qubes.ConnectTCP policy bug/missconfig

Schnur · July 26, 2026, 9:23am

qubes.ConnectTCP +<PORT> @dispvm:<SOURCE-QUBE> @default allow target=<TARGET-QUBE> should allow me connecting me from any dispvm with source-qube as template to the dedicated port of the targeted qube. But it doesn’t. Is this a bug, did I do something wrong, do you know a work around?

Thank you in advance.

unman · July 26, 2026, 9:51am

How have you configured the connection in the SOURCE-QUBE, and have you
ensured the connection is being made in the disposables? How are you
creating the tunnel in the disposables?

Schnur · July 26, 2026, 10:10am

In my /rw/config/rc.local there is a oneliner: qvm-connect-tcp <Port>:@default:<Port>.
When after creation of the dispvm I manually set qubes.ConnectTCP +<PORT> DISPXXXX @default allow target=<TARGET-QUBE> it even works.

rustybird · July 26, 2026, 10:26am

I’m intrigued that @dispvm:<disposable template> is even intended to work in a policy source field - and apparently it is - but yeah it doesn’t actually work, for any RPC.

Please file a bug.

As a workaround, you could add a tag to the disposable template (inherited by the disposable) and match on that with @tag:foo. Unfortunately, @dispvm:@tag:foo is also broken if used in a source field.

marmarek · July 26, 2026, 12:04pm

Yeah, it isn’t supposed to work. See Qrexec: secure communication across domains — Qubes OS Documentation :

@dispvm means “new VM created for this particular request,” so it is never a source of request

Schnur · July 26, 2026, 12:11pm

Thanks, but then I wonder why the Policy Editor states so. And source code if I understand it correctly.

Is there any way to achieve something similar? @rustybird said tags are broken too.

marmarek · July 26, 2026, 12:23pm

You can use @tag: in a source field, it’s only the @dispvm keyword that isn’t supposed to work there.

rustybird · July 26, 2026, 12:37pm

Should it be rejected at the parser level then or is there a reason not to (in contrast to bare @dispvm without a disposable template and without a tag, which is rejected)? The test suite seems to want the current behavior:

github.com/QubesOS/qubes-core-qrexec

qrexec/tests/policy_parser.py

v4.4.2


      
          with self.assertRaises(exc.PolicySyntaxError):
              parser.Source("@dispvm")
          parser.Source("@dispvm:default-dvm")
          parser.Source("@dispvm:@tag:tag3")

marmarek · July 26, 2026, 1:11pm

See my comment in the issue ( @dispvm:<template> policy not working · Issue #11017 · QubesOS/qubes-issues · GitHub ). While I can see what it could be interpreted as (any disposable based on a specified template), yet that would be quite confusing, as it’s very different than what the same thing means in the target field (a new disposable, not any existing disposable based on a given template).