipboardPaste: dom0 -> ai: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 14:24:48 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 14:24:48 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ClipboardPaste: dom0 -> ai: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 14:32:15 dom0 sudo[46192]:    rubik : TTY=pts/18 ; PWD=/etc/qubes-rpc/policy ; USER=root ; COMMAND=/usr/bin/nano /etc/qubes-rpc/policy
Aug 20 14:32:15 dom0 kernel: audit: type=1123 audit(1787250735.834:625): pid=46192 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes-rpc/policy" cmd=6E616E6F202F6574632F71756265732D7270632F706F6C696379 exe="/usr/bin/sudo" terminal=pts/18 res=success'
Aug 20 14:32:15 dom0 audit[46192]: USER_CMD pid=46192 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes-rpc/policy" cmd=6E616E6F202F6574632F71756265732D7270632F706F6C696379 exe="/usr/bin/sudo" terminal=pts/18 res=success'
Aug 20 14:35:41 dom0 kernel: audit: type=1123 audit(1787250941.718:631): pid=46228 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes-rpc/policy" cmd=61707420696E7374616C6C206C6F63617465 exe="/usr/bin/sudo" terminal=pts/18 res=failed'
Aug 20 14:35:41 dom0 audit[46228]: USER_CMD pid=46228 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes-rpc/policy" cmd=61707420696E7374616C6C206C6F63617465 exe="/usr/bin/sudo" terminal=pts/18 res=failed'
Aug 20 14:40:19 dom0 sudo[46247]:    rubik : TTY=pts/18 ; PWD=/etc/qubes-rpc/policy ; USER=root ; COMMAND=/usr/bin/find / -iname *nsigner*
Aug 20 14:40:19 dom0 kernel: audit: type=1123 audit(1787251219.942:633): pid=46247 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes-rpc/policy" cmd=66696E64202F202D696E616D65202A6E7369676E65722A exe="/usr/bin/sudo" terminal=pts/18 res=success'
Aug 20 14:40:19 dom0 audit[46247]: USER_CMD pid=46247 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes-rpc/policy" cmd=66696E64202F202D696E616D65202A6E7369676E65722A exe="/usr/bin/sudo" terminal=pts/18 res=success'
Aug 20 14:46:48 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 14:46:48 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 14:46:59 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 14:46:59 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 14:46:59 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 14:46:59 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NsignerRpc: ai -> nostr_signer: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 14:50:43 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 14:50:43 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 14:57:00 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 14:57:00 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 14:58:43 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 14:58:43 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ClipboardPaste: dom0 -> ai: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 14:59:31 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 14:59:31 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ClipboardPaste: dom0 -> ai: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 15:02:59 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 15:02:59 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ClipboardPaste: dom0 -> ai: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 15:06:00 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 15:06:00 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ClipboardPaste: dom0 -> ai: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 15:18:18 dom0 sudo[46648]:    rubik : TTY=pts/18 ; PWD=/etc/qubes/policy.d ; USER=root ; COMMAND=/usr/bin/chown --reference=/etc/qubes/policy.d/50-config-updates.policy /etc/qubes/policy.d/50-config-clipboard.policy
Aug 20 15:18:18 dom0 kernel: audit: type=1123 audit(1787253498.846:652): pid=46648 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes/policy.d" cmd=63686F776E202D2D7265666572656E63653D2F6574632F71756265732F706F6C6963792E642F35302D636F6E6669672D757064617465732E706F6C696379202F6574632F71756265732F706F6C6963792E642F35302D636F6E6669672D636C6970626F6172642E706F6C696379 exe="/usr/bin/sudo" terminal=pts/18 res=success'
Aug 20 15:18:18 dom0 audit[46648]: USER_CMD pid=46648 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes/policy.d" cmd=63686F776E202D2D7265666572656E63653D2F6574632F71756265732F706F6C6963792E642F35302D636F6E6669672D757064617465732E706F6C696379202F6574632F71756265732F706F6C6963792E642F35302D636F6E6669672D636C6970626F6172642E706F6C696379 exe="/usr/bin/sudo" terminal=pts/18 res=success'
Aug 20 15:19:35 dom0 sudo[46666]:    rubik : TTY=pts/18 ; PWD=/etc/qubes/policy.d ; USER=root ; COMMAND=/usr/bin/chown --reference=/etc/qubes/policy.d/50-config-updates.policy /etc/qubes/policy.d/45-signer.policy
Aug 20 15:19:35 dom0 kernel: audit: type=1123 audit(1787253575.796:658): pid=46666 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes/policy.d" cmd=63686F776E202D2D7265666572656E63653D2F6574632F71756265732F706F6C6963792E642F35302D636F6E6669672D757064617465732E706F6C696379202F6574632F71756265732F706F6C6963792E642F34352D7369676E65722E706F6C696379 exe="/usr/bin/sudo" terminal=pts/18 res=success'
Aug 20 15:19:35 dom0 audit[46666]: USER_CMD pid=46666 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes/policy.d" cmd=63686F776E202D2D7265666572656E63653D2F6574632F71756265732F706F6C6963792E642F35302D636F6E6669672D757064617465732E706F6C696379202F6574632F71756265732F706F6C6963792E642F34352D7369676E65722E706F6C696379 exe="/usr/bin/sudo" terminal=pts/18 res=success'
Aug 20 15:21:08 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 15:21:08 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 17:16:08 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 17:16:08 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NotifyUpdates: sys-whonix -> dom0: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 17:16:24 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 17:16:24 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NotifyUpdates: sys-net -> dom0: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 17:17:36 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 17:17:36 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NotifyUpdates: sys-firewall -> dom0: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 17:17:38 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 17:17:38 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NotifyUpdates: sys-vpn-mullvad-app -> dom0: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 17:18:40 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 17:18:40 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NotifyUpdates: clearnet -> dom0: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 17:20:24 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 17:20:24 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.GetDate+nanoseconds: ai -> @default: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 17:22:40 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 17:22:40 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.GetDate+nanoseconds: sys-firewall -> @default: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 17:24:05 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 17:24:05 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.GetDate+nanoseconds: sys-usb -> @default: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 17:24:16 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 17:24:16 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.GetDate+nanoseconds: clearnet -> @default: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 17:25:13 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 17:25:13 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NotifyUpdates: ai -> dom0: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 17:25:33 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 17:25:33 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.GetDate+nanoseconds: sys-vpn-mullvad-app -> @default: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 17:25:57 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 17:25:57 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NotifyUpdates: nostr -> dom0: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 17:30:50 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 17:30:50 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.GetDate+nanoseconds: nostr -> @default: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
Aug 20 17:58:59 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
Aug 20 17:58:59 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.GetDate+nanoseconds: vault -> @default: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *

===== 15. qrexec service definitions in target qube (via qvm-run, read-only) =====

$ qvm-run -p nostr_signer "ls -la /etc/qubes-rpc/ 2>/dev/null; echo ---; ls -la /rw/config/qubes-rpc/ 2>/dev/null; echo ---; cat /rw/config/rc.local 2>/dev/null" 2>&1 | head -60
total 172
drwxr-xr-x   2 root root  4096 Jul 11 09:43 .
drwxr-xr-x 132 root root 12288 Aug 17 07:41 ..
lrwxrwxrwx   1 root root    32 Feb 19 22:38 policy.Ask -> /var/run/qubes/policy-agent.sock
lrwxrwxrwx   1 root root    32 Feb 19 22:38 policy.Notify -> /var/run/qubes/policy-agent.sock
-rwxr-xr-x   1 root root   734 Nov 24  2025 qubes.Backup
lrwxrwxrwx   1 root root    18 Jan 11  2026 qubes.ConnectTCP -> /dev/tcp/127.0.0.1
-rwxr-xr-x   1 root root    92 Nov 24  2025 qubes.DetachPciDevice
-rwxr-xr-x   1 root root   304 Nov 24  2025 qubes.Filecopy
-rwxr-xr-x   1 root root  2183 Nov 24  2025 qubes.GetAppmenus
-rwxr-xr-x   1 root root   887 Nov 24  2025 qubes.GetDate
-rwxr-xr-x   1 root root  1529 Nov 24  2025 qubes.GetImageRGBA
-rwxr-xr-x   1 root root  1549 Oct 27  2025 qubes.Gpg
-rwxr-xr-x   1 root root    42 Oct 27  2025 qubes.GpgImportKey
lrwxrwxrwx   1 root root    27 Nov 23  2025 qubes.GuiVMSession -> /usr/bin/qubes-start-xephyr
-rwxr-xr-x   1 root root  1130 Nov 24  2025 qubes.InstallUpdatesGUI
-rwxr-xr-x   1 root root    65 Jul 11 09:44 qubes.NsignerRpc
-rwxr-xr-x   1 root root    45 Nov 24  2025 qubes.OpenInVM
-rwxr-xr-x   1 root root   195 Nov 24  2025 qubes.OpenURL
lrwxrwxrwx   1 root root    34 Oct  9  2025 qubes.PdfConvert -> /usr/lib/qubes/qpdf-convert-server
-rwxr-xr-x   1 root root  1006 Nov 24  2025 qubes.PostInstall
-rwxr-xr-x   1 root root  1027 Nov 24  2025 qubes.RegisterBackupLocation
-rwxr-xr-x   1 root root   439 Nov 24  2025 qubes.ResizeDisk
-rwxr-xr-x   1 root root  1393 Nov 24  2025 qubes.Restore
-rwxr-xr-x   1 root root  2620 Nov 24  2025 qubes.RestoreById
-rwxr-xr-x   1 root root  2059 Oct  4  2025 qubes.SaltLinuxVM
-rwxr-xr-x   1 root root    67 Nov 24  2025 qubes.SelectDirectory
-rwxr-xr-x   1 root root    55 Nov 24  2025 qubes.SelectFile
-rwxr-xr-x   1 root root   356 Nov 24  2025 qubes.SetDateTime
lrwxrwxrwx   1 root root    33 Nov 23  2025 qubes.SetMonitorLayout -> /usr/bin/qubes-set-monitor-layout
-rwxr-xr-x   1 root root   428 Nov 24  2025 qubes.ShowInTerminal
-rwxr-xr-x   1 root root  1799 Nov 24  2025 qubes.StartApp
-rwxr-xr-x   1 root root    48 Nov 24  2025 qubes.SuspendPost
-rwxr-xr-x   1 root root  1006 Nov 24  2025 qubes.SuspendPostAll
-rwxr-xr-x   1 root root    49 Nov 24  2025 qubes.SuspendPre
-rwxr-xr-x   1 root root  1005 Nov 24  2025 qubes.SuspendPreAll
-rwxr-xr-x   1 root root    70 Nov 24  2025 qubes.TemplateDownload
-rwxr-xr-x   1 root root    67 Nov 24  2025 qubes.TemplateSearch
lrwxrwxrwx   1 root root    23 Jan 11  2026 qubes.UpdatesProxy -> /dev/tcp/127.0.0.1/8082
-rwxr-xr-x   1 root root   342 Aug  5  2025 qubes.USB
-rwxr-xr-x   1 root root   567 Aug  5  2025 qubes.USBAttach
-rwxr-xr-x   1 root root  1132 Aug  5  2025 qubes.USBDetach
-rwxr-xr-x   1 root root    43 Nov 24  2025 qubes.VMExec
lrwxrwxrwx   1 root root    12 Jan 11  2026 qubes.VMExecGUI -> qubes.VMExec
-rwxr-xr-x   1 root root    43 Nov 24  2025 qubes.VMRootExec
-rwxr-xr-x   1 root root   142 Nov 24  2025 qubes.VMRootShell
-rwxr-xr-x   1 root root    25 Nov 24  2025 qubes.VMShell
-rwxr-xr-x   1 root root   450 Nov 24  2025 qubes.WaitForNetworkUplink
-rwxr-xr-x   1 root root    68 Nov 24  2025 qubes.WaitForRunningSystem
-rwxr-xr-x   1 root root   304 Nov 24  2025 qubes.WaitForSession
---
---
#!/bin/sh

# This script will be executed at every VM startup, you can place your own
# custom commands here. This includes overriding some configuration in /etc,
# starting services etc.
#
# Executable scripts located in /rw/config/rc.local.d with the extension
# '.rc' are executed immediately before this rc.local.

===== 16. Test qrexec call to nostr_signer (read-only get_info) =====

$ echo "{\"id\":\"diag\",\"method\":\"get_info\",\"params\":[]}" | timeout 10 qrexec-client-vm nostr_signer qubes.SignerRpc 2>&1; echo "exit=$?"
timeout: failed to run command ‘qrexec-client-vm’: No such file or directory
exit=127

$ echo "{\"id\":\"diag\",\"method\":\"get_info\",\"params\":[]}" | timeout 10 qrexec-client-vm nostr_signer qubes.NsignerRpc 2>&1; echo "exit=$?"
timeout: failed to run command ‘qrexec-client-vm’: No such file or directory
exit=127

===== 17. Qubes global config files =====

$ ls -la /etc/qubes/ | head -30
total 36
drwxr-xr-x   7 root root  4096 Mar 23 19:24 .
drwxr-xr-x 112 root root  4096 Apr 27 07:31 ..
drwxrwx---   2 root qubes 4096 Mar 31 19:45 backup
-rw-r--r--   1 root root  3798 Oct 19  2025 guid.conf
drwxrwxr-x   3 root qubes 4096 Aug 20 15:12 policy.d
drwxr-xr-x   2 root root  4096 Mar 23 19:24 post-install.d
-rw-rw-r--   1 root qubes  471 Nov  8  2025 qmemman.conf
drwxr-xr-x   3 root root  4096 Mar 23 19:23 repo-templates
drwxr-xr-x   2 root root  4096 Mar 23 19:24 rpc-config

$ cat /etc/qubes/policy.d/50-config-input.policy 2>/dev/null
qubes.InputMouse * sys-usb dom0 allow
qubes.InputKeyboard * sys-usb dom0 allow
# not configurable by this state
qubes.InputTablet * sys-usb dom0 deny

$ cat /etc/qubes/policy.d/50-config-updates.policy 2>/dev/null
qubes.UpdatesProxy * @tag:whonix-updatevm @default allow target=sys-whonix
qubes.UpdatesProxy * @tag:whonix-updatevm @anyvm deny

===== DONE =====
