Popup When Starting or Shutting down Whonix VMs

[pudding]

Hello,
today after updating my whonix-ws-15 and whonix-gw-15 template, every
time I start or shut down any of my whonix AppVMs or templateVMs, I get
the "Operation execution" popup like the attached pic 3 or 4 times. It's
pretty annoying. I tried updating dom0 from current-testing repo, but
the problem persists. Is there any way to make the popup disappear?
Thank you!

[awokd]

pudding:

You said you updated dom0, but did you also update your templates from
current-testing, and reboot afterwards?

[pudding]

Hello awokd,

No. I updated my Whonix templates from stable repo. Here's exactly what
I did:

1. I updated whonix-gw-15 and whonix-ws-15 from stable repo (plenty of
packages to update), and the popup appeared when shutting down these two
templateVMs;

2. I restarted sys-whonix after templateVMs were shut down, and updated
dom0 using sys-whonix from stable repo; two packages related to kernel
were updated, but the popup still appeared when trying to start
Whonix-based VMs;

3. I updated dom0 from the current-testing repo; the popup problem
persisted;

4. I rebooted my PC, and the problem is still there.

Pressing "Cancel" in the popup makes the popup go away and the VM start
or shutdown procedure resume as usual. The popup appears about 3-4 times
on VM start, random , and 1 time on VM shutdown.

I have encountered this popup problem before, and was able to fix it by
updating dom0 to current-testing repo, but this time it doesn't work. So
if there is a way to solve it, I would like to know. Thanks!

[pudding]

For your reference, I just found that the popup also randomly appears
during the time a Whonix-base VM is on. :(

[awokd]

pudding:

> For your reference, I just found that the popup also randomly appears
> during the time a Whonix-base VM is on. :(
>

There appears to be a new dom0 widget in current-testing that tells if
Whonix workstations have synced to a time source. I remember reading a
development thread about it somewhere. I bet those popups are because
something's not matching between versions. Suggest setting your
whonix-gw-15 and whonix-ws-15 templates to also update from Qubes
current-testing repo, to match dom0, and rebooting. Not getting those
popups on a PC where I've updated everything Qubes related to
current-testing.

[pudding]

Hello awokd,

Thanks for the answer, I remember seeing that post too. I checked the
dom0 log and found that hitting "Cancel" generated the following log:

dom0 qrexec[23456]: whonix.NewStatus+anon-whonix: anon-whonix ->
sys-whonix: denied: denied by the user
/etc/qubes-rpc/policy/whonix.NewStatus:7

My guess was that the popup was triggered by anon-whonix registering to
the sdwdate-gui of sys-whonix. I checked
/etc/qubes-rpc/policy/whonix.NewStatus, and it had only one line:

@anyvm    @anyvm    ask

I then added a line "$tag:anon-vm    $tag:anon-gateway    allow" at the
top of the file. It seems that this fixed the popup problem. Also, I
noticed anon-whonix now appears in the right-click menu of sys-whonix
sdwdate-gui icon. I am not sure if this is OK security wise, though. If
not, I will try your suggestion and update my Whonix templates from
testing repo. Anyway, thank you for the idea which helped me find the
solution. Many thanks!

P.S. Sorry for replying to your mailbox, I made a mistake. :(

[awokd]

pudding:

> /etc/qubes-rpc/policy/whonix.NewStatus, and it had only one line:
>
> @anyvm    @anyvm    ask
>
> I then added a line "$tag:anon-vm    $tag:anon-gateway    allow" at the
> top of the file. It seems that this fixed the popup problem. Also, I
> noticed anon-whonix now appears in the right-click menu of sys-whonix
> sdwdate-gui icon. I am not sure if this is OK security wise, though. If
> not, I will try your suggestion and update my Whonix templates from
> testing repo. Anyway, thank you for the idea which helped me find the
> solution. Many thanks!

Mine has these three lines in it, not sure why ours are different since
both our dom0's have been updated:

$tag:anon-vm $tag:anon-gateway allow

$tag:anon-vm sys-whonix allow
$anyvm $anyvm deny