Whonix update says hardening failed. Is that bad?

corny · November 12, 2024, 12:10am

When I update whonix ws and gw it completes successfully (green checkmark) but says hardening failed in the log. Is that a concern? I have been getting it for a while everytime

FranklyFlawless · November 12, 2024, 4:14am

That depends on your threat model.

apparatus · November 12, 2024, 8:26am

github.com/QubesOS/qubes-issues

SUID Disabler and Permission Hardener error when updating Whonix templates

opened 02:45AM - 10 Nov 24 UTC

andrewdavidwong

T: bug C: Whonix P: default needs diagnosis affects-4.2

[How to file a helpful issue](https://www.qubes-os.org/doc/issue-tracking/) #…## Qubes OS release 4.2 ### Brief summary When updating Whonix templates, there is an error message related to the SUID Disabler and Permission Hardener. ### Steps to reproduce Update Whonix 17 templates normally. ### Expected behavior Normal update output. ### Actual behavior Whonix Gateway 17 output: ``` [...] whonix-gateway-17:out: Running SUID Disabler and Permission Hardener... See also: whonix-gateway-17:out: https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener whonix-gateway-17:out: /var/lib/dpkg/info/security-misc.postinst: INFO: running: permission-hardener enable whonix-gateway-17:out: permission-hardener: [[1m[32mNOTICE[0m]: Managing (S|G)UID of line: setuid='true' existing_mode='4755' new_mode='744' file='/usr/bin/umount' whonix-gateway-17:out: permission-hardener: [[1m[32mNOTICE[0m]: Run: dpkg-statoverride --add --update root root 744 /usr/bin/umount whonix-gateway-17:out: permission-hardener: [[1m[32mNOTICE[0m]: Managing (S|G)UID of line: setuid='true' existing_mode='4755' new_mode='744' file='/usr/bin/su' whonix-gateway-17:out: permission-hardener: [[1m[32mNOTICE[0m]: Run: dpkg-statoverride --add --update root root 744 /usr/bin/su whonix-gateway-17:out: permission-hardener: [[1m[32mNOTICE[0m]: Run: setcap -r -- /bin/ping whonix-gateway-17:out: permission-hardener: [[1m[31mERROR[0m]: Removing capabilities failed. File: '/bin/ping' whonix-gateway-17:out: permission-hardener: [[1m[32mNOTICE[0m]: To compare the current and previous permission modes, install 'meld' (or preferred diff tool) for comparison of file mode changes: whonix-gateway-17:out: sudo apt install --no-install-recommends meld whonix-gateway-17:out: meld /var/lib/permission-hardener/existing_mode/statoverride /var/lib/permission-hardener/new_mode/statoverride whonix-gateway-17:out: permission-hardener: [[1m[31mERROR[0m]: Exiting with non-zero exit code: '205' whonix-gateway-17:out: /var/lib/dpkg/info/security-misc.postinst: ERROR: Permission hardening failed. whonix-gateway-17:out: Processing triggers for desktop-file-utils (0.26-1) ... whonix-gateway-17:out: Updated. whonix-gateway-17:out: Installed packages: whonix-gateway-17:out: None whonix-gateway-17:out: Updated packages: [...] ``` Whonix Workstation 17 output: ``` [...] whonix-workstation-17:out: Running SUID Disabler and Permission Hardener... See also: whonix-workstation-17:out: https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener whonix-workstation-17:out: /var/lib/dpkg/info/security-misc.postinst: INFO: running: permission-hardener enable whonix-workstation-17:out: permission-hardener: [[1m[32mNOTICE[0m]: Managing (S|G)UID of line: setuid='true' existing_mode='4755' new_mode='744' file='/usr/bin/su' whonix-workstation-17:out: permission-hardener: [[1m[32mNOTICE[0m]: Run: dpkg-statoverride --add --update root root 744 /usr/bin/su whonix-workstation-17:out: permission-hardener: [[1m[32mNOTICE[0m]: Managing (S|G)UID of line: setuid='true' existing_mode='4755' new_mode='744' file='/usr/bin/umount' whonix-workstation-17:out: permission-hardener: [[1m[32mNOTICE[0m]: Run: dpkg-statoverride --add --update root root 744 /usr/bin/umount whonix-workstation-17:out: permission-hardener: [[1m[32mNOTICE[0m]: Run: setcap -r -- /bin/ping whonix-workstation-17:out: permission-hardener: [[1m[31mERROR[0m]: Removing capabilities failed. File: '/bin/ping' whonix-workstation-17:out: permission-hardener: [[1m[32mNOTICE[0m]: To compare the current and previous permission modes, install 'meld' (or preferred diff tool) for comparison of file mode changes: whonix-workstation-17:out: sudo apt install --no-install-recommends meld whonix-workstation-17:out: meld /var/lib/permission-hardener/existing_mode/statoverride /var/lib/permission-hardener/new_mode/statoverride whonix-workstation-17:out: permission-hardener: [[1m[31mERROR[0m]: Exiting with non-zero exit code: '205' whonix-workstation-17:out: /var/lib/dpkg/info/security-misc.postinst: ERROR: Permission hardening failed. whonix-workstation-17:out: Processing triggers for mailcap (3.70+nmu1) ... whonix-workstation-17:out: Updated. whonix-workstation-17:out: Installed packages: whonix-workstation-17:out: None whonix-workstation-17:out: Updated packages: [...] ``` --- (CC: @adrelanos)

tanky0u · November 12, 2024, 11:40am

See this: permission-hardener error - Support - Whonix Forum

corny · November 13, 2024, 10:40am

Today’s update fixed the issue with hardening