Programming approaches to Alternative Appmenu icon effects, Setting default workspace per qube, Additional label colors

[alimirjamali]

Workspaces

Automatic workspace selection per VM is the last piece of the puzzle of this project. I have been hesitant to write it. Mostly because of two reasons. 1st of all, custom labels & custom icon effects worked nice for me personally. I barely required Workspaces to organize Qube Windows. Yet the major reason is something else. It is the never ending X11 to Wayland transition.

Technical overview

At the moment, Qubes OS uses the X Windows system to communicate window details between host and VMs. Qube Windows you see in dom0 or GUIVM do not have individual process IDs within dom0. They have X Window IDs. You could get a list of them with wmctrl -l or similar tools. Then you could get the detail of each Window by ID via xprop -id ID. This would reveal that Qubes attaches special _QUBES_VMNAME and some other very useful properties to each Windows. This is all done in qubes-gui-daemon. It is possible to iterate through list of Windows and send Windows belonging to specific Qube to desired Workspace. Or Maybe minimize them all. Or stack them on top of other windows. Or blink their Icons and Window borders… All of this could be done programmatically without necessity of external tools. It could be done via direct interaction with EWMH. There is even a ready to use Python library for that (even that is not needed). The Qubes icon-receiver daemon does something similar and could be an inspiration. Overall it is easy. I just wonder what this tool should be called. Perhaps qvm-workspace-tt?

Wayland drama

All of the above is going to break once Qubes OS fully transitions to Wayland. EWMH is strictly an X Windows system standard. If you want to have some background on Qubes OS X11->Wayland project, I would recommend you to watch Demi Marie Obenour’s presentation during Qubes OS Summit 2013. But I believe that it is not going to happen in short or even mid-term. Unlike the transition from Pulseaudio to Pipewire which was/is still trouble making, this one is going to make users and developers cry. Lots of things might break. Core tools or community tools (e.g. icon-receiver daemon, qvm-xkill, Qubes Video Companion, …). Pipewire was introduced just 6 years ago. Wayland has been pushed for over 16 years. Even some users have published long articles against it. XFCE is not wayland ready yet but at least they have a roadmap (without any commitments). The last commit Demi did to qubes-gui-agent-wayland repository was 7 months ago. And she is overloaded. Up to the point that some of her projects are postponed and moved to the backlog. Yet we need Wayland. It will come to Qubes soon or later but will be inevitable.

So why do it

This will be my personal way of observing Qubes OS transition to Wayland. Since it is going to be an exciting procedure. I will write the qvm-workspace-tt tool in two front/back-end parts. One to intefact with user and the other to interact with compositor(s). And I will learn lots of new things.

[Tezeria]

thank you for all these explanations

[alimirjamali]

The GUI for label view/creation/deleting is not turning very impressive. But it works. Fedora 37 is limited to Gtk 3.0 which will be end-of-life as soon as Gtk 5 is introduced (not very far). Qt is not better as Qt5 is the last for Fedora 37. Since Marmarta et. al. are using Gtk, I would stick with it for this work. But I am not going to spend time to Picasso it.

p.s. If anyone is interested on learning PyGtk 3.0. this series of videos should be more than sufficient. I spend a weekend on watching it. And reading this guide.

[alimirjamali]

Ok. It is a much better now. Using Gtk Stacks and a custom header makes is nicer.

Users could select from Random selection of tinted Qute icons in Qute Bar tab.

Or select icons from ready-made community qube icons in Community Bar tab. This should be drag-and-drop rather than ugly buttons. But buttons will do for the time.

Some work on Qubes tab and Create Label tab and I should be able to upload it. I will rewrite the main CLI tool in Python while I am at it. I am not spending too much time. Mostly doing this for fun. Gtk is not bad in the end. But I wish if the next sys-gui or dom0 would support Gtk 5.0. But that is such a great wish that could not be fulfilled.

[quber]

Awesome! a “Watermelon” or Palestine-Qube would be nice too.

[Miguelmm8125]

I can’t understand how to install this. I got ~/bin/ created but and i used curl to get the Makefile and qubes-label-tt in there, if i run make install it returns a error, if i run qubes-labe-tt --help it says the command does not exist.

I see different install methods all over this post and im so confused, could you please create a install instructions for newbies with the right commands?

[alimirjamali]

@Miguelmm8125

I can’t understand how to install this. I got ~/bin/ created but and i used curl to get the Makefile and qubes-label-tt in there, if i run make install it returns a error, if i run qubes-labe-tt --help it says the command does not exist.

If you only need qubes-label-tt, you should make in executable as well. Do this:

chmod a+x ~/bin/qubes-label-tt

But if you need all of the project, do this:

1. Download the whole project as a zip file: https://github.com/alimirjamali/personal-qubesos/archive/refs/heads/main.zip
2. Copy the zip file to dom0 (instructions on how to copy files to dom0 is on Qubes OS website).
3. Extract the zip file somewhere in dom0
4. Go to project directory and run make install there.

I am going to make proper RPMs for easier installation. I have been working with Qubes OS core team on different projects recently. Building proper communication channel is an essential part of the project. My aim is to submit project in multiple parts for review before Qubes OS r4.3 launch.

[Miguelmm8125]

I just found out why I cant do it its cause something is broken after i updated dom0, basically i cant send file to it, the qvm-run comand always returns a error
“error:Could not find qubesd-query(1). is this running on dom0?
Please see --help for more information”
This is what happens when sending your files, i created a txt and wrote 1234 inside it and tried to send it and it returns “/home/user/test.txt” line 1:1234 command not found"

wtf and yes the command is right i have used it a ton of times before, have you ever seen anything like this? I cant find any post where this happened with anyone

[Miguelmm8125]

sudo systemctl qubesd returns active i dont understand

[Miguelmm8125]

nevermind im a dumbass, i removed cat from the command lol
newbie type shit ahahah thank you tho for the explanation

[alimirjamali]

In the meantime, I have developed a new effect for AppMenu and XFCE panel icons. I named it marker. I primarily use this effect for TemplateVMs. It makes xfce4-terminal icons belonging to TemplateVMs easily identifiable (pay attention to xfce panel on top of this screenshot):

[ddevz]

You are creating additional options for expressing information about individual qubes? This is great! Of course, not everyone will be excited to adding code from a unknown source to their system. Are you working with the qubes team to see if you can get your additions into the main distribution (I.E. making a github pull request for it)?

A long time ago, someone had a great proposal of making some of the labeling for automatic things, like what networking qube it is plugged into, or disposable vm vs non-disposable (which is already expressed in the qube name of disp####). I can’t find the exact comment, but I think it came from this discussion on what kinds of things we might want to express about individual qubes:

Picking a system for selecting colors/security labels for qubes

(Got good feedback already, so information from comments responding to this post have been added to this post) Definition of “security labels”: For this document, I’ll refer to all the types of important security related information that would be good to be known about a qube when making decisions about it as “security labels” (colors will be one way of expressing that information) What we want to express: Some information we might need to convey through the security labels is How vulnerab…

@alimirjamali

BTW, does anyone read these posts? Sometimes I feel that I am just talking to myself here.

A little late, but I definitely have and am interested in this.
Overall, what methods do we have for expressing labels? The ones I see are:

• Window frame background color (I believe text is always black except for dom0 which is grey)
  • Is colored text in a window frame a option?
• Icon
  • Color Tint (current qubes official way)
  • Colored border
  • Colored background
  • (You have expanded the window border and added the launching icon for each program, so that icons can be seen in window frame for running programs. This means we have the same way to recognize things from launch menu and while running)
• Name of the qube
  • I suspect the answer is no, but does anyone know if it would be possible to express non-centered text in a window frame? For example:

Window1:

[[RAM based disposable]]............................[disp1234] user@disp1234` ~/.ssh…

Window2:

[[disk based disposable]]............................[disp5678] user@disp5678` ~/.ssh…

Or maybe:
Window1:
[[Tor network]]............................[disp1234] user@disp1234` ~/.ssh…

Window2:
[[No network]]............................[disp1234] user@disp1234` ~/.ssh…

Window3:
[[Full internet]]............................[disp1234] user@disp1234` ~/.ssh…

Window3:
[[Whitelisted internet]]............................[disp1234] user@disp1234` ~/.ssh…

(whitelisted internet would be something that only connects to your bank, or something like that, probably just the name of the network VM)

(The fire emoji is my attempt to simulate the firefox logo

(it would be cool if “RAM based disposable” could be a different color then the rest of the window frame text)

Anyway, am i missing anything?

Also note, your link is broken, you may want to update it to go to: personal-qubesos/qubes-label-tt at main · alimirjamali/personal-qubesos · GitHub

[alimirjamali]

@ddevz

You are creating additional options for expressing information about individual qubes? This is great!

Thanks. I am glad that you liked it.

@ddevz

Of course, not everyone will be excited to adding code from a unknown source to their system. Are you working with the qubes team to see if you can get your additions into the main distribution (I.E. making a github pull request for it)?

Sure. I have informed them about the existence of the projects. Like here and here.

@ddevz

Window frame background color, Is colored text in a window frame a option?
Name of the qube, would be possible to express non-centered text in a window frame? For example:

Those are done in qubes-gui-daemon. A relatively complex mechanism written in C language. All of it might change in near feature if Wayland support is finally implemented.

[ddevz]

@alimirjamali

Sure. I have informed them about the existence of the projects. Like here and here.

Great. And I see what you mean. It looks like anytime you join the conversation the conversation dies.

@alimirjamali

Those are done in qubes-gui-daemon. A relatively complex mechanism written in C language. All of it might change in near feature if Wayland support is finally implemented.

That’s a good point.

oOo. seeing what you did in your Appmenu Favorite tab demo, if a big icon can be next to a small icon, that opens possibilities.

The way I’m seeing it, Ideally each user would need to pick the dimensions that mean the most to them. (by dimensions I mean like “dimension 1: qube type (AppVM vs DispVM vs DIspTemplateVM vs Serivce VM vs Standalone vs TemplateVM)”, “diemension 2: network type (full internet, vs tor, vs none, vs custom whitlistings)”, “dimension 3: data sensitivity type (banking level data vs facebook level data vs the code your about to post to github anyway level data)”. of course that one can get broken into data confidentiality, vs data integrity. Another dimension would be how risky of software you have installed in a particular qube. another dimesion would be attack vectors (like sys-net and sys-usb). You get the idea.

Then you would map those to whatever orthogonal dimensions we have to express the labels of things (like window frame color, icon tinting, icon background, graphical layout of the icon (like the new icon options you added),

I think that any enhancements should by default come disabled. The learning curve on Qubes is brutal enough already . Of course, I’ve already seen a tendency for the qubes community to respond to questions with “what’s your threat model?”, which while it’s a valid question, it implies that random end users should generate a formal threat model before they look to see if qubes has anything to offer them.

So in other words, for defaults, we’d want to leave things as close as possible to how they are now, with a way for people to break open all the new options after they got over the initial qubes learning curve.

Actually, having a out of tree (I.E. not part of the qubes code) threat modeling software running in a VM that people could use that could end with recommending qubes configurations to people might be helpful, but I guess one step at a time. heh

[SteveC]

@ddevz

Of course, I’ve already seen a tendency for the qubes community to respond to questions with “what’s your threat model?”, which while it’s a valid question, it implies that random end users should generate a formal threat model before they look to see if qubes has anything to offer them.

Really, all they want to know when they ask this is how powerful/capable the people you’re trying to protect yourself from, are. So no need for anything formal; you can just say “hacker living in his mom’s basement” or “state police agency” or anything in between.

[ddevz]

@SteveC

Really, all they want to know when they ask this is how powerful/capable the people you’re trying to protect yourself from, are. So no need for anything formal; you can just say “hacker living in his mom’s basement” or “state police agency” or anything in between.

Hmm, perhaps I was inferring their intention of the question wrongly. (Possibly caused by imagining the wrong inflection/voice tone when I would read someone asking it to another user.

[Melanie]

How can I install the whole thing on my computer?
I have the QubesOS version: R4.2.3, Kernel: 6.6.48-1
Is there a page on how to install something like this on your computer?

Wie kann ich das ganze nachinstallieren auf meinem Computer?
Ich habe die QubesOS Version: R4.2.3, Kernel: 6.6.48-1
Gibt es da eine Seite, wie man sowas auf seinem Computer installiert?

[alimirjamali]

@Melanie

How can I install the whole thing on my computer?

Download it as a zip file:
https://github.com/alimirjamali/personal-qubesos/archive/refs/heads/main.zip

Copy the zip file to dom0 (here is the help page).

Unzip. Go to directory. Type make install

Sample icons and labels could be individually installed from icons directory. Type make info in that directory for additional help.

Disclaimer: This software is not yet reviewed by core Qubes OS developers. It is intended to be used and reviewed by advanced users who could understand how it works. It may have bugs.

[Melanie]

How do I get this zip file into the Dom0?
What is the name of the command line in the terminal?
Do I still have to install the zip file opener in Dom0 or is it already in Dom0?

[parulin]

Given your questions, I don’t think it’s a good idea for you to use it …

@alimirjamali

It is intended to be used and reviewed by advanced users who could understand how it works.