Opening files in dispvm denied, despite having a policy which allows it

User Support General
1

I try to open files in a disposable VM (named or normal disposable) from the personal qube. When I try to do it, I get a notification:
Denied qubes.OpenInVM from personal to @dispvm:dvm-offline, but /etc/qubes/policy.d/30-user.policy already contains a line
qubes.OpenInVM * personal @dispvm:dvm-offline allow. It gets triggered by the line Exec=qvm-open-in-vm --view-only -- @dispvm:dvm-offline %u in a .desktop file in the personal qube. Does anyone know why this is not working?

1 Like
2

Just to double check, dvm-offline is a disposable template, right? If it is a named disposable instead, the @dispvm: prefix should be omitted in the qvm-open-in-vm invocation and in the policy.

Other than that, there might be something interesting in the dom0 logs:

$ journalctl -u qubes-qrexec-policy-daemon
2 Likes
3

Try with target=@dispvm:dvm-offline at the end of the policy.

4

It was indeed a named disposable. Thx for the solution.

2 Likes
5

That would only be required if they were making a call to another destination (e.g. @default) and wanted it to be redirected. But since @dispvm:dvm-offline is already the destination in the qvm-open-in-vm call (resulting in qrexec-client-vm -- @dispvm:dvm-offline qubes.OpenInVM ...), it doesn’t need to be redirected.

2 Likes