Change sys VMs from disposable to non-disposable

User Support General
1

How can I change sys-usb and sys-firewall from disposable to non-disposable and base them on ordinary templates? There does not appear to be a way to do so by changing settings. All I can find in the on-line docs is how to go the other direction and, in the forum, only directions for sys-net. I expect that the two above will need some differences.

I’ve seen some info on deleting/recreating sys-usb but that involves mucking with boot parameters. And nothing on sys-firewall.

Background: I ordered a laptop wtih Qubes preinstalled and, for the first time in many years of doing so, the vendor went through the _complete_ process, rather than stopping after the first part and allowing me to choose the options in the second part.

2

I haven’t tried this, but here’s how I’d go about it in the Qube Manager.

  • Look for the sys-usb qube and under the Template entry identify its disposable template (dvm in the name).

  • Right click on the disposable template (dvm) entry and choose Clone Qube.

  • Right click on cloned qube and enter Settings. Under the Advanced tab, unclick Disposable template. Then go through all of the settings and reset any that do not match the settings for the existing sys-usb qube. The following will likely need changed: Advanced > Provides network, Virtualization Mode; Devices > Devices always connected to this qube.

  • In the existing sys-usb, unclick Start automatically on boot.

Possible I’ve missed something, so report back if this doesn’t work. Creating a non-disposable sys-firewall should require less modification of the cloned qube.

3

What @ephile explained + consider the qubes names in the policies. If you rename sys-usb and you have only a USB keyboard you may lock yourself out.

4

Thanks for your reply, but as I expected, none of this changes the state of sys-usb in any way whatsoever. Are these supposed to be directions for creating a replacement USB qube? There are a lot of places in the system where “sys-usb” is the designated one.

Possible I’ve missed something

  1. the nature of the question
  2. disconnecting USB controllers from the existing sys-usb…
5

I have no intention of renaming or replacing sys-usb short of a complete reinstallation. My question is how to change the status of the current qube.

6

I don’t think you got the responses properly. You already have such: it’s a template of a sys-usb.

What I don’t get here is what is your goal with this, not the step you want to make with this.

7

I don’t think you got the responses properly. You already have such: it’s a template of a sys-usb.

As received, sys-usb was based on default-dvm. The latter is not [just] a “template of a sys-usb”, it is also the template for sys-firewall and two pre-loaded disposables. It is not a USB qube.

What I don’t get here is what is your goal with this, not the step you want to make with this.

My goal, which I thought I made clear, is to end up with sys-usb and sys-firewall in the condition they would be in if the options to make them disposable had NOT been selected during installation (which was erroneously done by the vendor). That is, non-disposable and based on fedora-43-xfce. That is a technical question. Anything beyond that is not up for discussion, and I very much do not want this thread to be hijacked for such a discussion, as happens all too often.

Since I was prepared to do a full reinstallation if things went haywire, I experimented more with ephile’s approach.

After cloning default-dvm as testUSB (wouldn’t creating any AppVM on the desired template suffice?), I made the following changes:

in sys-usb Settings:
	Devices tab: removed the USB controllers. 
 (I have three and actually moved them one at a time
 across several boots to see the effects.)

in testUSB Settings:
	Basic:
		Net qube -> none
		Start on boot -> yes
	Advanced:
		Memory -> up to 400 MiB
		Balancing -> no
		Provides Network - yes
		Disposable Template -> no
		Virtualization -> HVM
	Devices:
		Always connected -> added the three controllers
		Clicked on "Configure strict reset" and selected all 3
	Applications:
		in App Menu -> ensured Thunar was included
			[to verify where USB drives get mounted]
	Services:
		Selected "network-manager" in the service drop-down,
			added it and turned it off
		Selected "minimal-usbvm" in the service drop-down,
			added it and turned it off
			[else drives don't mount, as noted elsewhere]

Renamed "sys-usb" as "exusb".
Renamed "testUSB" as" sys-usb".

Rebooted.

I then deleted “exusb”, but probably could have deleted it immediately instead of renaming it.

While I was doing all this, the USB mouse was indeed disabled until I could get to the Glocal config editor and enable it for testUSB. But if one does all this at once, it may work without a hitch.

My fear was that “sys-usb” would be present in numerous /etc policy files and that renaming it would either rename it or fail to rename it in any number of policy files, breaking stuff. Some things did get renamed or added (under the name “testUSB”), but since I ended up with a “sys-usb”, all the needed data seems to be there. I say “seems” because I don’t know what may be lurking in some as-yet-untouched corner.

But after enough reboots. the new “sys-usb” ended up with the icons for “service” VMs and in the “Services” section of the Application Menu. I have no idea what Qubes looks at to make that determination.

The USB page in Global config was happy to list two USB qubes while there were controllers attached to both and both were running.

The new Device Assignments page has one lingering difference. Instead of stating that device “dom0:00…X” is required for sys-usb to start (three lines, one for each controller), it now states that “Any pci device attached to” said device is required. So I do not think that I have achieved my stated goal, but if that’s the only difference, it will do.

Where else does sys-usb or any USB stuff appear in the Settings dialogs or config files?

As for sys-firewall, I created a new AppVM (“new-fw”) on fedora-43-xfce with sys-net as netVM and Provides Network checked. Then in Settings I bumped up its memory and turned off network-manager after selecting it in Services.

Renamed “sys-firewall” as"exfw" and “new-fw” as “sys-firewall”.

In Global config, I changed the default net cube and the dom0 update proxy, both of which had been changed to “exfw”. For the second one, the dialog looked like it would not accept the change, but it was there after closing and reopening the config editor.

Basic networking works but I have not tested anything else to do with that VM.

Where else does sys-firewall appear in the Settings dialogs or config files?

I believe that the answer to my quesion as posed is, “You can’t”. I did not achieve my aim of changing the VMs in place, but is this enough? I have no idea, being too unfamiliar with the innards of Qubes.

Re-installation might actually have been faster, with no data on the box yet, but for the moment I can proceed.

8

I am still convinced you didn’t get responses properly. Otherwise, you would recognize that I was just summarizing @ephile’s proposal. Otherwise, you would clone dvm template once again, this time for sys-fwall.

Stepping on a footstep cannot be a goal, not even a climbing footsteps could be. The goal is to achieve something with climbing. And when we know the goal, we could advise you then to use elevator instead, for example.

And you were just endangered your machine and Qubes by widening attack surface and using non-disposable.

I see your formatted text cut as quoted above, but I am sure this says that you added 3 controllers to a single, non-disposable, based on a fedora-43-xfce, networking qube.

And you were just endangered your machine and Qubes by multiple factor in addition with that. Wish you a luck with that.

You already told us without telling us. I was the one too, 10 years ago. But didn’t install Qubes until I was sure about each and every aspect about it. Hopefully, you will discover some day how bad your choice with this was, before it was too late.

Don’t mind my writing style, you’ll forget it: it’s better me to be wrong with being a bit harsh, then the things I am harsh about to happen. Regardless of I could bet they will.

9

Yes. I was working under the assumption that the choice of creating a disposable sys-usb was a “one-way door”. Would be interesting to learn if that’s not actually the case. IIRC a disposable sys-usb is now the default and the vendor didn’t actually choose anything, but I honestly don’t recall the default setup with the r4.3 iso. FWIW, my r4.2 machine’s sys-usb is disposable with the default-dvm template, so that’s probably been the default for awhile.

I handled this by suggesting to unclick the autostart option and figured the reader could handle it from there. @qubist was correct to point out qube names as well.

Cloning the disposable template and unclicking the disposable option is essentially revisiting the original install decision and creating a new appVM from there. In the end you’ll end up at the same place, but I was more pointing a general direction than trying to provide a step by step guide.

10

Status change is not possible. You need a separate AppVM and my remark was in regards to that because inevitably you have to deal with qube (re)naming as you have already seen.

11

We all have our own threat models and workflows. If it were as bad as you suggest, this wouldn’t be supported at all.

Well, leaving things at their default values is a choice, especially when the options are shown on screen. The relevant defaults are: disposable for sys-usb and sys-firewall, but not for sys-net.

Thanks for confirming that.

12

It’s not about them being there. It’s about how you use them. Kitchen knives are there in your kitchen drawer. It’s all about how you use them.

Sorry, I see I am wasting your time. I won’t anymore.