Qvm-move fails at 'Request refused'

User Support General
1

Problem
File downloaded to personal qube, based on fedora-38-xfce (created by installer) is not possible to move using qvm-move nor gvm-copy to a different qube. Commands fail with Request refused.

[user@personal Downloads]$ qvm-move package.deb
Request refused
[user@personal Downloads]$ qvm-copy package.deb
Request refused

Workaround
File is possible to move through dom0:

[johndoe@dom0 Downloads]$ qvm-run -p personal 'cat ~user/Downloads/package.deb' > package.deb
[johndoe@dom0 Downloads]$ qvm-move-to-vm d12m-usb package.deb

Target Machine Info
System: Qubes 4.2.0 (R4.2)
Xfce: 4.16
CPU: AMD Ryzen 3 4300G
SSD: M.2

Troubleshooting Passed

  1. Reboot
  2. Global Config set to Default policy (no change, just verification)
  3. Tried to check /etc/qubes-rpc/policy/qubes.Filecopy but qubes.Filecopy doesn’t exist
  4. No updates available for dom0

What could be the cause?

2

Qubes 4.2 now handles the policy files in /etc/qubes/policy.d/, that’s why you couldn’t find it.

Open Qubes Global Config, go to File Access and check the policy you are currently using.

1 Like
3

Section Moving and Copying Files is set to Default policy as I mention in passed troubleshooting.

4

Perhaps you have a custom file in the policy directory that changes the default behavior?

What does this give you in dom0:

sudo grep -r qubes.Filecopy /etc/qubes/policy.d/
1 Like
5

sudo grep -r qubes.Filecopy /etc/qubes/policy.d/ returns:

/etc/qubes/policy.d/90-default.policy:qubes.Filecopy         *      @anyvm      @anyvm     ask

I have also found an error in /var/log/qubes/qrexec.personal.log:

Screenshot
Screenshot1037×707 48.3 KB

Where does it lead to?

6

The policy looks ok to me.

About the screenshot, I see another policy file at the bottom that has a syntax error (/etc/qubes-rpc/policy/trezord-service).

Did you do a fresh install with backup restoration or is this an in-place upgraded Qubes 4.2 system?

1 Like
7

This is the fresh 4.2 installation. I have no backup of dom0. I’m trying to run Trezor Suite and trezord-service is part of it. I will confirm the validity of the file and let you know. Thank you for your time.

8

The problem was caused by trezord-service file.

1 Like
9

This is a follow-up proposed solution. The problem was caused by command "$anyvm $anyvm allow,user=trezord,target=sys-usb" > /etc/qubes-rpc/policy/trezord-service causing system to take anyvm as a variable. The author of tutorial has released a newer version addresing this syntax error, accessible here: smrtak: updated version with fixed issues: # TrezorSuite ...

The solution is to use '@anyvm @anyvm allow,user=trezord,target=sys-usb' > /etc/qubes-rpc/policy/trezord-service instead or edit file manually.