yeah… unfortunately qubes doesnt seem to have privacy as a priority - which i think it should…
anyone seeing this, please create a thread if they have successfully disabled CPUID on qubes. Thanks
yeah… unfortunately qubes doesnt seem to have privacy as a priority - which i think it should…
anyone seeing this, please create a thread if they have successfully disabled CPUID on qubes. Thanks
It’s a quite cool way to configure a template for waydroid, but i try to understand this line:
This will kill this script, but keep a waydroid-process running in the background (which is a little but confusing as the script will be terminated anyway after the last command.
If I want to shutdown the qube after closing waydroid/sway I added a
…but this only works, if I remove the above quoted line with “pstree”-command.
On my 4.1 machines I previously used weston instead of sway … which gave me the possiblity to start waydroid in (nearly) fullscreen-mode (of course: keeping the colored window-frame of qubes). Is there a way to tell sway to run fullscreen, too (now being on 4.2)?
Didn’t find anything in sway-documentation … and resizing the sway/waydroid-window after boot does not give the expected result (most likely Android does not allow resizing windows).
It’s killing the script and all processes started by this script.
It’s not killing this process:
/usr/bin/python3 /usr/bin/waydroid -w container start
Because it was started by waydroid-container.service
systemd service that is configured to autostart and not by the script.
The systemd service could be disabled and you can start/stop container in the same script sway-waydroid.sh
but it’ll require root to do this so I didn’t do this in the guide.
If you want to shutdown the qube then you don’t need the pstree command. This command is only needed to kill all the leftover processes if you’re going to continue using this qube.
On my 4.1 machines I previously used weston instead of sway … which gave me the possiblity to start waydroid in (nearly) fullscreen-mode (of course: keeping the colored window-frame of qubes). Is there a way to tell sway to run fullscreen, too (now being on 4.2)?
Didn’t find anything in sway-documentation … and resizing the sway/waydroid-window after boot does not give the expected result (most likely Android does not allow resizing windows).
I don’t think dynamic resizing is supported, check the links in this post:
You can set the sway window size in /etc/sway/config like this: output X11-1 resolution 1280x720 position 1280,0 Home · swaywm/sway Wiki · GitHub You can change the DPI like this: # Remove ro.sf.lcd_density properly if exist grep ro.sf.lcd_density /var/lib/waydroid/waydroid_base.prop && \ sudo sed -i '/ro.sf.lcd_density/d' /var/lib/waydroid/waydroid_base.prop # Append ro.sf.lcd_density property echo "ro.sf.lcd_density=320" | sudo tee -a /var/lib/waydroid/waydroid_base.prop Please add an sc…
If you don’t need to dynamically resize the window then you can do this:
If you need fullscreen then you can configure waydroid qube to start in fullscreen in dom0 the same way you’ll configure it for any other qube. You can use devilspie2 for this:
Add an option to automatically make a HVM desktop window full screen · Issue #7477 · QubesOS/qubes-issues · GitHub
For maximized window ((nearly) fullscreen-mode) you’ll have to configure the sway resolution as described in the linked previous post in this topic.
You also have an option to press Alt+F11 for fullscreen or Alt+F10 for maximized window when sway window started but before waydroid is started to change the sway resolution and it’ll waydroid will use this resolution when it starts.
now it is booting and it starts with the command in 4.1 but now i have to find out how i can connect to the internet
For Qubes OS 4.1 you need to change nftables rules with iptables rules in waydroid-firewall.service
:
You can try to replace this: ExecStart=/usr/bin/bash -c "if (nft create chain ip qubes waydroid-input) &>/dev/null; then nft add rule ip qubes custom-input jump waydroid-input; fi" ExecStart=/usr/bin/bash -c "if (nft create chain ip qubes waydroid-forward) &>/dev/null; then nft add rule ip qubes custom-forward jump waydroid-forward; fi" ExecStart=/usr/sbin/nft add rule ip qubes waydroid-input iifname "waydroid0" meta l4proto {tcp, udp} th dport { 53, 67 } accept ExecStart=/usr/sbin/nft add rule…
yes but i think the nft one is for 4.2 and the other one is for 4.1.
Yes, that’s what I’m talking about. The waydroid-firewall.service
in the guide had nftables rules for Qubes OS 4.2 so you need to change them to iptables rules for Qubes OS 4.1.
I’ve updated the Configure firewall for Waydroid part in the guide and added separate waydroid-firewall.service
for Qubes OS 4.1 and Qubes OS 4.2.
waydroid-install-apk /home/user/QubesIncoming/qube/F-Droid.apk
it says WayDroid session is stopped
sudo tells me not sudoed
ExecStart=/usr/sbin/iptables -I FORWARD 2 -o eth0 -i waydroid0 -j ACCEPT (code=exited, status=1/FAILURE)
service:1: Unknown section 'UNIT'. Ignoring
- cannot install apk WayDroid session stopped.
waydroid-install-apk /home/user/QubesIncoming/qube/F-Droid.apk
it saysWayDroid session is stopped
sudo tells me not sudoed
You need to start the Waydroid session first before you try to install APK there.
- no internet connection
ExecStart=/usr/sbin/iptables -I FORWARD 2 -o eth0 -i waydroid0 -j ACCEPT (code=exited, status=1/FAILURE) service:1: Unknown section 'UNIT'. Ignoring
What’s the output of this command?
cat /etc/systemd/system/waydroid-firewall.service
how can i start the session if i have to start the sway-waydroid.sh in terminal?
i exactly copied the word by word the text:
ExecStart=/usr/sbin/iptables -I INPUT -i waydroid0 -p tcp -m multiport --dports 53,67 -j ACCEPT
ExecStart=/usr/sbin/iptables -I INPUT -i waydroid0 -p udp -m multiport --dports 53,67 -j ACCEPT
ExecStart=/usr/sbin/iptables -I FORWARD 2 -o eth0 -i waydroid0 -j ACCEPT
ExecStart=/usr/sbin/iptables -I FORWARD 2 -i eth0 -o waydroid0 -j ACCEPT
ExecStop=/usr/sbin/iptables -D INPUT -i waydroid0 -p tcp -m multiport --dports 53,67 -j ACCEPT
ExecStop=/usr/sbin/iptables -D INPUT -i waydroid0 -p udp -m multiport --dports 53,67 -j ACCEPT
ExecStop=/usr/sbin/iptables -D FORWARD -o eth0 -i waydroid0 -j ACCEPT
ExecStop=/usr/sbin/iptables -D FORWARD -i eth0 -o waydroid0 -j ACCEPT
fixed installation problem, opened new terminal
how can i start the session if i have to start the sway-waydroid.sh in terminal?
You need to add the Waydroid-Sway
app shortcut for your Waydroid qube:
For ease of use Qubes aggregates shortcuts to applications that are installed in app qubes and shows them in one application menu (aka “app menu” or “start menu”) in dom0. Clicking on such shortcut runs the assigned application in its app qube. To...
Then you can start the Waydroid from qube app menu.
i exactly copied the word by word the text:
ExecStart=/usr/sbin/iptables -I INPUT -i waydroid0 -p tcp -m multiport --dports 53,67 -j ACCEPT ExecStart=/usr/sbin/iptables -I INPUT -i waydroid0 -p udp -m multiport --dports 53,67 -j ACCEPT ExecStart=/usr/sbin/iptables -I FORWARD 2 -o eth0 -i waydroid0 -j ACCEPT ExecStart=/usr/sbin/iptables -I FORWARD 2 -i eth0 -o waydroid0 -j ACCEPT ExecStop=/usr/sbin/iptables -D INPUT -i waydroid0 -p tcp -m multiport --dports 53,67 -j ACCEPT ExecStop=/usr/sbin/iptables -D INPUT -i waydroid0 -p udp -m multiport --dports 53,67 -j ACCEPT ExecStop=/usr/sbin/iptables -D FORWARD -o eth0 -i waydroid0 -j ACCEPT ExecStop=/usr/sbin/iptables -D FORWARD -i eth0 -o waydroid0 -j ACCEPT
Is this the full content of the file?
As stated in the linked post you need to open the waydroid-firewall.service
file and only replace the Exec lines and leave other lines intact.
Or just run these commands instead:
For Qubes OS 4.1:
cat << 'EOF' | tee /etc/systemd/system/waydroid-firewall.service [Unit] PartOf=waydroid-container.service Before=waydroid-container.service Requires=qubes-iptables.service After=qubes-iptables.service [Service] Type=oneshot ExecStart=/usr/sbin/iptables -I INPUT -i waydroid0 -p tcp -m multiport --dports 53,67 -j ACCEPT ExecStart=/usr/sbin/iptables -I INPUT -i waydroid0 -p udp -m multiport --dports 53,67 -j ACCEPT ExecStart=/usr/sbin/iptables -I FORWARD 2 -o eth0 -i waydroid0 -j ACCEPT ExecStart=/usr/sbin/iptables -I FORWARD 2 -i eth0 -o waydroid0 -j ACCEPT ExecStop=/usr/sbin/iptables -D INPUT -i waydroid0 -p tcp -m multiport --dports 53,67 -j ACCEPT ExecStop=/usr/sbin/iptables -D INPUT -i waydroid0 -p udp -m multiport --dports 53,67 -j ACCEPT ExecStop=/usr/sbin/iptables -D FORWARD -o eth0 -i waydroid0 -j ACCEPT ExecStop=/usr/sbin/iptables -D FORWARD -i eth0 -o waydroid0 -j ACCEPT RemainAfterExit=yes [Install] WantedBy=waydroid-container.service EOF systemctl daemon-reload systemctl enable waydroid-firewall.service
no i have this complete and systemctl status showes me the failure in the line i wrote
Or just run these commands instead:
For Qubes OS 4.1:
cat << 'EOF' | tee /etc/systemd/system/waydroid-firewall.service [Unit] PartOf=waydroid-container.service Before=waydroid-container.service Requires=qubes-iptables.service After=qubes-iptables.service [Service] Type=oneshot ExecStart=/usr/sbin/iptables -I INPUT -i waydroid0 -p tcp -m multiport --dports 53,67 -j ACCEPT ExecStart=/usr/sbin/iptables -I INPUT -i waydroid0 -p udp -m multiport --dports 53,67 -j ACCEPT ExecStart=/usr/sbin/iptables -I FORWARD 2 -o eth0 -i waydroid0 -j ACCEPT ExecStart=/usr/sbin/iptables -I FORWARD 2 -i eth0 -o waydroid0 -j ACCEPT ExecStop=/usr/sbin/iptables -D INPUT -i waydroid0 -p tcp -m multiport --dports 53,67 -j ACCEPT ExecStop=/usr/sbin/iptables -D INPUT -i waydroid0 -p udp -m multiport --dports 53,67 -j ACCEPT ExecStop=/usr/sbin/iptables -D FORWARD -o eth0 -i waydroid0 -j ACCEPT ExecStop=/usr/sbin/iptables -D FORWARD -i eth0 -o waydroid0 -j ACCEPT RemainAfterExit=yes [Install] WantedBy=waydroid-container.service EOF systemctl daemon-reload systemctl enable waydroid-firewall.service
.
Open terminal with root with qvm-run in dom0
Than systemctl start firewall.service works and gives network connection but how to fix that at boot?
Did you enable the waydroid-firewall.service with this command?
systemctl enable waydroid-firewall.service
Yes I did and he shows that on each boot firewall service is enabled but with failure in this line gives no network. If I systemctl start service again with root than everything works fine and network is connecting.
What’s the output of these commands when there is no network after the qube start (without manually running systemctl start service)?
systemctl cat waydroid-firewall.service
systemctl status waydroid-firewall.service
systemctl status waydroid-container.service
FYI you can copy text from xterm terminal by pressing Ctrl+Middle mouse click and selecting “Select to Clipboard”. Then when you select the text in the terminal using mouse it will be copied to clipboard and you can then copy it to global clipboard.
One of my testing waydroid qubes now gives permanent network connection but I have found another problem so the changes made in qvm-run -u root waydroid xterm & are not permanent so if I try to install git and clone a package and even after i installed it if I am going to reboot the qubes everything is gone like it has been never be installed. Wtf is wrong