Was trying to use USB microphone, but sys-usb is disabled by default so I went through the documentation and installed it.
sudo qubesctl state.sls qvm.sys-usb
The USB was still working after said command. It was only until I powered off the machine it no longer was detecting my mouse or password. I can not enter password to decrypt. What should I do? Please and thank you Qubes Community
1 Like
add qubes.skip_autostart to kernel option when you in grub menu, so your kernel paramenter have something like ............rhgb quiet qubes.skip_autostart then f10 to boot
to modify kernel parameters, press e when you in grub menu.
6 Likes
Did you try the suggestion? Did you make any progress on this problem? I don’t know if I am having the same problem or not, but my usb mouse and KB work fine after install, until after my first reboot, then they won’t work at all.
What does that accomplish, @51lieal (because my problem seems a little similar but I am unsure what skipping autostart would do and a little afraid to modify kernel parameters)?
what happen before you do first reboot? create sys-usb ? if yes, what command.
it’s just telling to not start vm that automatically start, it’s safe and it’s not permanent (only for that boot), because we don’t write it, in grub config.
Thank you.
I installed Qubes 4.1, it boots, I plug in my mouse and click OK and the mouse works. I edit the Input.Keyboard file and plug in my keyboard and it works. Both through sys-usb but working in every Qube automatically without attaching (which seems like a security risk?).
However, then if I boot again, mouse and KB won’t work in dom0 or anywhere. It will say device name available when they are plugged in, but they won’t attach. It says QubesException device attached failed: but then it doesn’t provide a more specific error for why it won’t attach.
that mean you create sys-usb at initial setup ? what’s the policy inside input.keyboard and mouse? did you enable no-strict-reset ?
1 Like
sys-usb was automatically created for me and it was already running also.
Input.Keyboard has:
sys-usb dom0 allow
usbcore.authorized_default=0
$anyvm $anyvm deny
Input.Mouse I didn’t edit from the default, it has:
sys-usb dom0 ask,user=root,default_target=dom0
$anyvm $anyvm deny
Of course I am not using Qubes as a root user.
I didn’t enable no-strict-reset, I have tried to read all threads and documents. I have not heard of this before.
if you hadn’t do any changes, then :
boot qubes with kernel parameters i mention above (if keyboard and mouse not working)
- remove all line in input.keyboard and mouse except
$anyvm $anyvm deny - run
sudo qubesctl state.sls qvm.usb-keyboard
then reboot, you should be able to use keyboard, and after login screen there’s a notification to confirm if mouse is allowed or not.
for futher documentation, read this. USB qubes | Qubes OS
read it 2 - 3 times, to fully understand about sys-usb.
1 Like
Thanks, I have done these steps and the mouse and keyboard work.
However, I was not prompted after plugging in the mouse or keyboard (or later I tried my usb hub). It seems insecure?
I have read the documentation about usb many times, but I think I am not understanding part of it.
I planned to type my password(s) on the built-in laptop keyboard (never usb keyboard) for security.
However the methods in the documentation didn’t work as you know, I could not get the keyboard or mouse to work at all.
Most of the modern laptop internal keyboard using usb connection, just add this kernel parameters in grub rd.qubes.hide_all_usb see if you can enter luks password or not. if it doesn’t work, that mean your pc is using usb.
Similar problem here… I have created a sys-usb with
sudo qubesctl state.sls qvm.usb-keyboard
and added
sys-usb dom0 allow
as first line in
/etc/qubes-rpc/policy/qubes.InputKeyboard and qubes.InputMouse
Fortunatly my build-in keyboard and trackpad work. However, my external usb-keyboard and usb-mouse connected with a small docking-station do not. They are recognized and displayed by sys-usb (sys-usb:4-4.1 and sys-usb:4-4.2) but not attached to dom0 (and can’t be attached to dom0).
I’ve experimented with installing sys-gui and sys-gui-gpu, are not using either of them for the time being, and wonder if there are remnants in the configs pointing my devices towards sys-gui or sys-gui-gpu but those qubes are not running and since my build-in keyboard and trackpad are working, I consider this unlikely.
I’ve read USB qubes | Qubes OS - not sure if I understood the section “Qubes 4.1: How to enable a USB keyboard on a separate USB controller” - can anybody confirm that and WHY one has insert usbcore.authorized_default=0 and rd.qubes.dom0_usb=<BDF> to grub’s CMDLINE? Both relevant PCI devices (‘00:14.0 USB controller Intel barfoo’ and ‘3c:00.0 USB controller Thunderbird foobar’) are attached to or selected for sys-usb.
You can check journalctl to see if your keyboard/mouse will be attached to dom0 when you disconnect and reconnect keyboard/muse from USB port.
Qubes 4.1 only: You should also add the
usbcore.authorized_default=0option, which prevents the initialization of non-input devices. (Qubes ships with a USBGuard configuration that allows only input devices whenusbcore.authorized_default=0is set.)
All USB controllers except the ones listed in rd.qubes.dom0_usb will be hidden from dom0. But that’s only if you want to use one of your USB controllers exclusively for dom0.
That is actually not what I want.
Got a couple of problems with Qubes at the moment. Can copy but not paste clipboard contents to AppVMs and can not update templates… probably have a typo in one of my rpc rules . I’ll be back with the journalctl output later…
edit: after fixing my qubes-qrexec-policy-daemon.service, removing /etc/qubes/policy.d/50-sys-gui-stuff.policy, removing the sys-gui-qubes and then unplugging followed by replugging usb-keyboard and usb-mouse did the trick. And they showed up in the journal as well:
qrexec: qubes.InputMouse+: sys-usb → @adminvm: allowed to dom0
and
qrexec: qubes.InputKeyboard+: sys-usb → @adminvm: allowd to dom0
Can not say for sure if this was due to the malfunctioning qrexec.service or the 50-sys-gui-stuff.policies
It’s actually the opposite from security point of view:
Maybe if you have sys-usb that is only used specifically to pass USB keyboard and mouse to dom0 then it may have some meaning but I’m not sure.
You AMAZING dude. I at least now have access to my keyboard again.