qubes.UpdatesProxy not updating everything over Tor

[adw]

@anon3066456

You seem to know more about the policy files than anyone here

@anon3066456

Your post solved it but I’m just trying to verify with ADW since he’s a part of the Qubes team.

@enmus

I’m finding the proof in that @adw reacted on your wrong comprehension of his words, and on nothing else in this topic.

I appreciate the vote of confidence, guys, but I’m not a technical authority. I’m basically just a user/enthusiast who has been using Qubes for a decently long time and who happens to work on the project as community manager and volunteer website and doc maintainer. There are many folks here who are far more knowledgeable than I am about technical matters. Also, when I don’t comment on something, that shouldn’t be taken as an indication of anything. It probably just means I don’t know about it, didn’t see it, or have no opinion on it.

@anon3066456

My only real goal is to be certain that the whonix templates go through Tor for updates. So just for clarification: As long as the “/etc/qubes/policy.d/90-default.policy” file has the “Upgrade Whonix TemplateVMs through sys-whonix” and “Deny Whonix TemplateVMs using UpdatesProxy of any other VM” commands uncommented, and also has those same commands in “qubes.UpdatesProxy”, it should always go through Tor for whonix template updates right?

I don’t know the details of the new system in Qubes 4.1, but my understanding is that these three rules, in this order, in /etc/qubes-rpc/policy/qubes.UpdatesProxy, in Qubes 4.0, are sufficient to ensure that all Whonix VMs are updated through sys-whonix and only through sys-whonix:

@type:TemplateVM	    @default	allow,target=sys-whonix
@tag:whonix-updatevm	@default	allow,target=sys-whonix
@tag:whonix-updatevm	@anyvm		deny

I don’t see why the same wouldn’t hold in Qubes 4.1 in the new unified policy file, but I can’t say with certainty that it does.

@anon3066456

And does it matter if I keep it $ on there or change it to @ like on the first file?

As already explained above, both types of syntax are supposed to be compatible in Qubes 4.1. As stated here:

In all client tools, $ will still be automatically translated into @, so you don’t have to change any existing scripts. However, we highly recommend using only @. Legacy support for $ will continue throughout the Qubes 4.x series and end in Qubes 5.0.

@anon3066456

I understand that “/etc/qubes-rpc/policy/” is now the older version of “/etc/qubes/policy.d/” but it’s still in the filesystem and has an effect on updates, so making sure everything is right in “/etc/qubes-rpc/policy/” is recommended as well right?

All I know is what’s stated here:

One of the new policy files is 35-compat.policy. It loads the old policy files and parses them in a way compatible with the new policy format.

I interpret this as meaning that the answer to your question is “yes.” At any rate, I can’t see how it would hurt to ensure that the rules in the new and old policy files match.