Was trying to use USB microphone, but sys-usb is disabled by default so I went through the documentation and installed it.
sudo qubesctl state.sls qvm.sys-usb
The USB was still working after said command. It was only until I powered off the machine it no longer was detecting my mouse or password. I can not enter password to decrypt. What should I do? Please and thank you Qubes Community
add qubes.skip_autostart
to kernel option when you in grub menu, so your kernel paramenter have something like ............rhgb quiet qubes.skip_autostart
then f10 to boot
to modify kernel parameters, press e when you in grub menu.
Did you try the suggestion? Did you make any progress on this problem? I donât know if I am having the same problem or not, but my usb mouse and KB work fine after install, until after my first reboot, then they wonât work at all.
What does that accomplish, @51lieal (because my problem seems a little similar but I am unsure what skipping autostart would do and a little afraid to modify kernel parameters)?
what happen before you do first reboot? create sys-usb ? if yes, what command.
itâs just telling to not start vm that automatically start, itâs safe and itâs not permanent (only for that boot), because we donât write it, in grub config.
Thank you.
I installed Qubes 4.1, it boots, I plug in my mouse and click OK and the mouse works. I edit the Input.Keyboard file and plug in my keyboard and it works. Both through sys-usb but working in every Qube automatically without attaching (which seems like a security risk?).
However, then if I boot again, mouse and KB wonât work in dom0 or anywhere. It will say device name available when they are plugged in, but they wonât attach. It says QubesException device attached failed: but then it doesnât provide a more specific error for why it wonât attach.
that mean you create sys-usb at initial setup ? whatâs the policy inside input.keyboard and mouse? did you enable no-strict-reset ?
sys-usb was automatically created for me and it was already running also.
Input.Keyboard has:
sys-usb dom0 allow
usbcore.authorized_default=0
$anyvm $anyvm deny
Input.Mouse I didnât edit from the default, it has:
sys-usb dom0 ask,user=root,default_target=dom0
$anyvm $anyvm deny
Of course I am not using Qubes as a root user.
I didnât enable no-strict-reset, I have tried to read all threads and documents. I have not heard of this before.
if you hadnât do any changes, then :
boot qubes with kernel parameters i mention above (if keyboard and mouse not working)
- remove all line in input.keyboard and mouse except
$anyvm $anyvm deny
- run
sudo qubesctl state.sls qvm.usb-keyboard
then reboot, you should be able to use keyboard, and after login screen thereâs a notification to confirm if mouse is allowed or not.
for futher documentation, read this. USB qubes | Qubes OS
read it 2 - 3 times, to fully understand about sys-usb.
Thanks, I have done these steps and the mouse and keyboard work.
However, I was not prompted after plugging in the mouse or keyboard (or later I tried my usb hub). It seems insecure?
I have read the documentation about usb many times, but I think I am not understanding part of it.
I planned to type my password(s) on the built-in laptop keyboard (never usb keyboard) for security.
However the methods in the documentation didnât work as you know, I could not get the keyboard or mouse to work at all.
Most of the modern laptop internal keyboard using usb connection, just add this kernel parameters in grub rd.qubes.hide_all_usb
see if you can enter luks password or not. if it doesnât work, that mean your pc is using usb.
Similar problem here⌠I have created a sys-usb with
sudo qubesctl state.sls qvm.usb-keyboard
and added
sys-usb dom0 allow
as first line in
/etc/qubes-rpc/policy/qubes.InputKeyboard and qubes.InputMouse
Fortunatly my build-in keyboard and trackpad work. However, my external usb-keyboard and usb-mouse connected with a small docking-station do not. They are recognized and displayed by sys-usb (sys-usb:4-4.1 and sys-usb:4-4.2) but not attached to dom0 (and canât be attached to dom0).
Iâve experimented with installing sys-gui and sys-gui-gpu, are not using either of them for the time being, and wonder if there are remnants in the configs pointing my devices towards sys-gui or sys-gui-gpu but those qubes are not running and since my build-in keyboard and trackpad are working, I consider this unlikely.
Iâve read USB qubes | Qubes OS - not sure if I understood the section âQubes 4.1: How to enable a USB keyboard on a separate USB controllerâ - can anybody confirm that and WHY one has insert usbcore.authorized_default=0
and rd.qubes.dom0_usb=<BDF>
to grubâs CMDLINE? Both relevant PCI devices (â00:14.0 USB controller Intel barfooâ and â3c:00.0 USB controller Thunderbird foobarâ) are attached to or selected for sys-usb.
You can check journalctl to see if your keyboard/mouse will be attached to dom0 when you disconnect and reconnect keyboard/muse from USB port.
Qubes 4.1 only: You should also add the
usbcore.authorized_default=0
option, which prevents the initialization of non-input devices. (Qubes ships with a USBGuard configuration that allows only input devices whenusbcore.authorized_default=0
is set.)
All USB controllers except the ones listed in rd.qubes.dom0_usb will be hidden from dom0. But thatâs only if you want to use one of your USB controllers exclusively for dom0.
That is actually not what I want.
Got a couple of problems with Qubes at the moment. Can copy but not paste clipboard contents to AppVMs and can not update templates⌠probably have a typo in one of my rpc rules ďżź. Iâll be back with the journalctl output laterâŚ
edit: after fixing my qubes-qrexec-policy-daemon.service
, removing /etc/qubes/policy.d/50-sys-gui-stuff.policy
, removing the sys-gui-qubes and then unplugging followed by replugging usb-keyboard and usb-mouse did the trick. And they showed up in the journal as well:
qrexec: qubes.InputMouse+: sys-usb â @adminvm: allowed to dom0
and
qrexec: qubes.InputKeyboard+: sys-usb â @adminvm: allowd to dom0
Can not say for sure if this was due to the malfunctioning qrexec.service or the 50-sys-gui-stuff.policies
Itâs actually the opposite from security point of view:
Maybe if you have sys-usb that is only used specifically to pass USB keyboard and mouse to dom0 then it may have some meaning but Iâm not sure.
You AMAZING dude. I at least now have access to my keyboard again.