1446 lines
92 KiB
Plaintext
1446 lines
92 KiB
Plaintext
|
||
===== 1. Identity / versions =====
|
||
|
||
$ hostname
|
||
dom0
|
||
|
||
$ id
|
||
uid=0(root) gid=0(root) groups=0(root)
|
||
|
||
$ uname -a
|
||
Linux dom0 6.12.59-1.qubes.fc41.x86_64 #1 SMP PREEMPT_DYNAMIC Sun Nov 30 10:39:00 UTC 2025 x86_64 GNU/Linux
|
||
|
||
$ cat /etc/qubes-release
|
||
Qubes release 4.3.0 (R4.3)
|
||
|
||
$ qubesctl --version
|
||
usage: qubesctl [-h] [--show-output] [--force-color] [--skip-dom0]
|
||
[--max-concurrency MAX_CONCURRENCY] [--skip-top-check]
|
||
[--sync-extmods] [--targets TARGETS | --all] [--templates]
|
||
[--standalones] [--app]
|
||
...
|
||
qubesctl: error: unrecognized arguments: --version
|
||
|
||
$ rpm -q qubes-core-admin-linux qubes-core-qrexec
|
||
package qubes-core-admin-linux is not installed
|
||
qubes-core-qrexec-4.3.11-1.fc41.x86_64
|
||
|
||
===== 2. Qubes version detail =====
|
||
|
||
$ qvm-ls --raw-data --fields NAME,STATE,CLASS,TEMPLATE
|
||
ai|Running|StandaloneVM|-
|
||
anon-whonix|Running|AppVM|whonix-workstation-18
|
||
clearnet|Running|StandaloneVM|-
|
||
corn-whonix|Running|AppVM|whonix-workstation-18
|
||
debian-13-xfce|Halted|TemplateVM|-
|
||
default-dvm|Halted|AppVM|debian-13-xfce
|
||
default-mgmt-dvm|Halted|AppVM|debian-13-xfce
|
||
disp870|Paused|DispVM|default-dvm
|
||
disp9124|Paused|DispVM|default-dvm
|
||
dom0|Running|AdminVM|-
|
||
fedora-42-xfce|Halted|TemplateVM|-
|
||
n-os-tr|Halted|StandaloneVM|-
|
||
nostr|Running|StandaloneVM|-
|
||
nostr_signer|Running|StandaloneVM|-
|
||
sys-fips|Halted|StandaloneVM|-
|
||
sys-firewall|Running|DispVM|default-dvm
|
||
sys-net|Running|AppVM|debian-13-xfce
|
||
sys-usb|Running|DispVM|default-dvm
|
||
sys-vpn-mullvad-app|Running|StandaloneVM|-
|
||
sys-whonix|Running|AppVM|whonix-gateway-18
|
||
vault|Running|AppVM|debian-13-xfce
|
||
whonix-gateway-18|Halted|TemplateVM|-
|
||
whonix-workstation-18|Halted|TemplateVM|-
|
||
whonix-workstation-18-dvm|Halted|AppVM|whonix-workstation-18
|
||
|
||
$ qvm-ls --running
|
||
please wait... ................................................................................
|
||
NAME STATE CLASS LABEL TEMPLATE NETVM
|
||
ai Running StandaloneVM orange - sys-vpn-mullvad-app
|
||
anon-whonix Running AppVM red whonix-workstation-18 sys-whonix
|
||
clearnet Running StandaloneVM purple - sys-firewall
|
||
corn-whonix Running AppVM red whonix-workstation-18 sys-whonix
|
||
dom0 Running AdminVM black - -
|
||
nostr Running StandaloneVM gray - sys-vpn-mullvad-app
|
||
nostr_signer Running StandaloneVM yellow - sys-vpn-mullvad-app
|
||
sys-firewall Running DispVM green default-dvm sys-net
|
||
sys-net Running AppVM red debian-13-xfce -
|
||
sys-usb Running DispVM red default-dvm -
|
||
sys-vpn-mullvad-app Running StandaloneVM red - sys-firewall
|
||
sys-whonix Running AppVM black whonix-gateway-18 sys-firewall
|
||
vault Running AppVM black debian-13-xfce -
|
||
|
||
===== 3. Policy directories inventory =====
|
||
|
||
$ ls -la /etc/qubes/policy.d/
|
||
total 80
|
||
drwxrwxr-x 3 root qubes 4096 Aug 20 15:12 .
|
||
drwxr-xr-x 7 root root 4096 Mar 23 19:24 ..
|
||
-rw-rw-r-- 1 root root 674 Aug 30 2025 35-compat.policy
|
||
-rw-r--r-- 1 root root 284 Aug 20 14:45 45-signer.policy
|
||
-rw-r--r-- 1 root root 3 Aug 20 15:12 50-config-clipboard.policy
|
||
-rw-r--r-- 1 root root 150 Mar 23 20:00 50-config-input.policy
|
||
-rw-r--r-- 1 root root 129 Mar 23 19:59 50-config-updates.policy
|
||
-rw-rw-r-- 1 root qubes 2961 Dec 9 2025 80-whonix.policy
|
||
-rw-rw-r-- 1 root qubes 2261 Nov 8 2025 85-admin-backup-restore.policy
|
||
-rw-rw-r-- 1 root qubes 9075 Nov 8 2025 90-admin-default.policy
|
||
-rw-rw-r-- 1 root root 1197 Aug 30 2025 90-admin-policy-default.policy
|
||
-rw-r--r-- 1 root root 563 Oct 19 2025 90-default-gui-daemon.policy
|
||
-rw-rw-r-- 1 root qubes 227 Nov 4 2025 90-default-linux.policy
|
||
-rw-rw-r-- 1 root qubes 227 Oct 9 2025 90-default-pdf-convert.policy
|
||
-rw-rw-r-- 1 root qubes 6690 Nov 8 2025 90-default.policy
|
||
drwxrwxr-x 2 root qubes 4096 Mar 23 19:24 include
|
||
-rw-rw-r-- 1 root root 185 Aug 30 2025 README
|
||
|
||
$ ls -la /etc/qubes-rpc/policy/
|
||
total 24
|
||
drwxrwsr-x 3 root qubes 4096 Aug 20 14:20 .
|
||
drwxr-xr-x 3 root root 12288 Aug 16 17:10 ..
|
||
drwxrwxr-x 2 root root 4096 Aug 30 2025 include
|
||
-rw-r--r-- 1 root qubes 12 Aug 20 14:20 qubes.SignerRpc
|
||
|
||
$ ls -la /usr/share/qubes/policy.d/
|
||
ls: cannot access '/usr/share/qubes/policy.d/': No such file or directory
|
||
|
||
$ ls -la /etc/qubes-rpc/
|
||
total 88
|
||
drwxr-xr-x 3 root root 12288 Aug 16 17:10 .
|
||
drwxr-xr-x 112 root root 4096 Apr 27 07:31 ..
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.backup.Cancel -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.backup.Execute -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.backup.Info -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.deviceclass.List -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.Events -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.label.Create -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.label.Get -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.label.Index -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.label.List -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.label.Remove -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.Add -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.Info -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.List -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.ListDrivers -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.Remove -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.Set.ephemeral_volatile -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.Set.revisions_to_keep -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.UsageDetails -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.volume.Info -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.volume.List -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.volume.ListSnapshots -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.volume.Resize -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.volume.Revert -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.volume.Set.ephemeral -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.volume.Set.revisions_to_keep -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.volume.Set.rw -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.pool.volume.Snapshot -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.property.Get -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.property.GetAll -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.property.GetDefault -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.property.Help -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.property.HelpRst -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.property.List -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.property.Reset -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.property.Set -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vmclass.List -> ../../var/run/qubesd.sock
|
||
-rwxr-xr-x 1 root root 705 Nov 8 2025 admin.vm.Console
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.Create.AppVM -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.CreateDisposable -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.Create.DispVM -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.CreateInPool.AppVM -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.CreateInPool.DispVM -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.CreateInPool.StandaloneVM -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.CreateInPool.TemplateVM -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.Create.StandaloneVM -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.Create.TemplateVM -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.CurrentState -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.block.Assign -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.block.Assigned -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.block.Attach -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.block.Attached -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.block.Available -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.block.Detach -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.block.Set.assignment -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.block.Unassign -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.denied.Add -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.denied.List -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.denied.Remove -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.mic.Assign -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.mic.Assigned -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.mic.Attach -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.mic.Attached -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.mic.Available -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.mic.Detach -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.mic.Set.assignment -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.mic.Unassign -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.pci.Assign -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.pci.Assigned -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.pci.Attach -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.pci.Attached -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.pci.Available -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.pci.Detach -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.pci.Set.assignment -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.pci.Unassign -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.usb.Assign -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.usb.Assigned -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.usb.Attach -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.usb.Attached -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.usb.Available -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.usb.Detach -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.usb.Set.assignment -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.device.usb.Unassign -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.feature.CheckWithAdminVM -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.feature.CheckWithNetvm -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.feature.CheckWithTemplate -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.feature.CheckWithTemplateAndAdminVM -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.feature.Get -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.feature.List -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.feature.Remove -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.feature.Set -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.firewall.Flush -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.firewall.Get -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.firewall.GetPolicy -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.firewall.Reload -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.firewall.Set -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.firewall.SetPolicy -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.Kill -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.List -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.notes.Get -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.notes.Set -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.Pause -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.property.Get -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.property.GetAll -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.property.GetDefault -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.property.Help -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.property.HelpRst -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.property.List -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.property.Reset -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.property.Set -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.Remove -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.Shutdown -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.Start -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.Stats -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.tag.Get -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.tag.List -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.tag.Remove -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.tag.Set -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.Unpause -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.volume.Clear -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.volume.CloneFrom -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.volume.CloneTo -> ../../var/run/qubesd.sock
|
||
-rwxr-xr-x 1 root root 3543 Nov 8 2025 admin.vm.volume.Import
|
||
lrwxrwxrwx 1 root root 22 Nov 8 2025 admin.vm.volume.ImportWithSize -> admin.vm.volume.Import
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.volume.Info -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.volume.List -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.volume.ListSnapshots -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.volume.Resize -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.volume.Revert -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.volume.Set.ephemeral -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.volume.Set.revisions_to_keep -> ../../var/run/qubesd.sock
|
||
lrwxrwxrwx 1 root root 25 Nov 8 2025 admin.vm.volume.Set.rw -> ../../var/run/qubesd.sock
|
||
drwxrwsr-x 3 root qubes 4096 Aug 20 14:20 policy
|
||
lrwxrwxrwx 1 root root 32 Aug 30 2025 policy.Ask -> /var/run/qubes/policy-agent.sock
|
||
srw-rw---- 1 root qubes 0 Aug 16 17:10 policy.EvalGUI
|
||
srw-rw---- 1 root qubes 0 Aug 16 17:10 policy.EvalSimple
|
||
lrwxrwxrwx 1 root root 27 Aug 30 2025 policy.Get -> /usr/bin/qubes-policy-admin
|
||
lrwxrwxrwx 1 root root 27 Aug 30 2025 policy.GetFiles -> /usr/bin/qubes-policy-admin
|
||
lrwxrwxrwx 1 root root 27 Aug 30 2025 policy.include.Get -> /usr/bin/qubes-policy-admin
|
||
lrwxrwxrwx 1 root root 27 Aug 30 2025 policy.include.List -> /usr/bin/qubes-policy-admin
|
||
lrwxrwxrwx 1 root root 27 Aug 30 2025 policy.include.Remove -> /usr/bin/qubes-policy-admin
|
||
lrwxrwxrwx 1 root root 27 Aug 30 2025 policy.include.Replace -> /usr/bin/qubes-policy-admin
|
||
lrwxrwxrwx 1 root root 27 Aug 30 2025 policy.List -> /usr/bin/qubes-policy-admin
|
||
lrwxrwxrwx 1 root root 32 Aug 30 2025 policy.Notify -> /var/run/qubes/policy-agent.sock
|
||
-rwxr-xr-x 1 root root 5217 Aug 30 2025 policy.RegisterArgument
|
||
lrwxrwxrwx 1 root root 27 Aug 30 2025 policy.Remove -> /usr/bin/qubes-policy-admin
|
||
lrwxrwxrwx 1 root root 27 Aug 30 2025 policy.Replace -> /usr/bin/qubes-policy-admin
|
||
-rwxr-xr-x 1 root root 234 Nov 8 2025 qubes.ConnectTCP
|
||
-rwxr-xr-x 1 root root 162 Nov 8 2025 qubes.FeaturesRequest
|
||
-rwxr-xr-x 1 root root 1780 Nov 8 2025 qubes.GetDate
|
||
-rwxr-xr-x 1 root root 2165 Nov 8 2025 qubes.GetRandomizedTime
|
||
-rwxr-xr-x 1 root root 63 Nov 12 2025 qubes.InputKeyboard
|
||
-rwxr-xr-x 1 root root 52 Nov 12 2025 qubes.InputMouse
|
||
-rwxr-xr-x 1 root root 61 Nov 12 2025 qubes.InputTablet
|
||
lrwxrwxrwx 1 root root 45 Dec 2 2025 qubes.Notifications -> ../../usr/bin/qubes-notification-proxy-server
|
||
-rwxr-xr-x 1 root root 158 Nov 8 2025 qubes.NotifyTools
|
||
-rwxr-xr-x 1 root root 157 Nov 8 2025 qubes.NotifyUpdates
|
||
lrwxrwxrwx 1 root root 45 Nov 4 2025 qubes.ReceiveUpdates -> ../../usr/libexec/qubes/qubes-receive-updates
|
||
-rwxr-xr-x 1 root root 377 Oct 9 2025 qubes.RemoveAppMenusFor
|
||
lrwxrwxrwx 1 root root 49 Nov 4 2025 qubes.repos.Disable -> ../../usr/lib/qubes/qubes-rpc/qubes.repos.Disable
|
||
lrwxrwxrwx 1 root root 48 Nov 4 2025 qubes.repos.Enable -> ../../usr/lib/qubes/qubes-rpc/qubes.repos.Enable
|
||
lrwxrwxrwx 1 root root 46 Nov 4 2025 qubes.repos.List -> ../../usr/lib/qubes/qubes-rpc/qubes.repos.List
|
||
-rwxr-xr-x 1 root root 258 Oct 9 2025 qubes.SyncAppMenus
|
||
-rwxr-xr-x 1 root root 393 Oct 9 2025 qubes.UpdateAppMenusFor
|
||
-rwxr-xr-x 1 root root 921 Aug 30 2025 qubes.WaitForSession
|
||
lrwxrwxrwx 1 root root 33 Oct 19 2025 qubes.WindowIconUpdater -> /var/run/qubes/icon-receiver.sock
|
||
|
||
===== 4. Policy file ownership/permissions =====
|
||
|
||
$ find /etc/qubes/policy.d /etc/qubes-rpc/policy /usr/share/qubes/policy.d -maxdepth 1 -type f -printf "%M %u:%g %s %p\n" 2>/dev/null | sort
|
||
-rw-r--r-- root:qubes 12 /etc/qubes-rpc/policy/qubes.SignerRpc
|
||
-rw-r--r-- root:root 129 /etc/qubes/policy.d/50-config-updates.policy
|
||
-rw-r--r-- root:root 150 /etc/qubes/policy.d/50-config-input.policy
|
||
-rw-r--r-- root:root 284 /etc/qubes/policy.d/45-signer.policy
|
||
-rw-r--r-- root:root 3 /etc/qubes/policy.d/50-config-clipboard.policy
|
||
-rw-r--r-- root:root 563 /etc/qubes/policy.d/90-default-gui-daemon.policy
|
||
-rw-rw-r-- root:qubes 2261 /etc/qubes/policy.d/85-admin-backup-restore.policy
|
||
-rw-rw-r-- root:qubes 227 /etc/qubes/policy.d/90-default-linux.policy
|
||
-rw-rw-r-- root:qubes 227 /etc/qubes/policy.d/90-default-pdf-convert.policy
|
||
-rw-rw-r-- root:qubes 2961 /etc/qubes/policy.d/80-whonix.policy
|
||
-rw-rw-r-- root:qubes 6690 /etc/qubes/policy.d/90-default.policy
|
||
-rw-rw-r-- root:qubes 9075 /etc/qubes/policy.d/90-admin-default.policy
|
||
-rw-rw-r-- root:root 1197 /etc/qubes/policy.d/90-admin-policy-default.policy
|
||
-rw-rw-r-- root:root 185 /etc/qubes/policy.d/README
|
||
-rw-rw-r-- root:root 674 /etc/qubes/policy.d/35-compat.policy
|
||
|
||
===== 5. Symlinks in policy dirs =====
|
||
|
||
$ find /etc/qubes/policy.d /etc/qubes-rpc /etc/qubes-rpc/policy -maxdepth 2 -type l -printf "%p -> %l\n" 2>/dev/null
|
||
/etc/qubes-rpc/admin.vm.device.usb.Available -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.volume.Set.ephemeral -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.mic.Attach -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/policy.List -> /usr/bin/qubes-policy-admin
|
||
/etc/qubes-rpc/admin.vm.device.mic.Unassign -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.property.Help -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.label.List -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/policy.Notify -> /var/run/qubes/policy-agent.sock
|
||
/etc/qubes-rpc/policy.include.List -> /usr/bin/qubes-policy-admin
|
||
/etc/qubes-rpc/admin.vm.CreateInPool.DispVM -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.pool.volume.Set.rw -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.pool.volume.List -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.backup.Execute -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.property.List -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.pci.Unassign -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.Start -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.label.Get -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.pci.Attached -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.CurrentState -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.pool.volume.Set.revisions_to_keep -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/qubes.repos.Enable -> ../../usr/lib/qubes/qubes-rpc/qubes.repos.Enable
|
||
/etc/qubes-rpc/qubes.repos.Disable -> ../../usr/lib/qubes/qubes-rpc/qubes.repos.Disable
|
||
/etc/qubes-rpc/admin.property.List -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.label.Create -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.usb.Unassign -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.volume.Info -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.firewall.GetPolicy -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.volume.ImportWithSize -> admin.vm.volume.Import
|
||
/etc/qubes-rpc/admin.vm.feature.CheckWithNetvm -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.Create.StandaloneVM -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.block.Assign -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.volume.Clear -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.usb.Set.assignment -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.block.Available -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.Remove -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.usb.Assign -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.Create.DispVM -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.property.Reset -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.CreateInPool.StandaloneVM -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.pool.Set.revisions_to_keep -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.Pause -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.firewall.SetPolicy -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.volume.List -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.CreateInPool.AppVM -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.notes.Get -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.volume.Resize -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/policy.GetFiles -> /usr/bin/qubes-policy-admin
|
||
/etc/qubes-rpc/qubes.ReceiveUpdates -> ../../usr/libexec/qubes/qubes-receive-updates
|
||
/etc/qubes-rpc/admin.pool.volume.Info -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.pci.Assign -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.property.GetDefault -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.pool.volume.Resize -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.pool.Info -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.Kill -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.property.HelpRst -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/policy.include.Remove -> /usr/bin/qubes-policy-admin
|
||
/etc/qubes-rpc/admin.property.HelpRst -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.tag.Get -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.feature.Get -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.property.Set -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.property.GetDefault -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.tag.Set -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.usb.Detach -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.mic.Detach -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.backup.Cancel -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/policy.include.Get -> /usr/bin/qubes-policy-admin
|
||
/etc/qubes-rpc/admin.vm.volume.Set.rw -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.volume.Set.revisions_to_keep -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.property.Set -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.CreateInPool.TemplateVM -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.property.Get -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/policy.Ask -> /var/run/qubes/policy-agent.sock
|
||
/etc/qubes-rpc/admin.vm.Shutdown -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/policy.Remove -> /usr/bin/qubes-policy-admin
|
||
/etc/qubes-rpc/admin.pool.Remove -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.property.GetAll -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.property.GetAll -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.Stats -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.pool.volume.ListSnapshots -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.mic.Assign -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.notes.Set -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.pci.Attach -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.firewall.Set -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.usb.Attach -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/qubes.WindowIconUpdater -> /var/run/qubes/icon-receiver.sock
|
||
/etc/qubes-rpc/admin.vm.feature.Remove -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.usb.Assigned -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/qubes.repos.List -> ../../usr/lib/qubes/qubes-rpc/qubes.repos.List
|
||
/etc/qubes-rpc/admin.vm.firewall.Get -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.feature.CheckWithTemplateAndAdminVM -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.pool.ListDrivers -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/policy.include.Replace -> /usr/bin/qubes-policy-admin
|
||
/etc/qubes-rpc/admin.Events -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.mic.Set.assignment -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.pool.volume.Set.ephemeral -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/qubes.Notifications -> ../../usr/bin/qubes-notification-proxy-server
|
||
/etc/qubes-rpc/admin.vm.device.mic.Attached -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.backup.Info -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.volume.CloneFrom -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.List -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.volume.CloneTo -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.pool.Add -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.pool.List -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.denied.Remove -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.volume.Revert -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.feature.List -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.pool.Set.ephemeral_volatile -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.property.Reset -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.block.Attach -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.tag.Remove -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.feature.Set -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.mic.Assigned -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.block.Set.assignment -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.mic.Available -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vmclass.List -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.pool.volume.Snapshot -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.pci.Assigned -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.label.Index -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.denied.List -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.deviceclass.List -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.CreateDisposable -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.pool.volume.Revert -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.denied.Add -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.feature.CheckWithTemplate -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.tag.List -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.Unpause -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.feature.CheckWithAdminVM -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.block.Detach -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.block.Unassign -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.property.Get -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.firewall.Reload -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.block.Assigned -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.pci.Available -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.usb.Attached -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/policy.Get -> /usr/bin/qubes-policy-admin
|
||
/etc/qubes-rpc/admin.property.Help -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.label.Remove -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.pci.Detach -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.Create.AppVM -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/policy.Replace -> /usr/bin/qubes-policy-admin
|
||
/etc/qubes-rpc/admin.pool.UsageDetails -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.block.Attached -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.firewall.Flush -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.Create.TemplateVM -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.volume.ListSnapshots -> ../../var/run/qubesd.sock
|
||
/etc/qubes-rpc/admin.vm.device.pci.Set.assignment -> ../../var/run/qubesd.sock
|
||
|
||
===== 6. Search for SignerRpc / nsigner / signer policy files =====
|
||
|
||
$ find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -iname "*signer*" -print 2>/dev/null | grep -vi "^/home" | head -50
|
||
/var/log/qubes/qubesdb.n_signer.log
|
||
/var/log/qubes/qrexec.n_signer.log
|
||
/var/log/qubes/qubesdb.nostr_signer.log
|
||
/var/log/qubes/update-nostr_signer.log
|
||
/var/log/qubes/guid.n_signer.log
|
||
/var/log/qubes/guid.nostr_signer.log
|
||
/var/log/qubes/qrexec.nostr_signer.log
|
||
/var/log/qubes/guid.nostr_signer.log.old
|
||
/var/log/libvirt/libxl/n_signer.log
|
||
/var/log/libvirt/libxl/nostr_signer.log
|
||
/var/log/xen/console/guest-nostr_signer.log
|
||
/var/log/xen/console/guest-n_signer.log-20260510.gz
|
||
/var/log/xen/console/guest-nostr_signer.log-20260816.gz
|
||
/var/log/xen/console/guest-nostr_signer.log-20260809.gz
|
||
/var/log/xen/console/guest-n_signer.log
|
||
/var/log/xen/console/guest-nostr_signer.log-20260726.gz
|
||
/var/log/xen/console/guest-nostr_signer.log-20260802.gz
|
||
/var/lib/qubes/appvms/nostr_signer
|
||
/usr/lib64/python3.13/site-packages/PyQt6/QtDesigner.pyi
|
||
/usr/lib64/python3.13/site-packages/PyQt6/lupdate/designer_source.py
|
||
/usr/lib64/python3.13/site-packages/PyQt6/lupdate/__pycache__/designer_source.cpython-313.pyc
|
||
/usr/lib64/python3.13/site-packages/PyQt6/lupdate/__pycache__/designer_source.cpython-313.opt-1.pyc
|
||
/usr/lib64/python3.13/site-packages/PyQt6/QtDesigner.abi3.so
|
||
/usr/lib64/cmake/Qt6Designer
|
||
/usr/lib64/libQt6Designer.so.6.8.3
|
||
/usr/lib64/qt6/plugins/designer
|
||
/usr/lib64/qt6/qml/QtQuick3D/AssetUtils/designer
|
||
/usr/lib64/qt6/qml/QtQuick3D/ParticleEffects/designer
|
||
/usr/lib64/qt6/qml/QtQuick3D/Effects/designer
|
||
/usr/lib64/qt6/qml/QtQuick3D/Helpers/designer
|
||
/usr/lib64/qt6/qml/QtQuick3D/Particles3D/designer
|
||
/usr/lib64/qt6/qml/QtQuick3D/designer
|
||
/usr/lib64/qt6/qml/QtQuick/Controls/designer
|
||
/usr/lib64/libQt6Designer.so.6
|
||
/usr/share/mime/application/x-designer.xml
|
||
/usr/share/icons/Mint-X/mimetypes/24/application-x-designer.png
|
||
/usr/share/icons/Mint-X/mimetypes/24/gnome-mime-application-x-designer.png
|
||
/usr/share/icons/Mint-X/mimetypes/16/application-x-designer.png
|
||
/usr/share/icons/Mint-X/mimetypes/16/gnome-mime-application-x-designer.png
|
||
/usr/share/icons/Mint-X/mimetypes/32/application-x-designer.png
|
||
/usr/share/icons/Mint-X/mimetypes/32/gnome-mime-application-x-designer.png
|
||
/usr/share/icons/Mint-X/mimetypes/48/application-x-designer.png
|
||
/usr/share/icons/Mint-X/mimetypes/48/gnome-mime-application-x-designer.png
|
||
/usr/share/icons/Mint-X/mimetypes/96/application-x-designer.svg
|
||
/usr/share/icons/Mint-X/mimetypes/96/gnome-mime-application-x-designer.svg
|
||
/usr/share/icons/Mint-X/mimetypes/22/application-x-designer.png
|
||
/usr/share/icons/Mint-X/mimetypes/22/gnome-mime-application-x-designer.png
|
||
/usr/share/icons/Mint-X/apps/24/qtdesigner.png
|
||
/usr/share/icons/Mint-X/apps/24/designer.png
|
||
/usr/share/icons/Mint-X/apps/16/qtdesigner.png
|
||
|
||
$ grep -RIl "SignerRpc\|NsignerRpc\|nsigner" /etc/qubes /usr/share/qubes 2>/dev/null | head -30
|
||
/etc/qubes/policy.d/45-signer.policy
|
||
|
||
===== 7. Policy contents (signer-related) =====
|
||
|
||
$ for f in $(grep -RIl "SignerRpc\|NsignerRpc\|nsigner\|signer" /etc/qubes/policy.d /etc/qubes-rpc/policy /usr/share/qubes/policy.d 2>/dev/null); do echo "--- $f ---"; cat "$f"; echo; done
|
||
--- /etc/qubes/policy.d/45-signer.policy ---
|
||
# Qubes OS qrexec policy for signer
|
||
qubes.SignerRpc * ai @tag:signer-signer allow target=nostr_signer
|
||
qubes.SignerRpc * nostr @tag:signer-signer allow target=nostr_signer
|
||
qubes.SignerRpc * @anyvm @tag:signer-signer ask default_target=nostr_signer
|
||
qubes.SignerRpc * @anyvm @anyvm deny
|
||
|
||
|
||
===== 8. Clipboard policy contents =====
|
||
|
||
$ for f in $(grep -RIl "ClipboardPaste" /etc/qubes/policy.d /etc/qubes-rpc/policy /usr/share/qubes/policy.d 2>/dev/null); do echo "--- $f ---"; cat "$f"; echo; done
|
||
--- /etc/qubes/policy.d/90-default-gui-daemon.policy ---
|
||
## Note that policy parsing stops at the first match,
|
||
## so adding anything below "@anyvm @anyvm action" line will have no effect
|
||
##
|
||
## Clipboard paste (Ctrl-Shift-V) will treat "ask" as "allow" but only when
|
||
## called by this keyboard shortcut. "deny" always denies the operation.
|
||
|
||
## Please use a single # to start your custom comments
|
||
|
||
qubes.ClipboardPaste * @adminvm @anyvm ask
|
||
qubes.ClipboardPaste * @anyvm @anyvm ask
|
||
|
||
# The default policy handles only GUI in dom0. GUIVM needs similar line in its
|
||
# policy too.
|
||
qubes.WindowIconUpdater * @anyvm dom0 allow
|
||
|
||
|
||
===== 9. Full policy.d listing with contents (all files) =====
|
||
|
||
$ for f in /etc/qubes/policy.d/*; do echo "--- $f ---"; cat "$f" 2>/dev/null; echo; done
|
||
--- /etc/qubes/policy.d/35-compat.policy ---
|
||
#
|
||
# NOTE:
|
||
#
|
||
# The following line enables compatibility mode. It reads files in old directory
|
||
# (/etc/qubes-rpc/policy). It also generates deny rules that were previously
|
||
# implicit after each file, but they are added only after policies for specific
|
||
# arguments, that is, for files with '+' in the name. For generic files, without
|
||
# '+', no such rules are generated and the control "falls through", which is
|
||
# a departure from previous semantics. It is done that way not to shadow the
|
||
# default rules.
|
||
#
|
||
# The "!compat-4.0" directive is transitional only and will be unavailable in
|
||
# next major release (R5.0). This file will be removed in that release also.
|
||
#
|
||
|
||
!compat-4.0
|
||
|
||
--- /etc/qubes/policy.d/45-signer.policy ---
|
||
# Qubes OS qrexec policy for signer
|
||
qubes.SignerRpc * ai @tag:signer-signer allow target=nostr_signer
|
||
qubes.SignerRpc * nostr @tag:signer-signer allow target=nostr_signer
|
||
qubes.SignerRpc * @anyvm @tag:signer-signer ask default_target=nostr_signer
|
||
qubes.SignerRpc * @anyvm @anyvm deny
|
||
|
||
--- /etc/qubes/policy.d/50-config-clipboard.policy ---
|
||
#
|
||
|
||
|
||
--- /etc/qubes/policy.d/50-config-input.policy ---
|
||
qubes.InputMouse * sys-usb dom0 allow
|
||
qubes.InputKeyboard * sys-usb dom0 allow
|
||
# not configurable by this state
|
||
qubes.InputTablet * sys-usb dom0 deny
|
||
|
||
--- /etc/qubes/policy.d/50-config-updates.policy ---
|
||
qubes.UpdatesProxy * @tag:whonix-updatevm @default allow target=sys-whonix
|
||
qubes.UpdatesProxy * @tag:whonix-updatevm @anyvm deny
|
||
|
||
--- /etc/qubes/policy.d/80-whonix.policy ---
|
||
## Do not modify this file, create a new policy file with a lower number in the
|
||
## filename instead. For example `30-user.policy`.
|
||
|
||
# service arg source target action params
|
||
|
||
sdwdate-gui.Connect * @tag:sdwdate-gui-client @tag:sdwdate-gui-server allow autostart=no notify=no
|
||
sdwdate-gui.ConnectCheck * @tag:sdwdate-gui-client @tag:sdwdate-gui-server allow autostart=no notify=no
|
||
|
||
sdwdate-gui.Connect * @anyvm @anyvm deny
|
||
sdwdate-gui.ConnectCheck * @anyvm @anyvm deny
|
||
|
||
# Legacy, all of these services should effectively be no-ops for fully updated
|
||
# Whonix-Gateway and Whonix-Workstation qubes.
|
||
sdwdate.Connect * @tag:sdwdate-gui-client @tag:sdwdate-gui-server allow autostart=no notify=no
|
||
sdwdate.ConnectCheck * @tag:sdwdate-gui-client @tag:sdwdate-gui-server allow autostart=no notify=no
|
||
|
||
sdwdate.Connect * @anyvm @anyvm deny
|
||
sdwdate.ConnectCheck * @anyvm @anyvm deny
|
||
|
||
whonix.SdwdateStatus + @tag:anon-gateway @tag:anon-vm allow autostart=no notify=no
|
||
whonix.SdwdateStatus + @tag:anon-gateway @default deny notify=no
|
||
whonix.SdwdateStatus + @anyvm @anyvm deny
|
||
|
||
whonix.NewStatus * @tag:anon-vm @tag:anon-gateway allow autostart=no
|
||
whonix.NewStatus * @anyvm @anyvm deny
|
||
|
||
whonix.GatewayCommand +restart @tag:anon-gateway @tag:anon-vm allow autostart=no
|
||
whonix.GatewayCommand +stop @tag:anon-gateway @tag:anon-vm allow autostart=no
|
||
whonix.GatewayCommand +showlog @tag:anon-gateway @tag:anon-vm allow autostart=no
|
||
whonix.GatewayCommand * @anyvm @anyvm deny
|
||
|
||
# Harden against potential IP leaks by not allowing a compromised
|
||
# Whonix-Workstation to open files, URLs, or applications in VMs other than
|
||
# Whonix-Workstation VMs (typically DispVMs).
|
||
qubes.OpenInVM * @tag:anon-vm @dispvm ask default_target=@dispvm
|
||
qubes.OpenInVM * @tag:anon-vm @tag:anon-vm ask
|
||
qubes.OpenInVM * @tag:anon-vm @default ask
|
||
qubes.OpenInVM * @tag:anon-vm @anyvm deny
|
||
|
||
qubes.OpenURL * @tag:anon-vm @dispvm ask default_target=@dispvm
|
||
qubes.OpenURL * @tag:anon-vm @tag:anon-vm ask
|
||
qubes.OpenURL * @tag:anon-vm @default ask
|
||
qubes.OpenURL * @tag:anon-vm @anyvm deny
|
||
|
||
qubes.StartApp * @tag:anon-vm @dispvm ask default_target=@dispvm
|
||
qubes.StartApp * @tag:anon-vm @tag:anon-vm ask
|
||
qubes.StartApp * @tag:anon-vm @default ask
|
||
qubes.StartApp * @tag:anon-vm @anyvm deny
|
||
|
||
--- /etc/qubes/policy.d/85-admin-backup-restore.policy ---
|
||
## File format:
|
||
## service-name|* +argument|* source destination action [options]
|
||
|
||
## Allow selected DisposableVM perform "paranoid backup restore"
|
||
admin.vm.Create.AppVM * @tag:backup-restore-mgmt dom0 allow target=dom0
|
||
admin.vm.Create.StandaloneVM * @tag:backup-restore-mgmt dom0 allow target=dom0
|
||
admin.vm.Create.TemplateVM * @tag:backup-restore-mgmt dom0 allow target=dom0
|
||
admin.vm.List * @tag:backup-restore-mgmt dom0 allow target=dom0
|
||
## Allow checking some basic info about all the VMs, to propose conflicts resolution
|
||
admin.vm.List * @tag:backup-restore-mgmt @anyvm allow target=dom0
|
||
admin.vm.property.Get +provides_network @tag:backup-restore-mgmt @anyvm allow target=dom0
|
||
admin.vm.property.Get +template_for_dispvms @tag:backup-restore-mgmt @anyvm allow target=dom0
|
||
|
||
## Allow it to configure just created qubes
|
||
admin.vm.feature.Set * @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0
|
||
admin.vm.firewall.Set * @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0
|
||
admin.vm.property.Set * @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0
|
||
admin.vm.tag.Set * @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0
|
||
admin.vm.volume.Import * @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0
|
||
admin.vm.volume.ImportWithSize * @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0
|
||
admin.vm.volume.Info * @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0
|
||
admin.vm.volume.List * @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0
|
||
admin.vm.volume.Set.revisions_to_keep * @tag:backup-restore-mgmt @tag:backup-restore-in-progress allow target=dom0
|
||
|
||
## And finally, allow it to retrieve the actual backup
|
||
qubes.RestoreById * @tag:backup-restore-mgmt @tag:backup-restore-storage allow
|
||
|
||
|
||
--- /etc/qubes/policy.d/90-admin-default.policy ---
|
||
## Do not modify this file, create a new policy file with a lower number in the
|
||
## filename instead. For example `30-admin-user.policy`.
|
||
|
||
###
|
||
### Default Admin API qrexec policy
|
||
###
|
||
|
||
## WARNING: most qrexec services here allows a qube to control system
|
||
## configuration. It should be allowed only to trusted qubes.
|
||
|
||
## Remember to add "target=dom0" option to any (allow/ask) entry you create.
|
||
|
||
## For convenience of maintaining this policy, all services include one of:
|
||
## - include/admin-local-rwx (services to modify a specific qube configuration)
|
||
## - include/admin-local-ro (services to read a specific qube configuration)
|
||
## - include/admin-global-rwx (services to modify global parameters)
|
||
## - include/admin-global-ro (services to read global parameters)
|
||
|
||
!include-service admin.vm.Console * include/admin-local-rwx
|
||
!include-service admin.vm.volume.Import * include/admin-local-rwx
|
||
!include-service admin.vm.volume.ImportWithSize * include/admin-local-rwx
|
||
|
||
!include-service admin.vm.device.mic.Assign * include/admin-local-rwx
|
||
!include-service admin.vm.device.mic.Assigned * include/admin-local-ro
|
||
!include-service admin.vm.device.mic.Attach * include/admin-local-rwx
|
||
!include-service admin.vm.device.mic.Attached * include/admin-local-ro
|
||
!include-service admin.vm.device.mic.Available * include/admin-local-ro
|
||
!include-service admin.vm.device.mic.Detach * include/admin-local-rwx
|
||
!include-service admin.vm.device.mic.Set.assignment * include/admin-local-rwx
|
||
!include-service admin.vm.device.mic.Unassign * include/admin-local-rwx
|
||
!include-service admin.vm.device.usb.Assign * include/admin-local-rwx
|
||
!include-service admin.vm.device.usb.Assigned * include/admin-local-ro
|
||
!include-service admin.vm.device.usb.Attach * include/admin-local-rwx
|
||
!include-service admin.vm.device.usb.Attached * include/admin-local-ro
|
||
!include-service admin.vm.device.usb.Available * include/admin-local-ro
|
||
!include-service admin.vm.device.usb.Detach * include/admin-local-rwx
|
||
!include-service admin.vm.device.usb.Set.assignment * include/admin-local-rwx
|
||
!include-service admin.vm.device.usb.Unassign * include/admin-local-rwx
|
||
|
||
!include-service admin.backup.Cancel * include/admin-global-rwx
|
||
!include-service admin.backup.Execute * include/admin-global-rwx
|
||
!include-service admin.backup.Info * include/admin-local-ro
|
||
!include-service admin.vm.CreateDisposable * include/admin-global-rwx
|
||
!include-service admin.deviceclass.List * include/admin-global-ro
|
||
!include-service admin.Events * include/admin-global-ro
|
||
!include-service admin.label.Create * include/admin-global-rwx
|
||
!include-service admin.label.Get * include/admin-global-ro
|
||
!include-service admin.label.Index * include/admin-global-ro
|
||
!include-service admin.label.List * include/admin-global-ro
|
||
!include-service admin.label.Remove * include/admin-global-rwx
|
||
!include-service admin.pool.Add * include/admin-global-rwx
|
||
!include-service admin.pool.Info * include/admin-global-ro
|
||
!include-service admin.pool.List * include/admin-global-ro
|
||
!include-service admin.pool.ListDrivers * include/admin-global-ro
|
||
!include-service admin.pool.Remove * include/admin-global-rwx
|
||
!include-service admin.pool.Set.ephemeral_volatile * include/admin-global-rwx
|
||
!include-service admin.pool.Set.revisions_to_keep * include/admin-global-rwx
|
||
!include-service admin.pool.UsageDetails * include/admin-global-ro
|
||
!include-service admin.pool.volume.List * include/admin-global-ro
|
||
!include-service admin.property.Get * include/admin-global-ro
|
||
!include-service admin.property.GetAll * include/admin-global-ro
|
||
!include-service admin.property.GetDefault * include/admin-global-ro
|
||
!include-service admin.property.Help * include/admin-global-ro
|
||
!include-service admin.property.List * include/admin-global-ro
|
||
!include-service admin.property.Reset * include/admin-global-rwx
|
||
!include-service admin.property.Set * include/admin-global-rwx
|
||
!include-service admin.vm.Console * include/admin-local-rwx
|
||
!include-service admin.vm.Create.AppVM * include/admin-global-rwx
|
||
!include-service admin.vm.Create.DispVM * include/admin-global-rwx
|
||
!include-service admin.vm.Create.RemoteVM * include/admin-global-rwx
|
||
!include-service admin.vm.Create.StandaloneVM * include/admin-global-rwx
|
||
!include-service admin.vm.Create.TemplateVM * include/admin-global-rwx
|
||
!include-service admin.vm.CreateInPool.AppVM * include/admin-global-rwx
|
||
!include-service admin.vm.CreateInPool.DispVM * include/admin-global-rwx
|
||
!include-service admin.vm.CreateInPool.RemoteVM * include/admin-global-rwx
|
||
!include-service admin.vm.CreateInPool.StandaloneVM * include/admin-global-rwx
|
||
!include-service admin.vm.CreateInPool.TemplateVM * include/admin-global-rwx
|
||
!include-service admin.vm.CurrentState * include/admin-local-ro
|
||
!include-service admin.vm.device.block.Assign * include/admin-local-rwx
|
||
!include-service admin.vm.device.pci.Assign * include/admin-local-rwx
|
||
!include-service admin.vm.device.block.Attach * include/admin-local-rwx
|
||
!include-service admin.vm.device.pci.Attach * include/admin-local-rwx
|
||
!include-service admin.vm.device.block.Attached * include/admin-local-ro
|
||
!include-service admin.vm.device.pci.Attached * include/admin-local-ro
|
||
!include-service admin.vm.device.block.Available * include/admin-local-ro
|
||
!include-service admin.vm.device.pci.Available * include/admin-local-ro
|
||
!include-service admin.vm.device.denied.Add * include/admin-local-rwx
|
||
!include-service admin.vm.device.denied.List * include/admin-local-ro
|
||
!include-service admin.vm.device.denied.Remove * include/admin-local-rwx
|
||
!include-service admin.vm.device.block.Detach * include/admin-local-rwx
|
||
!include-service admin.vm.device.pci.Detach * include/admin-local-rwx
|
||
!include-service admin.vm.device.block.Assigned * include/admin-local-ro
|
||
!include-service admin.vm.device.pci.Assigned * include/admin-local-ro
|
||
!include-service admin.vm.device.block.Set.assignment * include/admin-local-rwx
|
||
!include-service admin.vm.device.pci.Set.assignment * include/admin-local-rwx
|
||
!include-service admin.vm.device.block.Unassign * include/admin-local-rwx
|
||
!include-service admin.vm.device.pci.Unassign * include/admin-local-rwx
|
||
!include-service admin.vm.feature.CheckWithAdminVM * include/admin-local-ro
|
||
!include-service admin.vm.feature.CheckWithNetvm * include/admin-local-ro
|
||
!include-service admin.vm.feature.CheckWithTemplate * include/admin-local-ro
|
||
!include-service admin.vm.feature.CheckWithTemplateAndAdminVM * include/admin-local-ro
|
||
!include-service admin.vm.feature.Get * include/admin-local-ro
|
||
!include-service admin.vm.feature.List * include/admin-local-ro
|
||
!include-service admin.vm.feature.Remove * include/admin-local-rwx
|
||
!include-service admin.vm.feature.Set * include/admin-local-rwx
|
||
!include-service admin.vm.firewall.Get * include/admin-local-ro
|
||
!include-service admin.vm.firewall.Reload * include/admin-local-rwx
|
||
!include-service admin.vm.firewall.Set * include/admin-local-rwx
|
||
!include-service admin.vm.Kill * include/admin-local-rwx
|
||
!include-service admin.vm.List * include/admin-global-ro
|
||
!include-service admin.vm.notes.Get * include/admin-local-ro
|
||
!include-service admin.vm.notes.Set * include/admin-local-rwx
|
||
!include-service admin.vm.Pause * include/admin-local-rwx
|
||
!include-service admin.vm.property.Get * include/admin-local-ro
|
||
!include-service admin.vm.property.GetAll * include/admin-local-ro
|
||
!include-service admin.vm.property.GetDefault * include/admin-local-ro
|
||
!include-service admin.vm.property.Help * include/admin-local-ro
|
||
!include-service admin.vm.property.List * include/admin-local-ro
|
||
!include-service admin.vm.property.Reset * include/admin-local-rwx
|
||
!include-service admin.vm.property.Set * include/admin-local-rwx
|
||
!include-service admin.vm.Remove * include/admin-global-rwx
|
||
!include-service admin.vm.Resume * include/admin-local-rwx
|
||
!include-service admin.vm.Shutdown * include/admin-local-rwx
|
||
!include-service admin.vm.Start * include/admin-local-rwx
|
||
!include-service admin.vm.Stats * include/admin-global-ro
|
||
!include-service admin.vm.Suspend * include/admin-local-rwx
|
||
!include-service admin.vm.tag.Get * include/admin-local-ro
|
||
!include-service admin.vm.tag.List * include/admin-local-ro
|
||
!include-service admin.vm.tag.Remove * include/admin-local-rwx
|
||
!include-service admin.vm.tag.Set * include/admin-local-rwx
|
||
!include-service admin.vm.Unpause * include/admin-local-rwx
|
||
!include-service admin.vm.volume.Clear * include/admin-local-rwx
|
||
!include-service admin.vm.volume.CloneFrom * include/admin-local-rwx
|
||
!include-service admin.vm.volume.CloneTo * include/admin-local-rwx
|
||
!include-service admin.vm.volume.Info * include/admin-local-ro
|
||
!include-service admin.vm.volume.List * include/admin-local-ro
|
||
!include-service admin.vm.volume.ListSnapshots * include/admin-local-ro
|
||
!include-service admin.vm.volume.Resize * include/admin-local-rwx
|
||
!include-service admin.vm.volume.Revert * include/admin-local-rwx
|
||
!include-service admin.vm.volume.Set.ephemeral * include/admin-local-rwx
|
||
!include-service admin.vm.volume.Set.revisions_to_keep * include/admin-local-rwx
|
||
!include-service admin.vm.volume.Set.rw * include/admin-local-rwx
|
||
!include-service admin.vmclass.List * include/admin-global-ro
|
||
|
||
--- /etc/qubes/policy.d/90-admin-policy-default.policy ---
|
||
## Do not modify this file, create a new policy file with a lower number in the
|
||
## filename instead. For example `30-admin-policy.policy`.
|
||
|
||
###
|
||
### Policy Admin API qrexec policy
|
||
###
|
||
|
||
## WARNING: the services here allow viewing and changing the Qubes RPC policy,
|
||
## which effectively gives the caller full control over the system. You should
|
||
## allow them only to trusted qubes.
|
||
|
||
## For convenience of maintaining this policy, all services include one of:
|
||
## - include/admin-policy-rwx (services to modify the policy)
|
||
## - include/admin-policy-ro (services to read the policy)
|
||
|
||
!include-service policy.List * include/admin-policy-ro
|
||
!include-service policy.include.List * include/admin-policy-ro
|
||
!include-service policy.Get * include/admin-policy-ro
|
||
!include-service policy.include.Get * include/admin-policy-ro
|
||
!include-service policy.GetFiles * include/admin-policy-ro
|
||
|
||
!include-service policy.Replace * include/admin-policy-rwx
|
||
!include-service policy.include.Replace * include/admin-policy-rwx
|
||
!include-service policy.Remove * include/admin-policy-rwx
|
||
!include-service policy.include.Remove * include/admin-policy-rwx
|
||
|
||
--- /etc/qubes/policy.d/90-default-gui-daemon.policy ---
|
||
## Note that policy parsing stops at the first match,
|
||
## so adding anything below "@anyvm @anyvm action" line will have no effect
|
||
##
|
||
## Clipboard paste (Ctrl-Shift-V) will treat "ask" as "allow" but only when
|
||
## called by this keyboard shortcut. "deny" always denies the operation.
|
||
|
||
## Please use a single # to start your custom comments
|
||
|
||
qubes.ClipboardPaste * @adminvm @anyvm ask
|
||
qubes.ClipboardPaste * @anyvm @anyvm ask
|
||
|
||
# The default policy handles only GUI in dom0. GUIVM needs similar line in its
|
||
# policy too.
|
||
qubes.WindowIconUpdater * @anyvm dom0 allow
|
||
|
||
--- /etc/qubes/policy.d/90-default-linux.policy ---
|
||
# qubes-dom0-update
|
||
qubes.ReceiveUpdates * @anyvm dom0 allow
|
||
|
||
# This used to define policies for:
|
||
# - qubes.repos.List
|
||
# - qubes.repos.Enable
|
||
# - qubes.repos.Disable
|
||
# but since those are "deny" by default anyway, skip them
|
||
|
||
--- /etc/qubes/policy.d/90-default-pdf-convert.policy ---
|
||
## Note that policy parsing stops at the first match,
|
||
## so adding anything below "@anyvm @anyvm action" line will have no effect
|
||
|
||
## Please use a single # to start your custom comments
|
||
|
||
qubes.PdfConvert * @anyvm @dispvm allow
|
||
|
||
--- /etc/qubes/policy.d/90-default.policy ---
|
||
## Do not modify this file, create a new policy file with a lower number in the
|
||
## filename instead. For example `30-user.policy`.
|
||
|
||
###
|
||
### Default qrexec policy
|
||
###
|
||
|
||
## File format:
|
||
## service-name|* +argument|* source destination action [options]
|
||
|
||
## Note that policy parsing stops at the first match.
|
||
|
||
# policy.RegisterArgument should be allowed only for specific arguments.
|
||
policy.RegisterArgument * @anyvm @anyvm deny
|
||
policy.RegisterArgument * @anyvm dom0 deny
|
||
|
||
# WARNING: The qubes.ConnectTCP service is dangerous and allows any
|
||
# qube to access any other qube TCP port. It should be restricted
|
||
# only to restricted qubes. This is why the default policy is 'deny'
|
||
|
||
# Example of policy: qubes.ConnectTCP +22 mytcp-client @default allow target=mytcp-server
|
||
qubes.ConnectTCP * @anyvm @anyvm deny
|
||
|
||
# VM advertise its supported features
|
||
qubes.FeaturesRequest * @anyvm dom0 allow
|
||
|
||
# Windows VM advertise installed Qubes Windows Tools
|
||
qubes.NotifyTools * @anyvm dom0 allow
|
||
|
||
# File copy/move
|
||
qubes.Filecopy * @anyvm @anyvm ask
|
||
|
||
# Get current date/time
|
||
qubes.GetDate * @tag:anon-vm @anyvm deny
|
||
qubes.GetDate * @anyvm @anyvm allow target=dom0
|
||
|
||
# Get slightly randomized date/time
|
||
qubes.GetRandomizedTime * @anyvm dom0 allow
|
||
|
||
# Convert image to a safe format, also, allows to get an image (icon) file from a VM
|
||
qubes.GetImageRGBA * @anyvm @dispvm allow
|
||
qubes.GetImageRGBA * @anyvm @anyvm ask
|
||
|
||
# Notify about available updates
|
||
qubes.NotifyUpdates * @anyvm dom0 allow
|
||
|
||
# Open a file in a VM
|
||
qubes.OpenInVM * @anyvm @dispvm allow
|
||
qubes.OpenInVM * @anyvm @anyvm ask
|
||
|
||
# Open URL in a VM
|
||
qubes.OpenURL * @anyvm @dispvm allow
|
||
qubes.OpenURL * @anyvm @anyvm ask
|
||
|
||
# Start application using its menu entry (only applications with menu entries
|
||
# are allowed, no arbitrary command). Argument is an application name (in case
|
||
# of Linux, basename of .desktop file from /usr/share/applications or similar
|
||
# location).
|
||
qubes.StartApp * @anyvm @dispvm allow
|
||
qubes.StartApp * @anyvm @anyvm ask
|
||
|
||
# Sends list of available applications - relevant for GUI being in dom0;
|
||
# otherwise earlier policy will redirect it
|
||
qubes.SyncAppMenus * @anyvm dom0 allow
|
||
|
||
# notifications - relevant for GUI in dom0, otherwise earlier policy will
|
||
# redirect it
|
||
qubes.Notifications * @anyvm @default allow target=dom0
|
||
|
||
# HTTP proxy for downloading updates
|
||
# Upgrade all TemplateVMs through sys-whonix.
|
||
#qubes.UpdatesProxy * @type:TemplateVM @default allow target=sys-whonix
|
||
# Upgrade Whonix TemplateVMs through sys-whonix.
|
||
qubes.UpdatesProxy * @tag:whonix-updatevm @default allow target=sys-whonix
|
||
# Deny Whonix TemplateVMs using UpdatesProxy of any other VM.
|
||
qubes.UpdatesProxy * @tag:whonix-updatevm @anyvm deny
|
||
# Default rule for all TemplateVMs - direct the connection to sys-net
|
||
qubes.UpdatesProxy * @type:TemplateVM @default allow target=sys-net
|
||
qubes.UpdatesProxy * @anyvm @anyvm deny
|
||
|
||
# WARNING: The qubes.VMShell service is dangerous and there are really few
|
||
# cases when it could be safely used. Especially when policy set to "ask" you
|
||
# have no way to know for sure what command(s) will be called. Compromissed
|
||
# source VM can substitute the command. Allowing one VM to execute
|
||
# qubes.VMShell over the other VM allows the former to TAKE FULL CONTROL over
|
||
# the later. In most cases this is not what we want!
|
||
#
|
||
# Instead we should be using task-specific qrexec services which provide
|
||
# assurance as to what program will be responding to the (untrusted) VM
|
||
# requests.
|
||
#
|
||
# It is, however, safe, in most cases, to allow ultimate control of the
|
||
# creating AppVM over the DisposableVM it creates as part of the qrexec service
|
||
# invocation. That's why by default we have "@anyvm @dispvm allow" rule. Note
|
||
# that it does _not_ allow any AppVM to execute qubes.VMShell service over any
|
||
# DispVM created in the system -- that would obviously be wrong. It only allows
|
||
# qubes.VMShell service access to the AppVM which creates the DispVM as part of
|
||
# this very service invocation.
|
||
#
|
||
# See e.g. this thread for some discussion:
|
||
# https://groups.google.com/d/msg/qubes-users/xnAByaL_bjI/3PjYdiTDW-0J
|
||
qubes.VMShell * @anyvm @dispvm allow
|
||
qubes.VMShell * @anyvm @anyvm deny
|
||
|
||
# WARNING: qubes.VMRootShell has similar risks as qubes.VMExec
|
||
# Add "user=root" option to any ask or allow rules.
|
||
qubes.VMRootShell * @anyvm @anyvm deny
|
||
|
||
# WARNING: The qubes.VMExec service is dangerous and there are really few
|
||
# cases when it could be safely used. Contrary to qubes.VMShell, when policy is
|
||
# set to "ask", the command to be executed is visible in the confirmation
|
||
# prompt. But once allowed, the source VM have full control over the command
|
||
# standard input/output. Allowing one VM to execute qubes.VMExec over the
|
||
# other VM allows the former to TAKE FULL CONTROL over the later. In most cases
|
||
# this is not what we want!
|
||
#
|
||
# Instead we should be using task-specific qrexec services which provide
|
||
# assurance as to what program will be responding to the (untrusted) VM
|
||
# requests.
|
||
#
|
||
# It is, however, safe, in most cases, to allow ultimate control of the
|
||
# creating AppVM over the DisposableVM it creates as part of the qrexec service
|
||
# invocation. That's why by default we have "@anyvm @dispvm allow" rule. Note
|
||
# that it does _not_ allow any AppVM to execute qubes.VMExec service over any
|
||
# DispVM created in the system -- that would obviously be wrong. It only allows
|
||
# qubes.VMExec service access to the AppVM which creates the DispVM as part of
|
||
# this very service invocation.
|
||
#
|
||
# See e.g. this thread for some discussion:
|
||
# https://groups.google.com/d/msg/qubes-users/xnAByaL_bjI/3PjYdiTDW-0J
|
||
qubes.VMExec * @anyvm @dispvm allow
|
||
qubes.VMExec * @anyvm @anyvm deny
|
||
|
||
# WARNING: qubes.VMExecGUI has similar risks as qubes.VMExec
|
||
qubes.VMExecGUI * @anyvm @dispvm allow
|
||
qubes.VMExecGUI * @anyvm @anyvm deny
|
||
|
||
--- /etc/qubes/policy.d/include ---
|
||
|
||
--- /etc/qubes/policy.d/README ---
|
||
# This directory contains qrexec policy in new (Qubes R5.0) format.
|
||
# See https://www.qubes-os.org/doc/ for explanation. If you want to
|
||
# write your own policy, see the '30-user' file.
|
||
|
||
|
||
===== 10. Effective policy query (if tools exist) =====
|
||
|
||
$ command -v qrexec-policy-graph && qrexec-policy-graph --include-ask 2>&1 | grep -iE "signer|clipboard" | head -30
|
||
/usr/bin/qrexec-policy-graph
|
||
qrexec.exc.PolicySyntaxError: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
|
||
$ command -v qvm-tags && qvm-tags dom0 2>/dev/null | head -20
|
||
/usr/bin/qvm-tags
|
||
|
||
===== 11. qrexec policy daemon status =====
|
||
|
||
$ systemctl status qrexec-policy-daemon --no-pager -l
|
||
Unit qrexec-policy-daemon.service could not be found.
|
||
|
||
$ systemctl is-active qrexec-policy-daemon
|
||
inactive
|
||
|
||
===== 12. Target qube info (nostr_signer) =====
|
||
|
||
$ qvm-ls --raw-data --fields NAME,STATE,CLASS,TEMPLATE,NETVM nostr_signer
|
||
nostr_signer|Running|StandaloneVM|-|sys-vpn-mullvad-app
|
||
|
||
$ qvm-features nostr_signer
|
||
default-menu-items xfce4-terminal.desktop thunar.desktop firefox-esr.desktop xfce-settings-manager.desktop
|
||
menu-items brave-browser.desktop org.xfce.mousepad.desktop xfce-settings-manager.desktop thunar.desktop codium.desktop xfce4-terminal.desktop
|
||
netvm-menu-items debian-xterm.desktop
|
||
qrexec 1
|
||
os Linux
|
||
supported-service.gui-agent-clipboard-wipe 1
|
||
supported-service.qubes-updates-proxy 1
|
||
supported-service.apparmor 1
|
||
apparmor 1
|
||
supported-service.crond 1
|
||
supported-service.minimal-usbvm 1
|
||
supported-service.pipewire 1
|
||
supported-service.cups 1
|
||
supported-service.minimal-netvm 1
|
||
supported-service.qubes-firewall 1
|
||
supported-service.qubes-network 1
|
||
supported-service.modem-manager 1
|
||
supported-service.no-qubesincoming-cleanup 1
|
||
supported-service.updates-proxy-setup 1
|
||
supported-service.clocksync 1
|
||
supported-service.meminfo-writer 1
|
||
supported-service.network-manager 1
|
||
supported-service.qubes-update-check 1
|
||
supported-rpc.qubes.OpenInVM 1
|
||
supported-rpc.qubes.SuspendPostAll 1
|
||
supported-rpc.qubes.RegisterBackupLocation 1
|
||
supported-rpc.qubes.USB 1
|
||
supported-rpc.qubes.SetDateTime 1
|
||
supported-rpc.qubes.DetachPciDevice 1
|
||
supported-rpc.qubes.WaitForSession 1
|
||
supported-rpc.qubes.StartApp 1
|
||
supported-rpc.qubes.Filecopy 1
|
||
supported-rpc.qubes.InstallUpdatesGUI 1
|
||
supported-rpc.qubes.SuspendPre 1
|
||
supported-rpc.qubes.PdfConvert 1
|
||
supported-rpc.qubes.SelectFile 1
|
||
supported-rpc.qubes.TemplateSearch 1
|
||
supported-rpc.qubes.PostInstall 1
|
||
supported-rpc.qubes.Backup 1
|
||
supported-rpc.qubes.TemplateDownload 1
|
||
supported-rpc.qubes.VMShell 1
|
||
supported-rpc.qubes.SetMonitorLayout 1
|
||
supported-rpc.qubes.OpenURL 1
|
||
supported-rpc.qubes.ShowInTerminal 1
|
||
supported-rpc.qubes.GetAppmenus 1
|
||
supported-rpc.qubes.Gpg 1
|
||
supported-rpc.qubes.SuspendPost 1
|
||
supported-rpc.qubes.ResizeDisk 1
|
||
supported-rpc.qubes.SaltLinuxVM 1
|
||
supported-rpc.qubes.USBAttach 1
|
||
supported-rpc.qubes.Restore 1
|
||
supported-rpc.qubes.GuiVMSession 1
|
||
supported-rpc.qubes.GetDate 1
|
||
supported-rpc.qubes.USBDetach 1
|
||
supported-rpc.qubes.GpgImportKey 1
|
||
supported-rpc.qubes.VMExec 1
|
||
supported-rpc.qubes.WaitForNetworkUplink 1
|
||
supported-rpc.qubes.GetImageRGBA 1
|
||
supported-rpc.qubes.SuspendPreAll 1
|
||
supported-rpc.qubes.VMRootExec 1
|
||
supported-rpc.qubes.VMExecGUI 1
|
||
supported-rpc.qubes.WaitForRunningSystem 1
|
||
supported-rpc.qubes.VMRootShell 1
|
||
supported-rpc.qubes.RestoreById 1
|
||
supported-rpc.qubes.SelectDirectory 1
|
||
supported-feature.memory-hotplug 1
|
||
os-distribution debian
|
||
os-version 13
|
||
os-eol 2028-08-09
|
||
qubes-agent-version 4.3
|
||
gui 1
|
||
qubes-firewall 1
|
||
vmexec 1
|
||
template-name debian-13-xfce
|
||
template-epoch 0
|
||
template-version 4.3.0
|
||
template-release 202512040043
|
||
template-reponame @commandline
|
||
template-buildtime 2025-12-04 01:03:33
|
||
template-installtime 2026-03-23 23:42:36
|
||
template-license GPLv3+
|
||
template-url http://www.qubes-os.org
|
||
template-summary Qubes OS template for debian-13-xfce
|
||
template-description Qubes OS template for debian-13-xfce.
|
||
updates-available 1
|
||
last-updates-check 2026-08-19 07:47:50
|
||
last-update 2026-05-03 08:55:29
|
||
supported-rpc.qubes.NsignerRpc 1
|
||
|
||
$ qvm-prefs nostr_signer
|
||
audiovm D dom0
|
||
autostart D False
|
||
backup_timestamp U
|
||
bootmode D default
|
||
debug D False
|
||
default_dispvm D default-dvm
|
||
default_user D user
|
||
devices_denied D
|
||
dns D 10.139.1.1 10.139.1.2
|
||
gateway D
|
||
gateway6 D
|
||
guivm D dom0
|
||
icon D standalonevm-yellow
|
||
include_in_backups D True
|
||
installed_by_rpm D False
|
||
ip D 10.137.0.26
|
||
ip6 D fd09:24ef:4179::a89:1a
|
||
kernel D 6.12.59-1.fc41
|
||
kernelopts D swiotlb=2048
|
||
keyboard_layout D us++
|
||
klass D StandaloneVM
|
||
label - yellow
|
||
mac D 00:16:3e:5e:6c:00
|
||
management_dispvm D default-mgmt-dvm
|
||
maxmem D 4000
|
||
memory D 400
|
||
name - nostr_signer
|
||
netvm - sys-vpn-mullvad-app
|
||
provides_network - False
|
||
qid - 26
|
||
qrexec_timeout D 60
|
||
shutdown_timeout D 60
|
||
start_time D 1786966896.93
|
||
stubdom_mem U
|
||
stubdom_uuid D
|
||
stubdom_xid D -1
|
||
template_for_dispvms D False
|
||
updateable D True
|
||
uuid - 5e4cd87f-2bd2-4de3-a581-985abce50b04
|
||
vcpus D 2
|
||
virt_mode D pvh
|
||
visible_gateway D 10.137.0.20
|
||
visible_gateway6 D fd09:24ef:4179::a89:14
|
||
visible_ip D 10.137.0.26
|
||
visible_ip6 D fd09:24ef:4179::a89:1a
|
||
visible_netmask D 255.255.255.255
|
||
xid D 14
|
||
|
||
===== 13. Caller qube info (ai) =====
|
||
|
||
$ qvm-ls --raw-data --fields NAME,STATE,CLASS,TEMPLATE,NETVM ai
|
||
ai|Running|StandaloneVM|-|sys-vpn-mullvad-app
|
||
|
||
$ qvm-features ai
|
||
default-menu-items xfce4-terminal.desktop thunar.desktop firefox-esr.desktop xfce-settings-manager.desktop
|
||
menu-items brave-browser.desktop xfce4-mime-settings.desktop firefox-esr.desktop org.gnumeric.gnumeric.desktop libreoffice-writer.desktop org.xfce.mousepad.desktop com.obsproject.Studio.desktop pgadmin4.desktop pavucontrol.desktop xfce-settings-manager.desktop thunar.desktop vlc.desktop codium.desktop xfce4-terminal.desktop
|
||
netvm-menu-items debian-xterm.desktop
|
||
qrexec 1
|
||
os Linux
|
||
supported-service.gui-agent-clipboard-wipe 1
|
||
supported-service.qubes-updates-proxy 1
|
||
supported-service.apparmor 1
|
||
apparmor 1
|
||
supported-service.crond 1
|
||
supported-service.minimal-usbvm 1
|
||
supported-service.pipewire 1
|
||
supported-service.cups 1
|
||
supported-service.minimal-netvm 1
|
||
supported-service.qubes-firewall 1
|
||
supported-service.qubes-network 1
|
||
supported-service.modem-manager 1
|
||
supported-service.no-qubesincoming-cleanup 1
|
||
supported-service.updates-proxy-setup 1
|
||
supported-service.clocksync 1
|
||
supported-service.meminfo-writer 1
|
||
supported-service.network-manager 1
|
||
supported-service.qubes-update-check 1
|
||
supported-rpc.qubes.OpenInVM 1
|
||
supported-rpc.qubes.SuspendPostAll 1
|
||
supported-rpc.qubes.RegisterBackupLocation 1
|
||
supported-rpc.qubes.USB 1
|
||
supported-rpc.qubes.SetDateTime 1
|
||
supported-rpc.qubes.DetachPciDevice 1
|
||
supported-rpc.qubes.WaitForSession 1
|
||
supported-rpc.qubes.StartApp 1
|
||
supported-rpc.qubes.Filecopy 1
|
||
supported-rpc.qubes.InstallUpdatesGUI 1
|
||
supported-rpc.qubes.SuspendPre 1
|
||
supported-rpc.qubes.PdfConvert 1
|
||
supported-rpc.qubes.SelectFile 1
|
||
supported-rpc.qubes.TemplateSearch 1
|
||
supported-rpc.qubes.PostInstall 1
|
||
supported-rpc.qubes.Backup 1
|
||
supported-rpc.qubes.TemplateDownload 1
|
||
supported-rpc.qubes.VMShell 1
|
||
supported-rpc.qubes.SetMonitorLayout 1
|
||
supported-rpc.qubes.OpenURL 1
|
||
supported-rpc.qubes.ShowInTerminal 1
|
||
supported-rpc.qubes.GetAppmenus 1
|
||
supported-rpc.qubes.Gpg 1
|
||
supported-rpc.qubes.SuspendPost 1
|
||
supported-rpc.qubes.ResizeDisk 1
|
||
supported-rpc.qubes.SaltLinuxVM 1
|
||
supported-rpc.qubes.USBAttach 1
|
||
supported-rpc.qubes.Restore 1
|
||
supported-rpc.qubes.GuiVMSession 1
|
||
supported-rpc.qubes.GetDate 1
|
||
supported-rpc.qubes.USBDetach 1
|
||
supported-rpc.qubes.GpgImportKey 1
|
||
supported-rpc.qubes.VMExec 1
|
||
supported-rpc.qubes.WaitForNetworkUplink 1
|
||
supported-rpc.qubes.GetImageRGBA 1
|
||
supported-rpc.qubes.SuspendPreAll 1
|
||
supported-rpc.qubes.VMRootExec 1
|
||
supported-rpc.qubes.VMExecGUI 1
|
||
supported-rpc.qubes.WaitForRunningSystem 1
|
||
supported-rpc.qubes.VMRootShell 1
|
||
supported-rpc.qubes.RestoreById 1
|
||
supported-rpc.qubes.SelectDirectory 1
|
||
supported-feature.memory-hotplug 1
|
||
os-distribution debian
|
||
os-version 13
|
||
os-eol 2028-08-09
|
||
qubes-agent-version 4.3
|
||
gui 1
|
||
qubes-firewall 1
|
||
vmexec 1
|
||
template-name debian-13-xfce
|
||
template-epoch 0
|
||
template-version 4.3.0
|
||
template-release 202512040043
|
||
template-reponame @commandline
|
||
template-buildtime 2025-12-04 01:03:33
|
||
template-installtime 2026-03-23 23:42:36
|
||
template-license GPLv3+
|
||
template-url http://www.qubes-os.org
|
||
template-summary Qubes OS template for debian-13-xfce
|
||
template-description Qubes OS template for debian-13-xfce.
|
||
updates-available 1
|
||
last-updates-check 2026-08-18 17:25:14
|
||
last-update 2026-08-02 07:16:44
|
||
qubesmanager.maxmem_value 100000
|
||
supported-service.guivm-gui-agent 1
|
||
kvm true
|
||
|
||
===== 14. Recent qrexec/policy journal errors =====
|
||
|
||
$ journalctl -b --no-pager 2>/dev/null | grep -iE "qrexec|policy|SignerRpc|NsignerRpc|clipboard" | tail -80
|
||
Aug 20 14:10:57 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: denied: no matching rule found
|
||
Aug 20 14:11:11 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NsignerRpc+: ai -> nostr_signer: allowed to nostr_signer
|
||
Aug 20 14:12:09 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: denied: no matching rule found
|
||
Aug 20 14:12:09 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NsignerRpc+: ai -> nostr_signer: allowed to nostr_signer
|
||
Aug 20 14:12:24 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ConnectTCP: ai -> nostr_signer: denied: denied by policy /etc/qubes/policy.d/90-default.policy:22
|
||
Aug 20 14:14:38 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: denied: no matching rule found
|
||
Aug 20 14:19:19 dom0 sudo[45983]: rubik : TTY=pts/18 ; PWD=/home/rubik/Desktop ; USER=root ; COMMAND=/usr/bin/mkdir -p /etc/qubes-rpc/policy/
|
||
Aug 20 14:20:47 dom0 sudo[46015]: rubik : TTY=pts/18 ; PWD=/home/rubik/Desktop ; USER=root ; COMMAND=/usr/bin/tee /etc/qubes-rpc/policy/qubes.SignerRpc
|
||
Aug 20 14:21:07 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 14:21:07 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 14:22:08 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 14:22:08 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ClipboardPaste: dom0 -> ai: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 14:23:06 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 14:23:06 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ClipboardPaste: dom0 -> ai: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 14:23:55 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 14:23:55 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ClipboardPaste: dom0 -> ai: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 14:24:48 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 14:24:48 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ClipboardPaste: dom0 -> ai: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 14:32:15 dom0 sudo[46192]: rubik : TTY=pts/18 ; PWD=/etc/qubes-rpc/policy ; USER=root ; COMMAND=/usr/bin/nano /etc/qubes-rpc/policy
|
||
Aug 20 14:32:15 dom0 kernel: audit: type=1123 audit(1787250735.834:625): pid=46192 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes-rpc/policy" cmd=6E616E6F202F6574632F71756265732D7270632F706F6C696379 exe="/usr/bin/sudo" terminal=pts/18 res=success'
|
||
Aug 20 14:32:15 dom0 audit[46192]: USER_CMD pid=46192 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes-rpc/policy" cmd=6E616E6F202F6574632F71756265732D7270632F706F6C696379 exe="/usr/bin/sudo" terminal=pts/18 res=success'
|
||
Aug 20 14:35:41 dom0 kernel: audit: type=1123 audit(1787250941.718:631): pid=46228 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes-rpc/policy" cmd=61707420696E7374616C6C206C6F63617465 exe="/usr/bin/sudo" terminal=pts/18 res=failed'
|
||
Aug 20 14:35:41 dom0 audit[46228]: USER_CMD pid=46228 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes-rpc/policy" cmd=61707420696E7374616C6C206C6F63617465 exe="/usr/bin/sudo" terminal=pts/18 res=failed'
|
||
Aug 20 14:40:19 dom0 sudo[46247]: rubik : TTY=pts/18 ; PWD=/etc/qubes-rpc/policy ; USER=root ; COMMAND=/usr/bin/find / -iname *nsigner*
|
||
Aug 20 14:40:19 dom0 kernel: audit: type=1123 audit(1787251219.942:633): pid=46247 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes-rpc/policy" cmd=66696E64202F202D696E616D65202A6E7369676E65722A exe="/usr/bin/sudo" terminal=pts/18 res=success'
|
||
Aug 20 14:40:19 dom0 audit[46247]: USER_CMD pid=46247 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes-rpc/policy" cmd=66696E64202F202D696E616D65202A6E7369676E65722A exe="/usr/bin/sudo" terminal=pts/18 res=success'
|
||
Aug 20 14:46:48 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 14:46:48 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 14:46:59 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 14:46:59 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 14:46:59 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 14:46:59 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NsignerRpc: ai -> nostr_signer: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 14:50:43 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 14:50:43 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 14:57:00 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 14:57:00 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 14:58:43 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 14:58:43 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ClipboardPaste: dom0 -> ai: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 14:59:31 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 14:59:31 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ClipboardPaste: dom0 -> ai: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 15:02:59 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 15:02:59 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ClipboardPaste: dom0 -> ai: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 15:06:00 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 15:06:00 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.ClipboardPaste: dom0 -> ai: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 15:18:18 dom0 sudo[46648]: rubik : TTY=pts/18 ; PWD=/etc/qubes/policy.d ; USER=root ; COMMAND=/usr/bin/chown --reference=/etc/qubes/policy.d/50-config-updates.policy /etc/qubes/policy.d/50-config-clipboard.policy
|
||
Aug 20 15:18:18 dom0 kernel: audit: type=1123 audit(1787253498.846:652): pid=46648 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes/policy.d" cmd=63686F776E202D2D7265666572656E63653D2F6574632F71756265732F706F6C6963792E642F35302D636F6E6669672D757064617465732E706F6C696379202F6574632F71756265732F706F6C6963792E642F35302D636F6E6669672D636C6970626F6172642E706F6C696379 exe="/usr/bin/sudo" terminal=pts/18 res=success'
|
||
Aug 20 15:18:18 dom0 audit[46648]: USER_CMD pid=46648 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes/policy.d" cmd=63686F776E202D2D7265666572656E63653D2F6574632F71756265732F706F6C6963792E642F35302D636F6E6669672D757064617465732E706F6C696379202F6574632F71756265732F706F6C6963792E642F35302D636F6E6669672D636C6970626F6172642E706F6C696379 exe="/usr/bin/sudo" terminal=pts/18 res=success'
|
||
Aug 20 15:19:35 dom0 sudo[46666]: rubik : TTY=pts/18 ; PWD=/etc/qubes/policy.d ; USER=root ; COMMAND=/usr/bin/chown --reference=/etc/qubes/policy.d/50-config-updates.policy /etc/qubes/policy.d/45-signer.policy
|
||
Aug 20 15:19:35 dom0 kernel: audit: type=1123 audit(1787253575.796:658): pid=46666 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes/policy.d" cmd=63686F776E202D2D7265666572656E63653D2F6574632F71756265732F706F6C6963792E642F35302D636F6E6669672D757064617465732E706F6C696379202F6574632F71756265732F706F6C6963792E642F34352D7369676E65722E706F6C696379 exe="/usr/bin/sudo" terminal=pts/18 res=success'
|
||
Aug 20 15:19:35 dom0 audit[46666]: USER_CMD pid=46666 uid=1000 auid=1000 ses=2 msg='cwd="/etc/qubes/policy.d" cmd=63686F776E202D2D7265666572656E63653D2F6574632F71756265732F706F6C6963792E642F35302D636F6E6669672D757064617465732E706F6C696379202F6574632F71756265732F706F6C6963792E642F34352D7369676E65722E706F6C696379 exe="/usr/bin/sudo" terminal=pts/18 res=success'
|
||
Aug 20 15:21:08 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 15:21:08 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.SignerRpc: ai -> nostr_signer: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 17:16:08 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 17:16:08 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NotifyUpdates: sys-whonix -> dom0: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 17:16:24 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 17:16:24 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NotifyUpdates: sys-net -> dom0: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 17:17:36 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 17:17:36 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NotifyUpdates: sys-firewall -> dom0: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 17:17:38 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 17:17:38 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NotifyUpdates: sys-vpn-mullvad-app -> dom0: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 17:18:40 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 17:18:40 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NotifyUpdates: clearnet -> dom0: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 17:20:24 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 17:20:24 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.GetDate+nanoseconds: ai -> @default: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 17:22:40 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 17:22:40 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.GetDate+nanoseconds: sys-firewall -> @default: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 17:24:05 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 17:24:05 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.GetDate+nanoseconds: sys-usb -> @default: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 17:24:16 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 17:24:16 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.GetDate+nanoseconds: clearnet -> @default: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 17:25:13 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 17:25:13 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NotifyUpdates: ai -> dom0: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 17:25:33 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 17:25:33 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.GetDate+nanoseconds: sys-vpn-mullvad-app -> @default: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 17:25:57 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 17:25:57 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.NotifyUpdates: nostr -> dom0: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 17:30:50 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 17:30:50 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.GetDate+nanoseconds: nostr -> @default: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
Aug 20 17:58:59 dom0 qrexec-policy-daemon[4782]: warning: !compat-4.0 directive in file /etc/qubes/policy.d/35-compat.policy line 16 is transitional and will be deprecated
|
||
Aug 20 17:58:59 dom0 qrexec-policy-daemon[4782]: qrexec: qubes.GetDate+nanoseconds: vault -> @default: error loading policy: /etc/qubes-rpc/policy/qubes.SignerRpc:1: invalid action: *
|
||
|
||
===== 15. qrexec service definitions in target qube (via qvm-run, read-only) =====
|
||
|
||
$ qvm-run -p nostr_signer "ls -la /etc/qubes-rpc/ 2>/dev/null; echo ---; ls -la /rw/config/qubes-rpc/ 2>/dev/null; echo ---; cat /rw/config/rc.local 2>/dev/null" 2>&1 | head -60
|
||
total 172
|
||
drwxr-xr-x 2 root root 4096 Jul 11 09:43 .
|
||
drwxr-xr-x 132 root root 12288 Aug 17 07:41 ..
|
||
lrwxrwxrwx 1 root root 32 Feb 19 22:38 policy.Ask -> /var/run/qubes/policy-agent.sock
|
||
lrwxrwxrwx 1 root root 32 Feb 19 22:38 policy.Notify -> /var/run/qubes/policy-agent.sock
|
||
-rwxr-xr-x 1 root root 734 Nov 24 2025 qubes.Backup
|
||
lrwxrwxrwx 1 root root 18 Jan 11 2026 qubes.ConnectTCP -> /dev/tcp/127.0.0.1
|
||
-rwxr-xr-x 1 root root 92 Nov 24 2025 qubes.DetachPciDevice
|
||
-rwxr-xr-x 1 root root 304 Nov 24 2025 qubes.Filecopy
|
||
-rwxr-xr-x 1 root root 2183 Nov 24 2025 qubes.GetAppmenus
|
||
-rwxr-xr-x 1 root root 887 Nov 24 2025 qubes.GetDate
|
||
-rwxr-xr-x 1 root root 1529 Nov 24 2025 qubes.GetImageRGBA
|
||
-rwxr-xr-x 1 root root 1549 Oct 27 2025 qubes.Gpg
|
||
-rwxr-xr-x 1 root root 42 Oct 27 2025 qubes.GpgImportKey
|
||
lrwxrwxrwx 1 root root 27 Nov 23 2025 qubes.GuiVMSession -> /usr/bin/qubes-start-xephyr
|
||
-rwxr-xr-x 1 root root 1130 Nov 24 2025 qubes.InstallUpdatesGUI
|
||
-rwxr-xr-x 1 root root 65 Jul 11 09:44 qubes.NsignerRpc
|
||
-rwxr-xr-x 1 root root 45 Nov 24 2025 qubes.OpenInVM
|
||
-rwxr-xr-x 1 root root 195 Nov 24 2025 qubes.OpenURL
|
||
lrwxrwxrwx 1 root root 34 Oct 9 2025 qubes.PdfConvert -> /usr/lib/qubes/qpdf-convert-server
|
||
-rwxr-xr-x 1 root root 1006 Nov 24 2025 qubes.PostInstall
|
||
-rwxr-xr-x 1 root root 1027 Nov 24 2025 qubes.RegisterBackupLocation
|
||
-rwxr-xr-x 1 root root 439 Nov 24 2025 qubes.ResizeDisk
|
||
-rwxr-xr-x 1 root root 1393 Nov 24 2025 qubes.Restore
|
||
-rwxr-xr-x 1 root root 2620 Nov 24 2025 qubes.RestoreById
|
||
-rwxr-xr-x 1 root root 2059 Oct 4 2025 qubes.SaltLinuxVM
|
||
-rwxr-xr-x 1 root root 67 Nov 24 2025 qubes.SelectDirectory
|
||
-rwxr-xr-x 1 root root 55 Nov 24 2025 qubes.SelectFile
|
||
-rwxr-xr-x 1 root root 356 Nov 24 2025 qubes.SetDateTime
|
||
lrwxrwxrwx 1 root root 33 Nov 23 2025 qubes.SetMonitorLayout -> /usr/bin/qubes-set-monitor-layout
|
||
-rwxr-xr-x 1 root root 428 Nov 24 2025 qubes.ShowInTerminal
|
||
-rwxr-xr-x 1 root root 1799 Nov 24 2025 qubes.StartApp
|
||
-rwxr-xr-x 1 root root 48 Nov 24 2025 qubes.SuspendPost
|
||
-rwxr-xr-x 1 root root 1006 Nov 24 2025 qubes.SuspendPostAll
|
||
-rwxr-xr-x 1 root root 49 Nov 24 2025 qubes.SuspendPre
|
||
-rwxr-xr-x 1 root root 1005 Nov 24 2025 qubes.SuspendPreAll
|
||
-rwxr-xr-x 1 root root 70 Nov 24 2025 qubes.TemplateDownload
|
||
-rwxr-xr-x 1 root root 67 Nov 24 2025 qubes.TemplateSearch
|
||
lrwxrwxrwx 1 root root 23 Jan 11 2026 qubes.UpdatesProxy -> /dev/tcp/127.0.0.1/8082
|
||
-rwxr-xr-x 1 root root 342 Aug 5 2025 qubes.USB
|
||
-rwxr-xr-x 1 root root 567 Aug 5 2025 qubes.USBAttach
|
||
-rwxr-xr-x 1 root root 1132 Aug 5 2025 qubes.USBDetach
|
||
-rwxr-xr-x 1 root root 43 Nov 24 2025 qubes.VMExec
|
||
lrwxrwxrwx 1 root root 12 Jan 11 2026 qubes.VMExecGUI -> qubes.VMExec
|
||
-rwxr-xr-x 1 root root 43 Nov 24 2025 qubes.VMRootExec
|
||
-rwxr-xr-x 1 root root 142 Nov 24 2025 qubes.VMRootShell
|
||
-rwxr-xr-x 1 root root 25 Nov 24 2025 qubes.VMShell
|
||
-rwxr-xr-x 1 root root 450 Nov 24 2025 qubes.WaitForNetworkUplink
|
||
-rwxr-xr-x 1 root root 68 Nov 24 2025 qubes.WaitForRunningSystem
|
||
-rwxr-xr-x 1 root root 304 Nov 24 2025 qubes.WaitForSession
|
||
---
|
||
---
|
||
#!/bin/sh
|
||
|
||
# This script will be executed at every VM startup, you can place your own
|
||
# custom commands here. This includes overriding some configuration in /etc,
|
||
# starting services etc.
|
||
#
|
||
# Executable scripts located in /rw/config/rc.local.d with the extension
|
||
# '.rc' are executed immediately before this rc.local.
|
||
|
||
===== 16. Test qrexec call to nostr_signer (read-only get_info) =====
|
||
|
||
$ echo "{\"id\":\"diag\",\"method\":\"get_info\",\"params\":[]}" | timeout 10 qrexec-client-vm nostr_signer qubes.SignerRpc 2>&1; echo "exit=$?"
|
||
timeout: failed to run command ‘qrexec-client-vm’: No such file or directory
|
||
exit=127
|
||
|
||
$ echo "{\"id\":\"diag\",\"method\":\"get_info\",\"params\":[]}" | timeout 10 qrexec-client-vm nostr_signer qubes.NsignerRpc 2>&1; echo "exit=$?"
|
||
timeout: failed to run command ‘qrexec-client-vm’: No such file or directory
|
||
exit=127
|
||
|
||
===== 17. Qubes global config files =====
|
||
|
||
$ ls -la /etc/qubes/ | head -30
|
||
total 36
|
||
drwxr-xr-x 7 root root 4096 Mar 23 19:24 .
|
||
drwxr-xr-x 112 root root 4096 Apr 27 07:31 ..
|
||
drwxrwx--- 2 root qubes 4096 Mar 31 19:45 backup
|
||
-rw-r--r-- 1 root root 3798 Oct 19 2025 guid.conf
|
||
drwxrwxr-x 3 root qubes 4096 Aug 20 15:12 policy.d
|
||
drwxr-xr-x 2 root root 4096 Mar 23 19:24 post-install.d
|
||
-rw-rw-r-- 1 root qubes 471 Nov 8 2025 qmemman.conf
|
||
drwxr-xr-x 3 root root 4096 Mar 23 19:23 repo-templates
|
||
drwxr-xr-x 2 root root 4096 Mar 23 19:24 rpc-config
|
||
|
||
$ cat /etc/qubes/policy.d/50-config-input.policy 2>/dev/null
|
||
qubes.InputMouse * sys-usb dom0 allow
|
||
qubes.InputKeyboard * sys-usb dom0 allow
|
||
# not configurable by this state
|
||
qubes.InputTablet * sys-usb dom0 deny
|
||
|
||
$ cat /etc/qubes/policy.d/50-config-updates.policy 2>/dev/null
|
||
qubes.UpdatesProxy * @tag:whonix-updatevm @default allow target=sys-whonix
|
||
qubes.UpdatesProxy * @tag:whonix-updatevm @anyvm deny
|
||
|
||
===== DONE =====
|