Behaviour when attaching block to multiple qubes at the same

I am quite confused what exacly happens currently when you connect one block device to multiple qubes at the same time.

I read qvm-block allows attaching the same device to multiple qubes · Issue #4692 · QubesOS/qubes-issues · GitHub
And some change seems to have been made but I am not sure what the exact behaviour is now?

I assume that the first time you attach it’s rw and all the others times it’s ro? But in that case it’s not obvious to the second qube, it thinks the device is rw and then just errors out when you write something. Also it’s weird when you create a new file in the first qube it does not show up on the second qube until you remount the device (not reattach)

The expected behavior is to not allow attaching the same block device to multiple qubes at the same time.

1 Like

Also via the cli? “qvm-block at” just does it. I was actually quite surprised and would like to use it, there should be no issue when doing this with the --ro option?

That is blocked in R4.3 already. R4.2 indeed allows that via CLI and it’s a bug. Don’t do that.

Alright thanks for the info.

Is there any plan to implement something that would enable cross file sharing like:

?

There are various 3rd-party tools for that, including the one you listed. Currently there are no plans for built-in mechanism like that, as it significantly weakens isolation between qubes. Use at your own risk.

Okay.

Also thanks for all your work on Qubes!

There is sort of a way to share the same thing among multiple qubes. Multiple qubes can have NFS (I’m sure that’s not the right term but I am having a mental block right now) sharing to the same device over a network. So conceivably you could pass files from one qube to another provided they are not isolated from whatever network the share is on.

That’s not completely in a Qubes context, of course; so it probably won’t be useful to you.

What Marmarek says is emphatically true; it does cut down on isolation between qubes. I certainly don’t do this, and even though I do NFS shares, what’s on that share are encrypted containers–which look like block devices after decryption–which means no two qubes can share the same one; exactly what QubesOS likes.