Denied: qubes.UpdatesProxy in Debian 12/13 Template

User Support General
1

I reorganized my PC today and installed fresh Debian 12 and 13 Template.
I updated Debian 13 and installed some software.

But out of nowhere (after i restart i think but not sure) I get this error message when i try to update the Debian 12 or when i use apt install: Denied: qubes.UpdatesProxy (it appears a lot, enough to cover about 80% of my screen in dom0 notifications) same with the Debian 13 now.

I am no longer able to update or download anything in this Template but i don’t have this problems in my Fedora 43 Template after testing.

Do you have any idea how to fix this?
I am on 4.3

If you need more info tell me.

thank :slight_smile:

2

Policies are to be found under /etc/qubes/policy.d (in dom0)
The default policy in 90-default.policy allows all templates to connect
to sys-net, the default update proxy.
If you have not installed any software in dom0, changed glocal settings,
or edited the policy files I cannot explain why your debian templates
no longer conform to the default policy.

Open the Qubes global config, select “Updates” and scroll down to
“Update proxy” - Make sure there are not exceptions entered there. Id
there are, delete them.
if that does not solve the issue, note the default update proxy, and
create a file at /etc/qubes/policy.d/30-updates.policy: with this
content.

qubes.UpdatesProxy	*	debian-12	@default	allow target=UPDATE_PROXY
qubes.UpdatesProxy	*	debian-13	@default	allow target=UPDATE_PROXY

replace UPDATE_PROXY with the name of the default update proxy.

This should solve the issue but it will not explain why it has
arisen.

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

3

I have the same error after trying your fix. Here is the error my Debian 13 template give me in the terminal:

Error: Failed to fetch https://deb.debian.org/debian/dists/trixie/InRelease  Reading from proxy failed - read (115: Operation now in progress) [IP: 127.0.0.1 8082]
Error: Failed to fetch https://deb.debian.org/debian-security/dists/trixie-security/InRelease  Reading from proxy failed - read (115: Operation now in progress) [IP: 127.0.0.1 8082]
Error: Failed to fetch https://deb.qubes-os.org/r4.3/vm/dists/trixie/InRelease  Reading from proxy failed - read (115: Operation now in progress) [IP: 127.0.0.1 8082]
Error: Failed to fetch https://updates.signal.org/desktop/apt/dists/xenial/InRelease  Reading from proxy failed - read (115: Operation now in progress) [IP: 127.0.0.1 8082]
Error: Failed to fetch https://download.vscodium.com/debs/dists/vscodium/InRelease  Reading from proxy failed - read (115: Operation now in progress) [IP: 127.0.0.1 8082]
Error: Some index files failed to download. They have been ignored, or old ones used instead.
4

Do you have a file in the /etc/qubes/policy.d/ directory, starting by 30- or less and containing a line starting with qubes.UpdatesProxy?

Is this a fresh install of Qubes 4.3?

5

@oliviaw
Run this command in /etc/qubes/policy.d :
grep -r UpdatesProxy

Post the output.

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

2 Likes
6 
30-updates.policy:qubes.UpdatesProxy      *       debian-12       @default        allow target=sys-whonix
30-updates.policy:qubes.UpdatesProxy      *       debian-13       @default        allow target=sys-vpn
50-config-updates.policy:qubes.UpdatesProxy	*	debian-12	@defaultallow target=sys-whonix
50-config-updates.policy:qubes.UpdatesProxy	*	@tag:whonix-updatevm	@default	allow target=sys-whonix
50-config-updates.policy:qubes.UpdatesProxy	*	@type:TemplateVM	@default	allow target=sys-vpn
90-default.policy:#qubes.UpdatesProxy     *    @type:TemplateVM        @default    allow target=sys-whonix
90-default.policy:qubes.UpdatesProxy      *   @tag:whonix-updatevm    @default    allow target=sys-whonix
90-default.policy:# Deny Whonix TemplateVMs using UpdatesProxy of any other VM.
90-default.policy:qubes.UpdatesProxy      *   @tag:whonix-updatevm    @anyvm      deny
90-default.policy:qubes.UpdatesProxy      *   @type:TemplateVM        @default    allow target=sys-net
90-default.policy:qubes.UpdatesProxy      *   @anyvm                  @anyvm      deny
7

Some interesting find!
I updated my Whonix VM using the Qubes os GUI and I get this in the details for Whonix:

Fail to refresh InRelease: tor+https://deb.kicksecure.com bookworm InRelease from tor+https://deb.kicksecure.com/dists/bookworm/InRelease
Fail to refresh InRelease: tor+https://deb.whonix.org bookworm InRelease from tor+https://deb.whonix.org/dists/bookworm/InRelease
Fail to refresh InRelease: tor+https://fasttrack.debian.net/debian-fasttrack bookworm-fasttrack InRelease from tor+https://fasttrack.debian.net/debian-fasttrack/dists/bookworm-fasttrack/InRelease
Fail to refresh InRelease: tor+https://deb.debian.org/debian bookworm InRelease from tor+https://deb.debian.org/debian/dists/bookworm/InRelease
Fail to refresh InRelease: https://deb.qubes-os.org/r4.3/vm bookworm InRelease from https://deb.qubes-os.org/r4.3/vm/dists/bookworm/InRelease
Fail to refresh InRelease: tor+https://deb.debian.org/debian bookworm-updates InRelease from tor+https://deb.debian.org/debian/dists/bookworm-updates/InRelease
Fail to refresh InRelease: tor+https://fasttrack.debian.net/debian-fasttrack bookworm-backports-staging InRelease from tor+https://fasttrack.debian.net/debian-fasttrack/dists/bookworm-backports-staging/InRelease
Fail to refresh InRelease: tor+https://deb.debian.org/debian-security bookworm-security InRelease from tor+https://deb.debian.org/debian-security/dists/bookworm-security/InRelease
Fail to refresh InRelease: tor+https://deb.debian.org/debian bookworm-backports InRelease from tor+https://deb.debian.org/debian/dists/bookworm-backports/InRelease
8

My problem just fixed itself and i don’t know how.
I just got a notification that a Debian 13 update was available and I just update the template with no problems.
This is a mystery so if you have any clues I’ll take it. If you need more info to help understand what happened tell me.

1 Like