Qubes Template updates not happening over Tor

I have Qubes installed on a few machines and both times I swear there was a check box to force all dom0 AND template vm updates over tor. But I noticed template vms were still using clearnet.

Looking at the /etc/qubes-rpc/policy/qubes.UpdatesProxy file I see “#Upgrade all TemplateVMs through sys-whonix” and “#$type:TemplateVM $default allow,target=sys-whonix”. This tells me that the TemplateVMs are NOT being routed over Tor and was not set that way during installation.

While the default rule for all template vms, has an uncommented “$type:TemplateVM $default allow,target=sys-net”.

So I would need to comment out the sys-net reference and uncomment the sys-whonix reference to force all updates, Template or dom0 over tor correct?

This seems like a thing that needs to be better indicated during install, or at least more visible. I get that updates over tor, especially tor over vpn, are very slow and boring. But I was running around thinking everything was fine because I clicked a check box, and I cant be the only one.

1 Like

Policies are parsed from top to bottom, and they stop at the first match, so you only have to uncomment the #$type:TemplateVM $default allow,target=sys-whonix line.

If you checked the box to route all updates over Tor, then that just sounds like a bug. You told the installer “do this” and it didn’t do it. I don’t see how that’s a visibility issue.

I don’t recall any other reports of that option not working. Are you sure that you actually checked the box? Did anything unusual happened during the installation process?

Please consider submitting a bug report with this information:

1 Like

On both of the machines I looked at I selected “update over tor” during install and in both cases, they did not update the qubes.UpdatesProxy file to update templates over tor. Dom0 in both cases did use Tor for updating, but Templates remained using sys-net. Fixing the qubes.UpdatesProxy file manually pushed all updates over sys-whonix.

I dorked up one install today something fierce so I will reinstall Qubes again and report back.

I probably never looked much into it before because I also had a vpn. But for one install I need to use a clearnet connection so it was more obvious.

Reinstalled, same thing, looks like dom0 does update over sys-whonix. Template VMs do not become set to update over sys-whonix unless it is manually done. I will do a bug report. People like myself might naively not know this is not happening as intended.