Warning: usb in dom0 is not restricted after 4.2.3 update on external SSD

Just updated to 4.2.3 via the Qubes updates GUI, I had been using Qubes for weeks with no issue. When I restart in order to apply the update, I get this error and the boot process does not continue.

‘’‘Warning: usb in dom0 is not restricted. Consider rd.qubes.hide_all_usb or usbcore.authorized_default=0.’‘’

No other errors or warnings.

My Qubes installation is on an external SSD, so it hasn’t been possible to restrict USBs.

This warning is unrelated, it should have been present before as well.

Try to boot with disabled qubes autostart:

You can also remove the rhgb quiet from the kernel command line options and add plymouth.enable=0 option in GRUB during Qubes OS boot to see the boot log.

Thank you for your response. I already tried booting with skip autostart, without success (same black screen with the same warning). Removing rhgb quiet results in a log that gets stuck here:

Trying both skip autostart, plymouth.enable=0 and removing rhgb quiet results in this:

The logs don’t progress after this.

Try to boot initramfs with older kernel in the GRUB boot menu → Advanced.

Thank you! I successfully booted from an older kernel and am now writing this from Qubes. Will I have to boot from an older kernel from now on? What exactly happened?

What’s the size of your EFI System partition (/boot/efi) and boot partition (/boot) and free space there?
Check the output of df -h command in dom0 terminal.

The output of df -h shows that the /boot partition is: Size: 974M, Used: 239M, Available: 668M, Use%: 27%. /boot/efi doesn’t show up in the output of the df -h command, maybe because I am using legacy boot? How else can I find it?

There is no /boot/efi for legacy boot so it’s ok.
It seems that you have corrupted initramfs with latest kernel.
I thought that this could happen if you didn’t have enough free space in /boot during dom0 update.
But this could also happen if the dom0 update was interrupted.
Was last dom0 update finished successfully?
Try to update the dom0 again, maybe it’ll fix the issue.
Or run this command in dom0 terminal to regenerate to initramfs:

sudo dracut -f --regenerate-all

I believe dom0 finished updating successfully, the PC did not go into suspend mode during the update and I restarted only after all updates had finished. The Qube updater right now shows no available updates for dom0, and I made it check just in case, and still found no available updates.

I tried sudo dracut -f --regenerate-all and attempted to restart. Same issue, so I removed rhgb quiet and appended plymouth.enable=0 and got the same error as the first picture of the log I posted. Trying without plymouth.enable-0 prompted some kind of plymouth error.

There is some issue with text encoding on the photo for “Creating slice” and target names, I’m not sure if it’s related to your problem.

You can try to install kernel-latest package in dom0 and boot with latest kernel.

Thank you, could you tell me how to do this or link me to the relevant instructions? I tried a quick search on how to do it but I don’t want to mess anything up.

Run this command in dom0 terminal:

sudo qubes-dom0-update kernel-latest

Thank you so much, this fixed the issue. I can boot normally now. I will be donating to Qubes on your behalf for the help you’ve given me. Appreciate it boss!

1 Like