[qubes-users] Qubes-backup verify only verifies dom0, not appVMs

Mailing Lists qubes-users
1

When I verify my backups, it happens ~instantaneously. It used to take
hours, because it would extract every VM backup and verify it. Judging
by the logs, it's only verifying dom0.

Unless something has changed with how Qubes verifies its backups, there
may be a bug that causes verification to only check dom0, rather than
verifying the AppVMs as well.

This is really bad, because what I care about is the data in the
AppVMs... being able to restore the AppVMs is more important than being
able to restore dom0!

Here's how I back up:

nice qvm-backup \
	--verbose \
	--passphrase-file $PASSFILE \
	--exclude $IGNORE_VM \
	--dest-vm $DEST_VM \
	--compress \
	--yes \
	$BACKUP_DIR

And here's how I restore:

qvm-backup-restore \
	--dest-vm $DEST_VM \
	--passphrase-file $PASSFILE \
	--verify-only \
	--verbose \
	$BACKUP_FILE

When it starts restoring, it shows that none of my VMs will be restored,
except for dom0:
```
The following VMs are included in the backup:

2

I cannot seem to reproduce this. My verify-only attempts also verify domUs. I'm using the same qvm-backup-restore command, just without `--verbose`.

3

That's very strange. Are restore settings stored anywhere on the local
machine, like how VMs can have an "exclude from backups" option?

1 Like
4

It's possible to create "backup profiles," but I haven't personally used them, so I'm not familiar with the details of how they work. This option is mentioned in the `--help` text for qvm-backup but not qvm-backup-restore.

5

It looks like the profiles are stored in /etc/qubes/backup/. I checked
that directory and there are no profiles, so that can't be the problem.

Unfortunately at this point I'm all out of ideas for troubleshooting
this -- even though it's a very important issue! Unverified backups are
very dangerous, and I've caught problems before because backups failed
to verify.

6

tetrahedra:

And here's how I restore:

qvm-backup-restore \
	--dest-vm $DEST_VM \
	--passphrase-file $PASSFILE \
	--verify-only \
	--verbose \
	$BACKUP_FILE

When it starts restoring, it shows that none of my VMs will be restored,
except for dom0:

The following VMs are included in the backup:

------------------------+--------------+-------------------+-----------------+--------+
                   name |         type |          template |           netvm |  label |
------------------------+--------------+-------------------+-----------------+--------+
                   dom0 |      AdminVM |               n/a |       (default) |  black |
                   myvm | StandaloneVM |               n/a | my-net-vm-xxxxx | orange | <-- Excluded from restore
    my-other-vm-xxxxxxx |        AppVM |         debian-10 |       (default) |   blue | <-- Excluded from restore
          another-vm-xx |        AppVM |         fedora-33 |       (default) |  green | <-- Excluded from restore
	  [... continuing for the list of all VMs ...]

It acts as if you accidentally passed a whitelist of VMs to restore,
and none of them are part of the backup file. Some ideas:

- - If you posted a simplified version instead of the command you're
  really using, make sure there's no extra argument after the backup
  file

- - Use quoted shell variables, e.g. "$BACKUP_FILE" with quotation marks

- - Just to ensure that nothing's somehow tripping up the options
  parser, try using = instead of a space for option arguments, e.g.
  --dest-vm="$DEST_VM"

Rusty