dhimh
January 28, 2026, 7:06pm
1
The answer for the “Device Attachment Policy” section can be found here:
The device attachment policy is stored in the devices_denied property of the specific VM:
$ qvm-prefs VMNAME devices_denied
I don’t think that’s possible.
But where are the settings stored for the “Device Assignment” and the “Required Devices” section?
I wasn’t able to find these settings in the qvm-prefs properties for the qube.
1 Like
Villa
January 28, 2026, 7:14pm
2
dhimh:
Device Attachment Policy
These ones?
/etc/qubes-rpc/admin.vm.device.usb.*
1 Like
It might be stored in qubes.xml but if you want to edit that, I think that it is better to use qvm-device instead.
2 Likes
dhimh
January 29, 2026, 11:19am
4
Thank you for your answer!
Maybe I should have mentioned that the question is about Qubes OS 4.3.
I tried the Device Assignment for one of my external hard disks:
I’d like to know especially how / where the device identity is stored, because what is shown as serial number in the screenshot is definitely not the serial number. So I’d like to compare that to the data that is actually stored.
Is there a way to show that info with the qvm-device (or any other) command? Alternatively where is the config file stored?
1 Like
Try
$ grep '<device ' /var/lib/qubes/qubes.xml
2 Likes
dhimh
January 29, 2026, 2:10pm
6
Thanks, that worked, and the serial number is indeed stored there.
So far the auto-attachment didn’t work reliably, though. I’ll check the qubes issues later to see if the problem is already reported there.
And if anyone knows how to get this info with a command, that would still be interesting. So far I haven’t found anything but maybe it’s just not yet documented?
The following command should give you that:
qubesdb-read -d sys-usb /qubes-block-devices/sda/desc
About the documentation:
opened 08:32AM - 22 Jan 26 UTC
C: doc
P: default
### The problem you're addressing (if any)
The new device “self-identity orient… ed” assignment is [documented in the developer documentation](https://dev.qubes-os.org/projects/core-admin-client/en/latest/manpages/qvm-device.html#assign) but there is nothing to tell the user how to use it.
### The solution you'd like
Document use cases and tell the user how to use it in [How to use devices](https://doc.qubes-os.org/en/latest/user/how-to-guides/how-to-use-devices.html#how-to-use-devices)
### The value to a user and who that user might be
The user won't have to search and figure out how to use that new feature.
### Completion criteria checklist
(This section is for developer use only. Please do not modify it.)
1 Like
dhimh
January 29, 2026, 2:58pm
8
It seems that shows the description but nothing else:
$ qubesdb-read -d sys-usb /qubes-block-devices/sda/desc
Expansion_SW ()
Thanks for filing the issue!
Are you talking of the serial number of the USB device? If so, check /qubes-usb-devices (use qubesdb-list to find what you need to read)
dhimh
January 29, 2026, 3:28pm
10
I’d like to see what is stored for the rule shown in the screenshot above.
But your info about qubesdb-read and qubesdb-list is helpful, too.
parulin
January 29, 2026, 3:53pm
11
I don’t get what kind of output do you want ? The following?
qvm-block list --assignments sys-usb
qvm-block info sys-usb:sda
dhimh
January 29, 2026, 4:22pm
12
The first command has some of the info. But it is missing info about what is used as device identy for the rule.
The qubes.xml file has the info, though. So I’ll just mark this as the solution.