Automatic clipboard clearing

User Support
1

I’m not sure I searched thoroughly enough for an answer, so please apologize if it’s a redundant question.

Is there a mechanism in Qubes that will purge clipboard after n seconds after pasting it?

What am I trying to achieve:
After copying credentials from the KeepasXC to a(n online) dispVM via CTRL+SHIFT+v - > CTRL+v, last credential stays in a dispVM’s clipboard which isn’t security oriented. So, I manually copy some other meaningless thing right after pasting credentials, even for several times in a row. I’d like purging to be done automatically after n seconds, just like it happens in KeePassXC

2

In R4.0 the Qubes clipboard contents/state are stored in three files in /run/qubes, all starting with qubes-clipboard.bin. I haven’t checked R4.1 but likely the same.

A script to monitor/discard the clipboard based on a timer, the file the modification date(s) and the xevent number in qubes-clipboard.bin.xevent probably wouldn’t be too complex. Not sure best way to avoid a race condition though if you happen to copy microseconds before the time runs out.

B

PS /run is tmpfs, so clipboard isn’t written to permanent storage.

1 Like
3

No there isn’t.
You can install xsel and run it under watch or in a loop, and that
will clear both the clipboard and the primary selection (used when 3
highlight text under X)
This will clear the clipboard automatically, but isn’t dependent on the
paste process.

For that, you can install a clipboard manager - you can (usually)
configure them to clear the clipboard after use. This isn’t a Qubes
specific issue.

To roll your own you could use a simple script that accesses the
clipboard using xsel or xclip, adds a sleep, and then uses xsel to clear
the selections:
something like -

/usr/bin/bash
xsel 
sleep 5
xsel -c -p
xsel -c -b

Bind it to a keyboard shortcut (You may be able to override Ctrl+C),
and it should do what you want.
You’ll have to handle the output so that it gets to the application you
want, but we’ve covered using xdotool getwindowfocus before.

4

sclip.sh

#!/usr/bin/sh
xsel -b -o |xclip -in -sel clip -loops 2
xsel -d -p

secure_paste.sh

#!/usr/bin/bash
ID=`xdotool getwindowfocus`
WM_CLASS=`xprop WM_CLASS -id $ID |cut -f2 -d, |tr -d '"' `
QUBE=`xprop _QUBES_VMNAME -id $ID|cut -f2 -d\" `
#echo $QUBE >> /home/user/log
if [[ "$QUBE" == "_QUBES_VMNAME: not found." ]]; then
  exit
else
  qvm-run $QUBE '/home/user/sclip.sh'
fi

sclip.sh and secure_paste.sh provide for a simple secure paste
mechanism in Qubes, clearing the clipboard after paste.
You must install xsel and xclip in the template:
sudo apt install xsel xclip

Copy sclip.sh to /etc/skel in a template, or to /home/user in a qube.
Make it executable - chmod +x <PATH>/sclip.sh

Copy secure_paste.sh to dom0 - make it executable.
Then create a keyboard shortcut, linking secure_paste.sh to Ctrl+B (or some other combination.)

Ctrl+B, Ctrl+V will wipe the clipboard after paste.
For inter-qube copy/paste the mechanism would be:
Ctrl+C, Ctrl+Shift+C, Ctrl+Shift+V, Ctrl+B, Ctrl+V

1 Like
5

Thanks a bunch. I was absolutely unfamiliar with the tools and didn’t want to be pushy you to further explain (it’s not Qubes specific), so went on a research and learning, and then here you are with a ready made solution.
Truly appreciate the time you took on this.