How to update disposable template using USB devices?

User Support General
1

Hi!

I recently deployed fedora-38 template, switch almost everything to it. But I’m stuck on updating the disposable VM template, I can’t change its base template if a DVM VM is running using it:

Cannot change template while there are running DispVMs based on this DVM template

Indeed, I need to keep sys-usb running, because my computer has USB keyboard and mouse, if I stop this VM, I can’t do anything with my computer except a not graceful power off.

How am I supposed to change the template for fedora-37-dvm ?

2

https://www.qubes-os.org/doc/templates/#switching

TLDR

[user@dom0 ~]$ qvm-shutdown --wait --all; qvm-prefs <SYS_USB_DISPOSABLE_TEMPLATE> template <NEW_TEMPLATE>; qvm-start <USB_QUBE>

e.g.

[user@dom0 ~]$ qvm-shutdown --wait --all; qvm-prefs sys-dvm template fedora-38; qvm-start sys-usb-dvm
1 Like
3

Thanks! :pray:

I should have read it again, I went through this guide for my laptop, and did the same from memory on the desktop but I forgot about this part :woman_facepalming:

1 Like
4

This question has come up a few times.
You can, of course, create a new disposable template using the fedora-38
template, then switch to that, rather than updating your existing
disposable template. I prefer this approach as long as the disposable
templates are versioned: this was you end up with
disposable-template-37 using fedora-37.

I use a simple script in this sort of case that you can adapt.

#!/usr/bin/bash

qvm-shutdown sys-usb
sleep 10
qvm-prefs sys-usb template <NEW_TEMPLATE>
qvm-start sys-usb

## Delete this section after testing
sleep 120
qvm-shutdown sys-usb
sleep 10
qvm-prefs sys-usb template <OLD_TEMPLATE>
sleep 5
qvm-start sys-usb
## Delete this section after testing

You can adjust the sleep times to fit your box - the sleep 120 is to
give you time to test using the new template - change as you will.

When you are sure everything is working fine, delete the second section
and run the script again.

I never presume to speak for the Qubes team. When I comment in the Forum or in the mailing lists I speak for myself.
2 Likes
5

$ qvm-shutdown --wait --all; qvm-prefs <SYS_USB_DISPOSABLE_TEMPLATE> template <NEW_TEMPLATE>; qvm-start <USB_QUBE>
Bold to assume that the transition will be bug free, and will work in
every case. And why shutdown all qubes?
If that’s in the docs it should have a health warning.

I never presume to speak for the Qubes team. When I comment in the Forum or in the mailing lists I speak for myself.
2 Likes
6

Indeed your advice with your script is a very nice one.

Yes, I have just copy/paste the doc.
I guess the qvm-shutdown --wait --all is in case the sys-dvm handles sys-net, sys-fw and sys-usb.
(not the case in the doc as it state <SYS_USB_DISPOSABLE_TEMPLATE>,
it could still be the same for all sys-* qubes, and shuting down only those ones are enought)

Personally, I just automate the whole thing.

Switch templates. 
qvm-shutdown --all --wait
change_template ()
{
    if [[ $# -ne 0 ]]
    then
        qvm-prefs $1 template $2
        change_template ${@:3}
    fi
}
change_template $(qvm-ls --field class,name,template \
    | sed -e '/^AppVM/ !d' \
          -e "/$os_name/ !d" \
          -e 's/^AppVM//' \
          -Ee "s/$os_name-[0-9]+/$os_name-$os_release/")

qvm-start \
    sys-usb-dvm \
    sys-net-dvm \
    sys-firewall-dvm

I didn’t think that the keyboard/touchpad/mouse could not work after switching.
I will definitly add a note about it when I will edit my fresh install guide.

1 Like
7

Agreed, but so far no one has contributed a better way to the documentation. A version of this command has been the officially-documented method for over three years.

Because if the user shuts down only the disposable template, then there could still be running disposables based on that disposable template, so the initial shutdown command will fail, which will cause all subsequent commands to fail, and the user will be left hopelessly confused as to why “it isn’t working.” You could instead say something like, “shut down the disposable template and all disposables based on it,” but some users will get lost at this point, because they don’t know which of their running disposables is based on the disposable template they need to shut down. (A lot of users probably don’t realize that their sys-firewall is disposable by default now, for example.) When “the instructions don’t work” again, we can try to explain how they’re not following them correctly, but it’s easier for everyone involved just to avoid all of that and simply provide one command that will work for everyone.

<SYS_USB_DISPOSABLE_TEMPLATE> just refers to the disposable template on which sys-usb is based, which could be the same disposable template as the one on which sys-net and sys-firewall (and others) are based. As a documentation author, you don’t know exactly how the user’s system is set up.

  1. It is, indeed, in the docs.
  2. As the new official documentation maintainer, I defer to you on how best to handle this. :slight_smile:
2 Likes
8

A few words to say it worked perfectly :+1: