Qubesd failed to start after removing deny rule in qubes-global-config/Device Assignment

I installed via

qubes-dom0-update qubes-video-companion-dom0

This triggers an qubesd restart

Which failed

I‘m on the current 4.3 with all updates in dom0 latest kernel

This breaks my system, w/o qubesd no qvm will start

Error Message:

Any ideas what can I do?

I also tried to uninstall.
Check the created policy files
And so on.

Btw: qubes-video-companion-dom0 was updated yesterday with a new versions string:
4.3.2

Pulled and installed was 4.3.1

EDIT:

the reason was not the installation of qubes-video-companion (this triggers only the qubesd.service restart)
the root cause was removing a “devices_denied” Rule in the qubes-global-config/Device Assignment

I´ve updated the title of this thread

No one who can help?

What I’ve checked/done till now:

  • checked /var/lib/qubes/qubes.xml

    • file is not empty and seams to be consistent
  • Review Documentation to qrexec.

    • Found no hints where else to look
  • Review the files:

    • /usr/lib/python3.13/site-packages/qubes:

      • no Changes to files in this folder since installation of system
    • device_protocol.py

      • Checked the code lines mentioned in the error message, but my python knowledge is not so good to understand at which points the variables are filled.

So what is the source of the variable Interfaces?
Is it qubesvm.py get the information via

import qube.config

All informations I found are related to /var/lib/qubes/qubes.xml

So I,v done one ‚shot in the blue‘ and recover the backup of /var/lib/qubes/qubes.xml which was done round about 1 hour before i installed qubes-video-companion.

After that i was able to restart qubesd
Puhhh well, that’s makes me happy again.
And now the interesting part:

The only change I,ve done was:

to remove a policy via qubes-global-config gui

Now, back on my systems here the technical details:

I had following Rule implemented:

the diff shows, after removing this rule, the property “devices_denied” is empty in

/var/lib/qubes/qubes.xml

<         <property name="devices_denied">b******m******p01****p03****p04****p0401**p0403**p0408**p09****p0903**p0d11**u01****u03****u06****u07****u08****u0b****u0e****u10****ue00101</property>
---
>         <property name="devices_denied"></property>

And the issue is reproduced:

Feb 13 11:24:55 dom0 qubesd[9181]:   File "/usr/lib/python3.13/site-packages/qubes/app.py", line 1040, in __init__
Feb 13 11:24:55 dom0 qubesd[9181]:     self.load(lock=lock)
Feb 13 11:24:55 dom0 qubesd[9181]:     ~~~~~~~~~^^^^^^^^^^^
Feb 13 11:24:55 dom0 qubesd[9181]:   File "/usr/lib/python3.13/site-packages/qubes/app.py", line 1135, in load
Feb 13 11:24:55 dom0 qubesd[9181]:     vm.load_properties(load_stage=2)
Feb 13 11:24:55 dom0 qubesd[9181]:     ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^
Feb 13 11:24:55 dom0 qubesd[9181]:   File "/usr/lib/python3.13/site-packages/qubes/__init__.py", line 757, in load_properties
Feb 13 11:24:55 dom0 qubesd[9181]:     setattr(self, name, value)
Feb 13 11:24:55 dom0 qubesd[9181]:     ~~~~~~~^^^^^^^^^^^^^^^^^^^
Feb 13 11:24:55 dom0 qubesd[9181]:   File "/usr/lib/python3.13/site-packages/qubes/__init__.py", line 276, in __set__
Feb 13 11:24:55 dom0 qubesd[9181]:     value = self._setter(instance, self, value)
Feb 13 11:24:55 dom0 qubesd[9181]:   File "/usr/lib/python3.13/site-packages/qubes/vm/qubesvm.py", line 146, in _setter_denied_list
Feb 13 11:24:55 dom0 qubesd[9181]:     sorted(map(repr, set(DeviceInterface.from_str_bulk(value))))
Feb 13 11:24:55 dom0 qubesd[9181]:                          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^
Feb 13 11:24:55 dom0 qubesd[9181]:   File "/usr/lib/python3.13/site-packages/qubes/device_protocol.py", line 763, in from_str_bulk
Feb 13 11:24:55 dom0 qubesd[9181]:     raise QubesValueError(
Feb 13 11:24:55 dom0 qubesd[9181]:     ...<2 lines>...
Feb 13 11:24:55 dom0 qubesd[9181]:     )
Feb 13 11:24:55 dom0 qubesd[9181]: qubes.exc.QubesValueError: Invalid length of interfaces='None' (is 4, expected multiple of 7)
Feb 13 11:24:55 dom0 systemd[1]: qubesd.service: Main process exited, code=exited, status=1/FAILURE

can somebody please do the same and confirm?
Steps to reproduce:

  1. add a rule “Device Attachment Policy”
  2. delete this rule again
  3. check /var/lib/qubes/qubes.xml if this line exist in description of the related qvm:
      <property name="devices_denied"></property>
    
  4. restart qubesd at dom0; sudo systemctl restart qubesd

The qubesd should fail to start

To fix:

remove line from /var/lib/qubes/qubes.xml and restart qubesd again

Is this a bug of the GUI?
Maybe the property “devices_denied” has not to be empty?

In my opinion this is a major bug, because the user didn´t recognized the issue, during working with gui.

There is no error thrown or something else.

Restarting the system causes, only dom0 to start

The patch is pretty simple, you can try writing it it to /usr/lib/python3.13/site-packages/qubes/vm/qubesvm.py and systemctl restart qubesd.

Thanks, for your feedback.

I didn´t find this issue.

My fault, i only searched for open issues.