Disable Qube updates for a specific qube

I would like to disable both update checks and updates for Windows 7 VMs because 1) Updates for Win 7 are no longer supported; 2) I want the Win VMs to be completely isolated from network. How do I do that?

Set the netvm to none.
Windows 7 qubes don’t participate in update checking.

In general, you can always disable checking on a per qube basis using
qvm-features QUBE service.qubes-update-check 0

I never presume to speak for the Qubes team.
When I comment in the Forum or in the mailing lists I speak for myself.

Set the netvm to none.

That is already set.

Windows 7 qubes don’t participate in update checking.

Then why running sudo qubesctl --show-output --skip-dom0 --templates state.sls update.qubes-vm starts the Windows 7 TemplateVMs?

In general, you can always disable checking on a per qube basis using
qvm-features QUBE service.qubes-update-check 0

That seems to disable only update check, not updates (which the above command seems to start for all domUs).

FWIW I also tried qvm-prefs <QUBE> updateable False but it tells me "property ‘updateable’ on TemplateVM instance cannot be set’ (for the moment I have only a Windows 7 TemplateVM).

Is there anything else I can do?

Because that is not update-checking, but updating actually, and of all templates as the command says?

I suggest that you look to see if the Windows 7 template is actually
updated.

I suggest that you look to see if the Windows 7 template is actually
updated.

It is not. It cannot be (as discussed here. Even if it could, I don’t want it to be (at least not automatically with all other VMs through the Salt formula). I would like it and its AppVMs to be explicitly network isolated.

How to do this?

This is answered

You don’t need to, since as you said, updates aren’t available for Windows 7 anymore, which you know:

Next one

This demand is absolutely unrelated to updating / update checking mechanism in Qubes. @unman already answered that this is achievable by setting netVM to none.
Qubes trying to update Windows 7 qube will NOT “un-isolate” it.

What network exactly?

So, your questions obviously aren’t formulated well, try with what goal exactly you are trying to achieve?

You don’t need to, since as you said, updates aren’t available for Windows 7 anymore, which you know:

The problem is that the update process starts the Windows 7 TemplateVM. I don’t want it to start as there is no need for that. That’s why I think it is necessary to block the updates for it. Hence the question.

What network exactly?

Any.

So, your questions obviously aren’t formulated well, try with what goal exactly you are trying to achieve?

Sorry for the confusion. I hope the clarification above is sufficient.

This is absolutely different from the topic’s subjects, and now it’s clear what is your goal.
Now what I don’t understand is, why do you think update process would start Win qube, unless you initiate it yourself specifically in terminal? If you use Qubes Update Tool, you’ll never get a notification to update Win qube, thus the qube won’t be started.

If you prefer to use typing instead of QUT, then I suggest you to create simple script with the argument targets= for the update where you would list all the qubes you’d like to be updated, name it update.sh and instead of typing whole command, run this one simple.

The other way might be this but I didn’t test if --skip-win-qube works as with --skip-dom0. I just have to much templates to list them all and I don’t have such a list. Please don’t say even if it works that it looks more like workaround. Neither --skip-dom0 looks like it isn’t when you want non-dom0 qubes to be updated, but you accepted it as is.

If you prefer to use typing instead of QUT,

That’s my preference, yes.

then I suggest you to create simple script with the argument targets= for the update where you would list all the qubes you’d like to be updated, name it update.sh and instead of typing whole command, run this one simple.

The problem with that approach is that creating/deleting/renaming qubes would require an update of that script too - something one may forget to do.

The other way might be this but I didn’t test if --skip-win-qube works as with --skip-dom0.

According to man qubesctl there is no such option.

I still hope there is a solution to this.

Well, I’m sure one day we’ll reach the point of giving voice command to Qubes.

Not sure of the relevance here,but this day is already here.

There is relevance actually. When we relate quoted words would require an update of that script too and forgot with voice commanding, then we hope someday we can give some voice commands to Qubes like

“Hello Qubes. I want to skip updates for this and that qube, because I’m lazy to keep on my mind maintaining my script”

or,

“Hello Qubes. I want you to maintain my scripts with newly added qubes”

That’s a level of semantic recognition beyond what is available.
You can have voice recognition and semantic recognition now.
One issue is that many of the best results come from offloading
processing to the cloud. Working with a locally installed engine is more
challenging, but still workable.
This is wildly off topic.

I never presume to speak for the Qubes team.


When I comment in the Forum or in the mailing lists I speak for myself.

Maybe, but as far as I am aware there’s no fourth solution to the topic.

You are Pythia without priests

2 Likes

Almost like oracle without erp, yep.

Hi @all,
I want to use a script to clone some templates for DR and disable update-check for them. When I use qvm-features, it adds a second update-service entry instead of updating the existing one:
DeepinScreenshot_select-area_20230806090159

Via Qubes Manager it works as espected. Unchecking the box in qube settings service tab removes the value for the update service.

I tried some workarounds, but with no success :confused: Any ideas on this?

qvm-features QUBE service.qubes-update-check 0
qvm-features QUBE service.qubes-update-check ' '
qvm-features QUBE service.qubes-update-check --delete   << it removes the duplicate, but not the original
qvm-features QUBE service.qubes-update-check --unset

My system: 5.15.94-qubes.fc32.x86_64

Thx & Regards,
hirschQ

Looks like a typo when running the qvm-features command.

In your screenshot @hirschQ you can see two distinct flags:

  • service.qubes-update-check (dot aftter the first word)
  • service-qubes.update-check (dot after the second word).

Next step is removing the meaningless flag and updating the other one again (this time with the correct name). :slightly_smiling_face:

Trying to figure out why I never receive an update notification unless a template is actually running (my workaround being to clone commonly used templates to what I call an update canary, and run that, with minimal memory), I saw this, and it’s one I can answer.

If you really want to just exclude one qube from updating, then you can create a script to do this, a bit more elaborate than was suggested. Have it run qvm-ls with whatever option gives you just a one-column list of qubes, set an array variable in your shellscript to the results of that, and loop. Inside the loop, check for the name of the template NOT being the name of your windows template. If it is not the same, go ahead and update.