Qubes policies packges or scripts - how to reinstall/regenerate?

User Support General
,
1

Hi!

It looks like I almost lost all of the default policies scripts in dom0 (in /etc and /srv).

Is there a way to reinstall them (which packages?) or a script to regenerate them?

Thanks a lot for your help!

(For the meantime, I’m using my own policies, but it’s not really efficient to discover missing policies when you need it…)

2

I am not sure how you would get them back.

What I can suggest you, firsthand, is to consider to manually copy /etc, /srv and /usr directories to /home, so next time you make a backup, you will have them there. But sometimes, the only working domain would be dom0, so you wouldn’t be able to reach backup, yet still you would have them in your home directory.

3

It’s good advice. Before I make a backup I run a dom0 snapshot script that copies to somewhere in ~ all the paths listed here:

It’s been helpful to me for cases like this. :+1: Sorry for your loss.

4

Or is it? If the policies comes from a package, they are owned by it.

I have the following packages installed on my test machine which owns policies:

% rpm -qf /etc/qubes/policy.d/{*,/include/*} | grep -v 'not owned' | sort -u

qubes-core-admin-addon-whonix-4.3.7-1.3.fc41.noarch
qubes-core-dom0-4.4.0-1.39.fc41.noarch
qubes-core-dom0-linux-4.4.1-1.10.fc41.x86_64
qubes-core-qrexec-dom0-4.4.2-1.13.fc41.x86_64
qubes-gui-dom0-4.3.15-1.4.fc41.x86_64
qubes-pdf-converter-dom0-2.1.26-1.19.fc41.noarch
qubes-video-companion-dom0-4.3.3-1.6.fc41.noarch

Reinstall each one of them:

sudo qubes-dom0-update --action=reinstall PKG

Where PKG is the list of packages from above, just the name (version not necessary). E.g.: qubes-core-qrexec-dom0-4.4.2-1.13.fc41.x86_64 becomes qubes-core-qrexec-dom0.

5
Better answer, just above...

I’m sure there are better ways to do that but in dom0, you can use rpm --queryformat to get some information about your files, if you still have them. I.e.:

rpm --queryformat /etc/qubes-rpc/*

This is the list of potential packages to reinstall. I don’t know if it’s a good idea, though. You might try to just download the packages and select the files you want.

qubes-core-dom0-4.3.46-1.fc41.noarch
qubes-core-dom0-linux-4.3.21-1.fc41.x86_64
qubes-core-qrexec-4.3.12-1.fc41.x86_64
qubes-core-qrexec-dom0-4.3.12-1.fc41.x86_64
qubes-desktop-linux-common-4.3.1-1.fc41.noarch
qubes-gui-daemon-4.3.15-1.fc41.x86_64
qubes-input-proxy-receiver-1.0.46-1.fc41.x86_64
qubes-notification-daemon-1.0.10-1.fc41.x86_64

With /srv/**/* have this:

qubes-mgmt-salt-base-4.3.2-1.fc41.noarch
qubes-mgmt-salt-base-config-4.1.2-1.fc41.noarch
qubes-mgmt-salt-base-topd-4.3.3-1.fc41.noarch
qubes-mgmt-salt-config-4.2.3-1.fc41.noarch
qubes-mgmt-salt-dom0-qvm-4.3.7-1.fc41.noarch
qubes-mgmt-salt-dom0-update-4.3.3-1.fc41.noarch

Another option to do that is to search the file name on Github (you need an account) or with a search engine. Then you have to use the git repo (and verify it) to get back the files…

6

Thanks to you @corporateblush! You just remind me I’m doing full backup right after system installation…
Thanks again!

7

Thanks for your concerne :slight_smile:

8

@ben-grande, I’ll try this first. Then use my backup if ever.

9

@ben-grande,
for the /srv/ directory, using your tips (french language : ‘aucun’ = ‘not owned’):

sudo tree -dfi /srv/ | xargs -I {} sudo rpm -q --path “{}” | grep -v ‘aucun’ | sort -u

Works like a charm!
Thank you very much

10

hmm… you can prefix the command with the C locale:

sudo tree -dfi /srv/ | xargs -I {} env LC_ALL=C sudo -E rpm -q –path “{}” | grep -iv ‘not owned’ | sort -u

To avoid having to discover the translation every time.