Re: [qubes-users] Qubes 3.2: Temporarily allowing full access does not revoke it after the time runs out

2018-02-04 Thread David Hobach
I also just noticed that the feature seems to exist in the 4.0 GUI. Maybe I'll test that as well... I just tested it in 4.0 and that's affected by the bug as well... I managed to re-produce it 2/2 times with 2m and proxy and sys-net as netvm. What is interesting: qvm-firewall in dom0 lists a

Re: [qubes-users] Qubes 3.2: Temporarily allowing full access does not revoke it after the time runs out

2018-02-04 Thread donoban
On 02/04/2018 03:20 PM, David Hobach wrote: > Honestly I don't really understand why systemd was used at all for that > functionality. > > Anyway I did test your suggestion and unfortunately it didn't reliably > work for me: > 1/3 times it worked and that seemed to be the random chance of it >

Re: [qubes-users] Qubes 3.2: Temporarily allowing full access does not revoke it after the time runs out

2018-02-04 Thread David Hobach
On 02/03/2018 01:31 PM, donoban wrote: On 02/03/2018 01:10 PM, David Hobach wrote: When you add temporary access for a AppVM, a service and a timer are created for that VM: - qubes-reload-firewall@(VM-Name).timer - qubes-reload-firewall@(VM-Name).service then the timer is enabled. 1min later

Re: [qubes-users] Qubes 3.2: Temporarily allowing full access does not revoke it after the time runs out

2018-02-03 Thread donoban
For clarify: On 02/03/2018 01:10 PM, David Hobach wrote: >> - open in dom0: /usr/lib/systemd/system/qubes-reload-firewall@.timer >> and add "OnUnitActiveSec=1m" on the end of file. >> >> >> - Reload systemd config -> "systemctl daemon-reload" and try to test >> again. > > Doesn't changing the

Re: [qubes-users] Qubes 3.2: Temporarily allowing full access does not revoke it after the time runs out

2018-02-03 Thread donoban
On 02/03/2018 01:10 PM, David Hobach wrote: >> - open in dom0: /usr/lib/systemd/system/qubes-reload-firewall@.timer >> and add "OnUnitActiveSec=1m" on the end of file. >> >> >> - Reload systemd config -> "systemctl daemon-reload" and try to test >> again. > > Doesn't changing the config and

Re: [qubes-users] Qubes 3.2: Temporarily allowing full access does not revoke it after the time runs out

2018-02-03 Thread David Hobach
- open in dom0: /usr/lib/systemd/system/qubes-reload-firewall@.timer and add "OnUnitActiveSec=1m" on the end of file. - Reload systemd config -> "systemctl daemon-reload" and try to test again. Doesn't changing the config and reloading all services with changed config just reload the

[qubes-users] Qubes 3.2: Temporarily allowing full access does not revoke it after the time runs out

2018-02-03 Thread donoban
Hi, Some days ago I decided to investigate this issue: https://github.com/QubesOS/qubes-issues/issues/1173 I think that I found the solution, at least it seems working fine for me. If some dev could take a look, it's very simple to check and fix and if you are considering a new 3.2 release would