Re: [qubes-users] Re: Qubes - Critique (long)

[Marc Griffiths]

Thanks for your input Brendan, David, Chris.

Having switched to KDE, the laptop is now completely stable, and in my
opinion far more usable than XFCE.

I'm also running Trisquel on a Thinkpad X200 flashed with Libreboot, which
feels more secure although requires more care over choosing what to
install. I would be keen to see a laptop that supports Libreboot and is
powerful enough to run Qubes.

What are your thoughts on LXD? Lightweight enough to run on an X200/T400,
although of course not offering the same compartmentalization as XEN,
sharing the same kernel etc

[and yes something can 'feel' more secure, insight deeper into the stack
results in more trust]


Marc Griffiths
marc.d.griffi...@gmail.com



On Mon, 20 May 2019 at 20:58,  wrote:

> On Friday, May 10, 2019 at 2:09:09 PM UTC-4, Chris Laprise wrote:
> > On 5/10/19 12:16 PM, Marc Griffiths wrote:
> > > Next step for me is ordering a T400, which doesn't have Intel
> Management
> > > Engine, supports Libreboot, and has proven itself as an uncrashable
> > > workhorse. I used to run Windows and SUSE on this laptop back in
> > > 2008-2011, it never crashed, despite running a complex J2EE dev
> > > environment. I will miss having 16GB RAM, but the i7 I can happily
> part
> > > with.
> >
> > I doubt that Qubes will install or run on a T400. Qubes was initially
> > developed on Sandy Bridge-era hardware, and the requisite virtualization
> > features in chipsets was still maturing up to that point.
> >
> > I feel obliged to mention that if you want to avoid management engines
> > and a raft of other processor vulns, you should look to the AMD 15h
> > generation of chips (circa 2013). In the form of a Lenovo G505s A10,
> > installing Qubes first requires re-flashing the firmware with
> > Coreboot... an exercise that I'm about to try. :)
>
> As much as is really quantifiable...what percent of the real-world risk of
> the Intel ME to end-user is related to the fact that the
> manufacturer-whitelisted networking chipsets are directly usable by the
> firmware, primarily in support of the AMT feature set (and anything
> remotely hijacking via AMT, potentially without local compromise)?
>
> Which is to say: isn't one important mitigation of remote pwnage the
> disabling and/or removing (as appropriate) of the manufacturer-supplied
> network connections? Without a custom firmware, one can always use a
> USB-based wifi/ethernet connection..and with custom firmware (when
> possible) you can bypass the hardware whitelist and supply your own
> third-party wifi/bt card that the local AMT portion of the firmware has not
> been designed to talk to.
>
> Brendan
>
> --
> You received this message because you are subscribed to the Google Groups
> "qubes-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to qubes-users+unsubscr...@googlegroups.com.
> To post to this group, send email to qubes-users@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/qubes-users/d84a4fe5-1dcf-4c77-b86a-663672532fcd%40googlegroups.com
> .
> For more options, visit https://groups.google.com/d/optout.
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/CAPsYiwpVzO%3DN1Siver%2BYrKhsULLTTbVZmw59vm9utBxO%2BcLp-A%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Re: Qubes - Critique (long)

[Marc Griffiths]

Hi everyone. Nice critique John. To throw in my perspective as an
experienced Linux user switching to Qubes as sole laptop OS a few months
back. Primary usecase for me is #1 increased security when using crypto
exchanges and #2 the feeling of spinning up an environment that I have
confidence in being private, for the writing of personal notes and
reflections.

The concept is awesome, perfectly designed for protection against malicious
applications, websites and devices. Although it offers no protection
against Intel Management Engine.

My experience of installing on a Lenovo Yoga 720 was seamless, everything
worked including the touch screen. However, I experienced a lot of random
browser crashing. Chromium dead birds on a fairly regular basis. Vivaldi,
Chromium, and Firefox browser windows disappearing without error, on both
Fedora and Debian. Upgrading to Fedora 29, and upgrading dom0 didn't
resolve the problem. A few times the desktop became unresponsive, and while
I was able to ctrl+alt+F2 to dom0, it wasn't clear how I could view
processes running on a particular VM.

I'd be interested in knowing what audience Qubes is aimed at. With the
rapidly increasing public awareness on cyber-security and privacy, Qubes
could very easily find itself in high demand. At present though it's only
going to appeal to experienced Linux users, which is a shame, because it
wouldn't be that much work to make it far more accessible.

If the Qubes team is interested in a larger audience, I would suggest:

   - Include Ubuntu based VM as default, or at least make the process of
   adding a Ubuntu template significantly easier
   - Include a brief getting started guide that covers essentials such as
   cross VM copy/paste, accessing devices, upgrading software etc
   - If we're limited to XFCE, then include guides on customising to be
   more like other environments. Most critical for me was adding shortcuts for
   switching desktops and moving windows between desktops: System tools >
   Window Manager > Keyboard
   - A guide on the limitations: what does Qubes protect you from, what
   does it not protect you from, what are the next steps to improve security.
   Having a colour-coded grid to communicate this would be excellent.

Next step for me is ordering a T400, which doesn't have Intel Management
Engine, supports Libreboot, and has proven itself as an uncrashable
workhorse. I used to run Windows and SUSE on this laptop back in 2008-2011,
it never crashed, despite running a complex J2EE dev environment. I will
miss having 16GB RAM, but the i7 I can happily part with.

Marc Griffiths

marc.d.griffi...@gmail.com



On Sun, 31 Mar 2019 at 11:18,  wrote:

> Chris mentioned:
>
> "The current Firefox ESR does have a tendency to freeze temporarily when
> memory gets low. I'm considering switching to the non-ESR 'firefox'
> package in Debian to see if the newer versions are better in this respect."
>
> My computer (Intel NUC7i7) has 32 GB RAM, so I doubt I am having low
> memory issues -- but I suppose with my tendency to open a lot of tabs, it
> could happen.
>
> I finally got around to trashing the ESR version of Firefox and installing
> the latest "regular" release. It is too early to tell (less than a day),
> but I have not run into a problem yet (I had been running into the problem
> at least once or twice a day).
>
> --
> You received this message because you are subscribed to the Google Groups
> "qubes-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to qubes-users+unsubscr...@googlegroups.com.
> To post to this group, send email to qubes-users@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/qubes-users/9fbf11f4-2ca3-45f5-ba11-b708b405ba3a%40googlegroups.com
> .
> For more options, visit https://groups.google.com/d/optout.
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/CAPsYiwrunua7mm-4vES16ocftMzAbEnKRMevN5Nqoyeb_OpxDQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Mouse driver xorg (evdev)

[Marc Coenegracht]

I'm using multiple usb mouses/trackballs which need an  
section with the options for the evdev driver specified to make them 
function properly.


Where to put these .conf files?
I can only think of /etc/X11/xorg.conf.d in either dom0 or the template on 
which the sys-usb VM is based.


Or is this all wrong?
I searched the docs and mailing list for the Qubes way to do this, but 
couldn't find an answer.


Best,
Marc

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/alpine.DEB.2.20.1810082104380.1261%40localhost.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Unsupported hardware detected

[Marc Ballesteros]

Hello.
I am trying to install qubes os 4 on my computer, but I receive the
"Unsupported hardware detected" message (Missing features: HVM/VT-x/AMD.V,
IOMMU/VT/)
I verified the CPU compatibility with lscpu and I see the VT-x
virtualization system enabled and the ept flag.
It is possible to install Qubes OS 4 on this system? Thanks



Arquitectura:x86_64
modo(s) de operación de las CPUs:32-bit, 64-bit
Orden de los bytes:  Little Endian
CPU(s):  8
Lista de la(s) CPU(s) en línea:  0-7
Hilo(s) de procesamiento por núcleo: 2
Núcleo(s) por «socket»:  4
«Socket(s)»  1
Modo(s) NUMA:1
ID de fabricante:GenuineIntel
Familia de CPU:  6
Modelo:  60
Nombre del modelo:   Intel(R) Core(TM) i7-4790 CPU @
3.60GHz
Revisión:3
CPU MHz: 3396.892
CPU MHz máx.:4000,
CPU MHz mín.:800,
BogoMIPS:7195.68
Virtualización:  VT-x
Caché L1d:   32K
Caché L1i:   32K
Caché L2:256K
Caché L3:8192K
CPU(s) del nodo NUMA 0:  0-7
Indicadores: fpu vme de pse tsc msr pae mce cx8 apic
sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm
pbe
syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts rep_good
nopl xtopology nonstop_tsc cpuid aperfmperf pni pclmulqdq dtes64 monitor ds_
cpl vmx
smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe
popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm cpuid_fault
epb inv
pcid_single pti ssbd ibrs ibpb stibp tpr_shadow vnmi flexpriority ept vpid
fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid xsaveopt dtherm ida
arat pln
pts flush_l1d

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/CAO_Ax70R%2B2LrpmLL%3D3tzShwH_RUNMSEEMP3Pe_krvBQ3EYcj1A%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Define an environment variable to be accessible by qvm-sync-appmenus

[marc]

Hi,

I'm working in a small pull request to Qubes which modifies 
`/etc/qubes-rpc/qubes.GetAppmenus` to, optionally, read something from an 
environment variable. 

The issue is that, while manually testing it, I find no way to set an 
environment variable from my VM making it accessible when `qvm-sync-appmenus` 
is run. No matter in which shell initialization file I set it, it isn't read.

Where should I set that environment variable to make sure that scripts like 
`qvm-sync-appmenus` will load it?

Thanks

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/2f627353-e318-4432-b4d9-a93f91e86d86%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] qvm-run fails silently with chromium

[marc]

> I'm probably wrong but I think what's happening is this:
> Look up the process list and you'll see the invocation:
> su -l user -c /usr/bin/xinit...

Right

> That's su starting a shell as a login shell: as you have zsh as default
> shell, .zprofile is read to set env variables, including path.
> 
> And I think you should have seen the output from qvm-run ps aux
> included something like "sh -c ps aux".

Right

> That call to sh is coming from qrexec-fork-server, I think.
> 
> I hope that makes it a little clearer.

Not too much, but I guess I lack some background in qubes internals :)

> It would be interesting to see what happened if you were to relink sh
> to zsh in the template. I'm looking at a number of issues arising using
> some non default user shells(tcsh, fish)

Doing so:

$ qvm-run -a -p qube "echo $0"
# => sh

$ qvm-run -a -p qube "ps aux"
# Inclues
# => /bin/bash /usr/bin/qubes-session
# => su -l user -c /usr/bin/xinit
# => ps aux (without `sh -c` before)

$ qvm-run -a -p qube 'echo $SHELL'
# => /bin/zsh

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/e281e3ca-d595-40ae-a5c7-e471346179dc%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] qvm-run fails silently with chromium

[marc]

> try this:
> qvm-run -a -p qube "echo $0"

It returns `bash`

> and:
> qvm-run -a -p qube "ps aux"

It includes a `/bin/bash /usr/bin/qubes-session`
 
> You may be surprised.

Also, `echo $SHELL` returns `/bin/bash`.

I thought that maybe that `bash` process was in fact a subprocess of the actual 
`zsh` shell, but `ps aux|grep zsh` returns nothing.

So, yes, I'm very surprised, and now I understand even less why `~/.zprofile` 
is sourced... :)

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/23ff30d1-f131-467d-a729-2852fea32d58%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] qvm-run fails silently with chromium

[marc]

> Yes, I know - that's why I said "using bash".
> You are using zsh, so you said, so you need to put the path in ~/.zprofile
> 
> For example, with simple script 'logit' in home/user/newpath:
> 
> qvm-run -a -p qube logit
> fails with "logit: not found"
> 
> append path=('home/user/newpath' $path) to ~/.zprofile
> Then qvm-run succeeds

Yeah, you are right, this works. Thank you very much. But I don't quite 
understand. I guess that I'm opening an interactive non-login shell, but 
~/.zprofile is sourced while ~/.zshrc isn't, while, from 
http://zsh.sourceforge.net/Intro/intro_3.html:

> `.zshrc' is sourced in interactive shells

> [...]

> `.zlogin' is sourced in login shells. [...] `.zprofile' is similar to 
> `.zlogin', except that it is sourced before `.zshrc'

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/210bafbe-7d03-4752-a0ef-87162a6c6523%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] qvm-run fails silently with chromium

[marc]

> The issue you raise there arises because the xterm is not a login shell
> so will not use .profile.
> It is interactive so (using bash) will use .bashrc
> 
> On the immediate question here you can always set the path explicitly:
> qvm-run -p qube "export PATH=$PATH: && foo"

Hey Unman. The issue is that neither `~/.bashrc` nor `/etc/bash.bashrc` from my 
VM are used when I do `qvm-run` from dom0. Your workaround works but I think it 
is quite cumbersome. I wonder if there is any way to change the VM PATH seen 
from dom0 for every command.

Thanks

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/a1304499-d30b-40bc-84ca-43bb7ec7def9%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] qvm-run fails silently with chromium

[marc]

> Hello, did you run "Add more shortcuts" at least once (look which apps
> are there)? I got very confused by this point in another, maybe related
> situation: when changing the templateVM you *must* do so, since symbolic
> links to all apps are different in fedora and debian, for example.   All
> the best, Bernhard

Thanks for your answer haaber. Yes, I run that... now I see it is related with 
the application PATH. Please, see previous replies for details.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/8d03a102-ece2-4642-9a61-bd803b8a6259%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] qvm-run fails silently with chromium

[marc]

> I dont see this behaviour in a TemplateBased qube, or a standalone.
> In both, the browser just opens.
> That's with a standard Debian-8 template.
> 
> You can try running with '-p' option to see if any errors are being
> thrown.

Thanks for your answer Unman. The issue is that I installed it with nix package 
manager and then it ends up in another path. Please, see my previous reply for 
details.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/3d9b1e42-870c-4e93-8835-807a727c417b%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] qvm-run fails silently with chromium

[marc]

> Is chromium the only program with which you experience this problem?

Thanks for your answer Andrew.

Thanks to a private reply I got, I have been seen that the problem is related 
with my `PATH`. I have installed chromium via nix package manager, and for this 
reason it is not in the `PATH` that dom0 is able to see. Answering your 
question, it happens with any other package I installed with nix.

It doesn't happen in my VM because there I have the `PATH` configured with zsh 
when I log in.

So, now, the question comes down to: how could I change my VM `PATH` seen from 
dom0? I tried with my VM `~/.profile` and `~/.bashrc` but without success. I 
suspect this may be related with another topic I open some time ago:

https://groups.google.com/forum/#!topic/qubes-users/G9F3EHpeU2Q

Thank you very much

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/acc2936b-4c14-4dbd-b426-624820d0d58b%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] qvm-run fails silently with chromium

[marc]

Hi,

I installed chromium browser in a debian-8 based standalone VM called 'work'. 
If I run, from dom0:

```
qvm-run work chromium
```

it outputs:

```
Running command on VM: 'work'...
```

but nothing happens. It is the same if I use shortcut desktop menu (which I 
guess executes the same command).

If, instead, I run `chromium` from within a terminal in 'work' it works fine.

I thought maybe it was a permissions problem with folder `~/.config/chromium`, 
but I granted everything to everybody just to check it and nothing changes.

I'm quite lost because, as there is nothing in dom0 stderr, I don't know how I 
could debug it.

I would be thankful for any help.

Thanks!

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/5b368ffd-7035-43c5-83de-d672ce9fcccd%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] No Internal (Notebook) Keyboard and Touchpad.

[Marc Lucks]

Qubes OS version (e.g., R3.2): R3.2 Affected TemplateVMs (e.g., fedora-23, if 
applicable): dom0 Steps to reproduce the behavior: Not sure. Did some template 
updates in fedora-23 and debian-8 installed a windows HVM (not in Autostart)

General notes: The Keyboard is working when entering the disk encryption 
password. After that the internal Keyboard and the Touchpad aren't working. 
External mouse and keyboard work. I have no USB VM and didn't tinker with 
USB/PCI devices.

I started creating a ProxyVM which doesn't autostart, and is not yet used 
anywhere.

The Keyboard was working until the last full reboot today.

Any ideas?

   

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/350442654.16771.1485786882216%40ip-10-139-87-144.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: HDMI not working on my Dell Inspiron 17 7999

[Marc de Bruin]

On Saturday, December 3, 2016 at 9:18:35 PM UTC+1, Jonathann Giroux wrote:
> Hello guys, I just install Qubes on my Dell Inspiron 17 7999 and it's working 
> greatexcept for te hdmi port. My second screen in hdmi is not working at all. 
> Any ideas why? Thanks. 

I'm also having problems with getting HDMI to work on a Dell. In my case a Dell 
XPS 15, model 9550. 

Did you manage to solve it? xrandr does show HDMI1 and HDMI2 but no resolutions 
available to choose from.

Tnx,
Marc.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/b6d0de19-7046-41f3-a725-8d034fac8ec0%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Networking & firewall

[Marc de Bruin]

Hi Jos,

> 
> Can anyone point out some more reading material? If any?
> 
> Cheers!
> Jos
> 

I would like to know this as well! 

Anybody that would like to join and share? 

Thnx,

Greetz,
Marc.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/E64DF7C6-F41B-4A69-AA21-12E244B3BE77%40gmail.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Re: Install on Dell XPS 13 (9350)

[Marc de Bruin]

Op 4 dec. 2016, om 07:20 heeft miaoski <lin.zhe...@gmail.com> het volgende 
geschreven:
> 
> I failed to assign my TP-LINK TL-WN722N wireless USB dongle to sys-net.  
> Google'd a bit and found some docs, still no idea on how to do it.  Help is 
> much appreciated.
> 

How different is a 9350 from a 9550? I had no problems using the internal Wifi, 
e.g.

lspci? Just to compare?

Greetz,
Marc.


-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/9A8E77A8-CD60-451A-AF17-4492DC07982C%40gmail.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] qga.exe 100% CPU load (Windows Tools)

[Marc de Bruin]

Hi,

Occasionally, the Qubes GUI Agent (qga.exe) process turns into a CPU-hog for no 
apparent reason. The process just turns into a flatliner, eating up one 
complete core, which turns the Windows 7 machine into a very slow beast. 
Nothing is crashing tho. Power-off/power-on the HVM seems to fix it.

AFAIK, I’m using the latest version of the Windows Integration Tools on Qubes 
R3.2. 

Where should I start looking for problems? Any log-files that are recommended 
to look at?

Greetz,
Marc.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/A72E9C8F-404F-4F9E-9C36-B1B3291D8C53%40gmail.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Re: Qubes and HiDPI

[Marc de Bruin]

Op 2 dec. 2016, om 03:19 heeft Jean-Philippe Ouellet <j...@vt.edu> het volgende 
geschreven:
> 
> On Thu, Dec 1, 2016 at 6:25 PM, pixel fairy <pixelfa...@gmail.com> wrote:
>> On Thursday, December 1, 2016 at 2:58:21 PM UTC-5, Marc de Bruin wrote:
>> 
>>> Is there a way to get around this? Doesn't the Qubes VM Manager “window” 
>>> proportionally scale itself related to the occupied pixels of the text due 
>>> to the font? Or am I missing something?
>>> 
>> 
>> Im missing something here, why not just set your screen res in dom0 to 
>> 1920x1080 or whatever you find comfortable?
> 
> FWIW this is what I have done, and I don't mind it.
> 

I will do the same, no problem. I just couldn’t believe it didn’t rescale 
proportionally. It is the first thing you learn when programming GUIs I guess? 
;-) Nevermind. Qubes rulezzz. With what will it be replaced in Qubes 4? 

Thanks,

Greetz,
Marc.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/39E48086-07F5-4807-8A32-E4084700E5CA%40gmail.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Powerpoint Presenter mode in Windows 7 HVM

[Marc de Bruin]

Lo,

I’m trying to get presenter mode working in a Windows 7 HVM. According to this, 
http://www.peterfillmore.com/2015/05/enabling-additional-screen-in-qubes-os.html
 
<http://www.peterfillmore.com/2015/05/enabling-additional-screen-in-qubes-os.html>,
 it might be possible to virtually attach a second screen to a Windows 7 HVM 
with the Qubes Windows Tools installed.

I’m trying to copy his approach but ran into problems. First of all, after 
installing the Windows Tools, my Windows 7 HVM always seems to “full screen” 
itself in a maximized window. Is there a way to resize that window after the 
tools are installed? Second, when following his approach, the second screen 
seems to be there but cannot be seen. And, to my horror, starting the Windows 7 
HVM suggests that the cannot-be-seen second screen has become the primary 
output of that Windows 7 HVM. :-(  I had to restart the HVM in safe mode and 
disable the “Standard VGA Graphics Adapter” to get things normal again.

Could this nevertheless work? 

Greetz,
Marc.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/BD227CE2-11AC-48F8-9EFE-4615F3D4CBB6%40gmail.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Qubes and HiDPI

[Marc de Bruin]

Lo,

To start with, I’ve read https://github.com/QubesOS/qubes-issues/issues/1951 
<https://github.com/QubesOS/qubes-issues/issues/1951>. 

I got this new Dell XPS 15 9550 with a HiDPI screen (3840x2160). I’ve been 
trying to get it working the way I want: native resolution with readable text. 
Xfce provides a way to increase the system font to 192dpi; KDE has a scale 
factor to increase all fonts with a factor. Either way, the Qubes VM Manager 
doesn’t seem to scale it’s own “graphics” accordingly, is that correct? E.g., 
displaying the column with the IP-addresses results in it only displaying 
“10.137.”. The rest is cut of, because the width of the column doesn’t seem to 
get wide enough.

Is there a way to get around this? Doesn't the Qubes VM Manager “window” 
proportionally scale itself related to the occupied pixels of the text due to 
the font? Or am I missing something?

Greetz,
Marc.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/2A7511E7-9382-465B-9B07-85DDCDDC4D68%40gmail.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Re: Nix desktop shortcuts in dom0

[Marc Busqué]

> If it doesn't, supporting XDG_DATA_DIRS would not help with Nix.

But couldn't I set it manually? Then Qubes should read from it that change
is introduced.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/CAJzvRW-3kcy-KeZeka4NmVAUfHxCSKw%2BU1aikSs426_nnyJdtg%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Does QubesOs does not source ~/.profile on purpose?

[marc]

> the source code of qvm-run is your best documentation of how applications are 
> run without logging in :)
> here is the session that is started in vms. I like the hangman :)
> https://github.com/QubesOS/qubes-gui-agent-linux/blob/master/appvm-scripts/usrbin/qubes-session

Thanks for the link, Connor! Yes, a lot of effort has been put in that hangman 
:D

Looking at it and seeing how beautifully simply it is kept, wouldn't it make 
sense to load from there `/etc/profile` file? (I think usually this file is the 
main responsible of triggering cascade loading of profile files, but correct me 
if I am wrong)

Thanks

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/799e7396-3993-4a94-acda-84d7f9409d58%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Does QubesOs does not source ~/.profile on purpose?

[marc]

El lunes, 19 de septiembre de 2016, 10:18:42 (UTC+2), Dave Ewart  escribió:

> If you want something common to all your terminals, regardless of VM,
> you can add a file to /etc/profile.d which includes all your common
> content (e.g. aliases)
> 
> I use
> 
> /etc/profile.d/mystuff.sh
> 
> alias h=history ...

Thanks Dave. For me is ok to add what I need in `~/.bashrc`, I was asking just 
out of curiosity. Anyway, I think not loading home profile files breaks with 
the principle of least surprise, but surely supporting it would add some ugly 
hacks in qubes source code.

By the way, can I read somewhere an extension about how `user` user login 
technically happens (or, better said, not happens)?

Thanks

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/b2828068-e7fd-44a9-a0c9-e739d0979c9d%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: Does QubesOs does not source ~/.profile on purpose?

[marc]

> technically the user "user" is not logged in so the profile files are not 
> sourced. use .bashrc if you want to modify terminal sessions.

Ok! Thanks for your answer!

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/d210f25f-cff0-42ba-a753-fae7d5f30229%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Does QubesOs does not source ~/.profile on purpose?

[marc]

Hi,

I recently noticed that neither fedora nor debian virtual machines load 
`~/.profile` file.

In debian this file exists but it is ignored, while in fedora it doesn't exist. 
In fedora does exist a file `~/.bash_profile`, which usually means that this 
one will be loaded by bash instead of `~/.profile`. However, renaming the 
former does not change anything and the later is not loaded anyway.

I doubt that this behavior is inherited from debian and fedora themselves, so 
I'm asking if this is expected QubesOs behavior.

Thanks for your help.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/42732882-c217-442c-a920-6140b23d1f33%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Nix desktop shortcuts in dom0

[marc]

Hi,

This question is regarding a debian-8 standalone VM, but I guess it would be 
the same for template VMs.

I have installed [Nix](http://nixos.org/nix/) package manager. With it, I have 
installed latest firefox release. Then, I wanted the shortcut icon to nix 
installed firefox to appear in dom0 desktop. Reading [Managing shortcuts to 
applications in AppVMs](https://www.qubes-os.org/doc/managing-appvm-shortcuts/) 
and with some investigation I have achieve it. Here are the steps I have 
followed:

- I created a symlink to 
`/home/user/.nix-profile/share/applications/firefox.desktop` in 
`/user/share/applications`
- I run `qvm-sync-appmenus MyVM` from dom0
- I added new available shortcut

Then, I see I could do that for every GUI application I install from nix. But, 
is there any way to make `qvm-sync-appmenus` also read from 
`/home/user/.nix-profile/share/applications/`? Or should I investigate from the 
Nix side how to automatically create symlinks to `/usr/share/applications`?

Thanks

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/720310f5-a38e-47c2-8779-8279cc515f1b%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Configuring OpenDNS in Qubes

[Marc Busqué]

Ok, thanks a lot for your help. I'll try it.

On Aug 5, 2016 00:04, "Qubed One"  wrote:

> m...@lamarciana.com:
> >> eth0 is an uplink to sys-net. And /etc/resolv.conf there indeed is
> >> generated, so manual changes will be lost. There is a way to avoid this
> >> using /etc/qubes/protected-files.d/, but I think it isn't the way to go.
> >> Better adjust NetworkManager settings in sys-net, using standard
> >> connection editor GUI. The DNS servers in any other VM are in the end
> >> pointing to what you have in sys-net(*) (using DNAT redirections).
> >>
> >> (*) unless you use Tor/Whonix - in which case those are redirected to
> >> tor process.
> >
> > Thanks for your answer.
> >
> > Does it mean that all VM have to share the same DNS settings (except
> Tor/Whonix)? What I was trying to do is routing only one of them through
> OpenDNS, while keeping the rest with my ISP DNS server (and I would like to
> avoid an HVM just for that).
> >
> > I see I can create a new "NetVM" but I'm not sure if it is full
> supported. If I create a new one, is the GUI adapted so that I can
> configure both (sys-net and my custom one)? I prefer to ask before trying
> it and risking leaving something in an inconsistent state.
> >
>
>
>
> I would suggest trying to completely disable or get rid of
> NetworkManager in that ProxyVM (you shouldn't need it, especially just
> to redirect DNS), then see if /etc/resolv.conf changes become
> persistent. If not, you could still use /rw/config/rc.local to replace
> /etc/resolv.conf on boot.
>
> --
> You received this message because you are subscribed to a topic in the
> Google Groups "qubes-users" group.
> To unsubscribe from this topic, visit https://groups.google.com/d/
> topic/qubes-users/Q0kLzqD1ir4/unsubscribe.
> To unsubscribe from this group and all its topics, send an email to
> qubes-users+unsubscr...@googlegroups.com.
> To post to this group, send email to qubes-users@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/
> msgid/qubes-users/a038a41c-61c1-da76-225e-68600908de45%40riseup.net.
> For more options, visit https://groups.google.com/d/optout.
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/CAJzvRW9N7DsuScqixQURMPWdN6WVShp6_zccnQLM4a7DgQO3aw%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Configuring OpenDNS in Qubes

[marc]

> eth0 is an uplink to sys-net. And /etc/resolv.conf there indeed is
> generated, so manual changes will be lost. There is a way to avoid this
> using /etc/qubes/protected-files.d/, but I think it isn't the way to go.
> Better adjust NetworkManager settings in sys-net, using standard
> connection editor GUI. The DNS servers in any other VM are in the end
> pointing to what you have in sys-net(*) (using DNAT redirections). 
> 
> (*) unless you use Tor/Whonix - in which case those are redirected to
> tor process.

Thanks for your answer.

Does it mean that all VM have to share the same DNS settings (except 
Tor/Whonix)? What I was trying to do is routing only one of them through 
OpenDNS, while keeping the rest with my ISP DNS server (and I would like to 
avoid an HVM just for that).

I see I can create a new "NetVM" but I'm not sure if it is full supported. If I 
create a new one, is the GUI adapted so that I can configure both (sys-net and 
my custom one)? I prefer to ask before trying it and risking leaving something 
in an inconsistent state.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/e7b7ccac-708d-4c60-8dc6-1493fcf21d15%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Configuring OpenDNS in Qubes

[marc]

> Are you using NetworkManager in that ProxyVM?

I assigned "network-manager" service through "Qubes VM Manager" to my debian 
standalone ProxyVM, but I see this disappears once I start and shutdown the 
machine... I tried again to be sure and I can reproduce the issue. I will 
inspect it further and open a Qubes issue if needed.

But, anyway, I changed my ProxyVM to use fedora template (still standalone): 
Then, "network-manager" survives after reboot, but not the content in 
"/etc/resolv.conf"... But, in fedora template this file has an interesting hint:

# Generated by NetworkManager

I think this confirms my fears that /etc/resolv.conf should not be edited by 
hand...

I tried then to edit file 
/etc/NetworkManager/system-connections/qubes-uplink-eth0 and added OpenDNS IP's 
in "[ipv4]" section but changes are lost after reboot (I'm not using ethernet 
cable but wifi, but there is no other file. Furthermore, "ifconfig" only shows 
loop and eth0, but I suppose there is some kind of delegation to sys-net for 
that).

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/f8c7338b-90a9-484f-8d0f-1153aa04b73e%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Configuring OpenDNS in Qubes

[marc]

> If I understand correctly, permanently changing /etc/resolv.conf in the
> ProxyVM to show:
> 
>  nameserver 208.67.222.222
>  nameserver 208.67.220.220
> 
> should achieve that in a standalone ProxyVM.

Thanks for your answer. I thought that changing /etc/resolv.conf by hand was 
not recommended because some other programs can overwrite it. Anyway, I tried 
it and changes in /etc/resolv.conf in my standalone ProxyVM are lost once I 
reboot...

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/8bc745c0-2b86-4066-a18b-57ef56f2d058%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Configuring OpenDNS in Qubes

[marc]

Hi,

I'm trying to figure out how I can change my DNS settings for an AppVM. I'm 
relatively new to Qubes, so other related issues in this forum have clarified 
me some ideas but I am still quite puzzled.

This is what I have done so far:

1 - I have created a ProxyVM, which in turns connect to sys-firewall as NetVM. 
This ProxyVM uses debian-8 as template, because I'm following some tutorials in 
Internet about networking stuff using kali linux (configuring OpenDNS is one 
part). This ProxyVM is a StandaloneVM in order to keep changes in /.

2 - I have added to it network-manager service

3 - I have edited /etc/dhcp/dhclient.conf in my ProxyVM and I have added the 
following line with OpenDNS IPs:

prepend domain-name-servers 208.67.222.222, 208.67.220.220;

4 - I have connected my AppVM to this ProxyVM as NetVM.

5 - I have restarted my ProxyVM and my AppVM.

Now, I thought /etc/resolv.conf in my AppVM and ProxyVM should have changed. 
But no, they still have:

nameserver 10.137.5.1
nameserver 10.137.5.254

I see that my AppVM takes its /etc/dhcp/dhclient.conf from the ProxyVM, because 
that line is also added there.

Going to https://dnsleaktest.com confirms that I'm still using my ISP DNS 
server.

I guess that there is a way to do that without having to create a StandaloneVM 
for my ProxyVM, but I tried to do everything manual to learn how everything is 
tied. But anyway it doesn't work...

Thanks!




-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/78684271-4bcf-426d-9428-ee706ebe0381%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.