Sys-gui-vnc Broken in Qubes 4.2-RC4?

User Support
,
1

Re: sys-gui-vnc non-working in Qubes 4.2-RC4

@marmarek @fepitre and others who may know about sys-gui-vnc stuff:

sys-gui-vnc appears to be non-working in Qubes 4.2-RC4 with fully updated dom0 and fedora-38-xfce template.

Started fresh 2 times, being very careful with exact steps, and the same bugs/problems occur each time.

Using sys-remote qube to access sys-gui-vnc via VNC, but VNC connection is always dropped and closed automatically with no connection.

Confirmed that qubes.ConnectTCP traffic is allowed through from sys-remote to sys-gui-vnc, but x11vnc server does not appear to be running in sys-gui-vnc.

Maybe this 4.2 sys-gui-vnc breakage can be confirmed or troubleshot here to make it work?

Details:

#1 These dom0 commands seem to succeed fine:

sudo qubesctl top.enable qvm.sys-gui-vnc
sudo qubesctl top.enable qvm.sys-gui-vnc pillar=True
sudo qubesctl --all state.highstate
sudo qubesctl top.disable qvm.sys-gui-vnc
qubes-prefs default_guivm sys-gui-vnc
qvm-shutdown --all --wait
echo "qubes.ConnectTCP * sys-remote @default allow target=sys-gui-vnc" >> /etc/qubes/policy.d/30-user-networking.policy
qvm-start sys-gui-vnc

Confirmed sys-gui-vnc services on:

qvm-service --list sys-gui-vnc
lightdm       on
guivm         on
guivm-gui-vnc on
dummy-psu     on

#2 For sys-remote, I’ve tried using fedora-38-xfce & debian-12-xfce with multiple various VNC viewer applications, without success:

qvm-connect-tcp 5900:@default:5900

vncviewer localhost:5900

The VNC viewer applications never connect and always instantly throw connection drop errors, like:

"The connection was dropped by the server before the session could be established."

Confirmed qubes.ConnectTCP: If I remove the /etc/qubes/policy.d/30-user-networking.policy file, then when attempting to connect the VNC app, a Dom0 notification in the upper right corner says:

"Denied qubes.ConnectTCP+5900 from sys-remote to @default"

so this suggests to me that with this policy file enabled my VNC port 5900 traffic is being successfully routed to the sys-gui-vnc qube.

Really needing to get this sys-gui-vnc feature working, so happy to provide any diagnostics needed to help further troubleshoot.

Anyone know how to get sys-gui-vnc working?

Thanks!

2

Some further sys-gui-vnc diagnostics:

I also tried using @ddevz forum post #6687 suggestion to enable the custom service “guivm-vnc” on sys-gui-vnc.

qvm-shutdown sys-gui-vnc --wait
qvm-service --enable sys-gui-vnc guivm-vnc on
qvm-start sys-gui-vnc

Confirmed sys-gui-vnc services on:

qvm-service --list sys-gui-vnc
lightdm       on
guivm         on
guivm-gui-vnc on
dummy-psu     on
guivm-vnc     on

Looking into sys-gui-vnc file at /usr/bin/qubes-run-x11vnc shows a mention of “guivm-vnc”:

qvm-run --auto --nogui --pass-io sys-gui-vnc 'cat /usr/bin/qubes-run-x11vnc' | grep guivm-vnc
if qsvc guivm-vnc; then

so maybe this missing “guivm-vnc” is still needed and/or is a bug in 4.2?

But enabling “guivm-vnc” service in sys-gui-vnc still did not work. Same VNC app closed connection drop issue still.

I tried seeing if any VNC server process was running in sys-gui-vnc, like this:

qvm-start --auto --nogui --pass-io sys-gui-vnc 'ps aux | grep -v grep | grep vnc'

but no processes mentioning “vnc” were showing in an already running sys-gui-vnc.

I also tried seeing if any VNC server is running on sys-gui-vnc from startup in a loop of 100 iterations, like this:

qvm-shutdown sys-gui-vnc --wait

for i in {1..100}; do date && qvm-start --auto --nogui --pass-io sys-gui-vnc 'ps aux | grep -v grep | grep vnc'; done

and then several various “x11vnc” processes showed up, slightly changing across ps aux loop iterations, then going away to no “vnc” processes of any kind showing at all after about 10 to 15 seconds.

I then re-tried that startup loop test, but tried connecting to VNC from a sys-remote VNC app, several times shortly during/after startup of sys-gui-vnc, and it had a visible effect. The effect this had was that the ps aux loop showed “x11vnc” live processes for about as long as I kept retrying to connect from the sys-remote VNC app, up to about 2 minutes tested, compared to the standard 10 to 15 seconds where any live “x11vnc” processes seem to die out.

Once all “x11vnc” processes die out after sys-gui-vnc startup, any further attempts to connect from the sys-remote VNC app do not seem to bring any “vnc” processes back to life in the sys-gui-vnc qube.

So it seems like the x11vnc server is “being pinged” somehow by the VNC application connect attempts, but is maybe not being initialized or running properly in the fedora-38-xfce based sys-gui-vnc qube?

3

Another extra bug in sys-gui-vnc I found for Qubes 4.2-RC4, which the Qubes devs may want to fix:

sudo qubesctl --all state.highstate

fails to download the “dummy-psu” package, if one has their Dom0 Updates Global Config set to “Enable security-related testing updates only”, because the sys-gui-vnc installer then tries to download “dummy-psu” from “security-testing” and fails to find it there. Switching back to “stable” updates gets around this bug and successfully locates and downloads the “dummy-psu” package.

Still not sure how to get the x11vnc server connection working for sys-gui-vnc though.

4

I’ve now tried installing sys-gui-vnc with other versions of the Fedora template, but none worked.

All Fedora versions still had the same general problem of not being able to connect from the sys-remote VNC client to the sys-gui-vnc VNC server.

  • fedora-38-xfce
  • fedora-38
  • fedora-37-xfce
  • fedora 37

The sys-gui-vnc template is hardcoded at 3 spots the following 2 salt files, where you can edit them to use the template you want for sys-gui-vnc:

/srv/formulas/base/virtual-machines-formula/qvm/sys-gui-vnc.top
/srv/formulas/base/virtual-machines-formula/qvm/sys-gui-vnc.sls

Correcting a couple minor insignificant typos…

  • In the security-testing bug, I had mentioned the “dummy-psu” package but I meant “dummy-psu-sender” package.

  • In my sys-gui-vnc startup tests, I had mentioned “qvm-start --auto” but I meant “qvm-run --auto”.

Anyone else have experience with sys-gui-vnc in Qubes 4.2?

Anyone have an idea of how to dianose this x11vnc/lightdm server VNC connection issue in sys-gui-vnc?