Network Access dom0

[zack...@gmail.com]

I know it's unsecure and that the tempory elevation menioned in the update dom0 page has been removed. So is there some way I can give network access to the dom0 so I can add the bumblebee repo?

[Drew White]

On Wednesday, 17 August 2016 06:29:21 UTC+10, zack...@gmail.com wrote:
> I know it's unsecure and that the tempory elevation menioned in the update dom0 page has been removed. So is there some way I can give network access to the dom0 so I can add the bumblebee repo?

You need to enter it manually.

[Andrew David Wong]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

AFAIK, giving dom0 unfettered network access is not possible:

https://groups.google.com/d/topic/qubes-users/c2RyhLmTCm4/discussion

However, if your goal is just to get a certain package into dom0 so you can
yum/dnf install it there, then there are other ways to do that. For example,
you could download the package somewhere else, copy it to dom0, then install
it locally. Here's how you can copy files to dom0:

https://www.qubes-os.org/doc/copy-from-dom0/#tocAnchor-1-1-2

Please note the inherent risk of performing this action. Copying untrusted
files to dom0 is generally not advised and may compromise the security of your
Qubes installation.

- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJXs60XAAoJENtN07w5UDAw3aUP/jos3VZTef0hJ4OOXwXhc2M+
Eykv8f4QVX4Sd3yV72NPQ26RSCH8MloBxeaBqMdGoDqwCBh6g4CRq74GGSt82T0k
SSNcZVy9GgTd+D9rvMkuz6KMxxAOl4ZvPilSe5SNnElMGIUGYEJyQIeHj2hjAk2d
ZKuZH8cb4L+cauPF/+TtuxIIlIOWu7YR0h3hBfAVGdnYzAd6Ha8Id+IWNNKzAG2w
kngyts13X3J+PeMw6/N5mG3pe/sRZ+pfQUvQPQcaVGxFaJDcpqJFGO0Apvkhbdei
NURfmYe7F8jUqBIhXYnHxsLtJw9spkxXYtapDwYidS+LgGIzf5y7VO68E0VyTrXX
4RLzaj+Ocb1V+6si7/4wNe3/nTxm23ygjr03I3Iz/kZYyOO711rGj6OX9uGT0dSX
dvV36JJqEdCRoZM3BMjJBcx6KHDXQf3FMzzMjYVqvVg4u2zyWQtUYSI48/335Par
2g/BbdgEvpGF+ARhEec8kWr9A0n5sahWoiO3xwx2EU257XsWzjkS+I4knnWKbGtQ
TSwrKfld2Y1Y+mLZ3Sz5dvVO+GXs21WACx+tB7xjnYovDwkubRqzwf5zdNnrqBA5
B1TrvtuJWttaAIVqlf2rhz+NZxpS4Uyn8tQPa0H+GcxAJg7hU+r7IsMP28wRsr+Z
mZFJYhnzqSs9LEqoHSMA
=jIXz
-----END PGP SIGNATURE-----

[zack...@gmail.com]

Unfortunately, I need to install bumblebee for better power management for my laptop. Copying over the rpms and installing them are easy enough but my concern is with any dependencies that may be needed

[Andrew David Wong]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Maybe there's a way to define your own repo and piggyback on the usual dom0
update mechanism, but I've never really played around with this (due to the
security risks), so I don't know if it's possible.

The predefined repos are in /etc/yum.repos.d/. Here are the basics of the dom0
update system:

https://www.qubes-os.org/doc/software-update-dom0/

Here are the technical details:

https://www.qubes-os.org/doc/dom0-secure-updates/

And, in case it helps, an explanation of networking in Qubes:

https://www.qubes-os.org/doc/networking/

- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJXs67YAAoJENtN07w5UDAwjPIP/ROSiZqzxc/3+H1c572bDocC
rfwgllo7mcma51wf4STq17vgJee9Pg0Zrqm5NOBP/GjnqL8oJGuQMxP8lYjzJvCR
ThW3sGEBD1kTJS6Ixt01ZEcOAdI+oTI0P2l2N9ntYO/mPfh4cMKKKjS6qovmPpHn
iZ9OTgwNNBDVWFs9OMbaKXHZ5gIhF/19+/VvNfu0mnZnLN03nJrlHhgHsR4yrZ2+
Br6b7grJW6PuTVfT4ipbS23JMAv9s0xS8XJmmobdrVpVDLs4abb6TUo7muJ6WF4A
Qtcvx4gk9asyhkd/Xm0ms23xJKoT8oYctVyt1A88PhGifJHPsv19iQ4u5gUNV5ni
q+99o9cd9faTMjhoL0h9Ks9FfiLZBDR5Y+KezsNnqXA8N+akRzVaNFlSwtauHfwm
8hJyKlzKDEGoFvqSH56miLUHnipxWR0jdw05PXWMP+2Lpnefawe2EyGEx9Eu+Nvq
4Eb0nZwAfSjuu3Y626BU2PzyKUakGJmlugtuRgeryLtIphe9X95dVMoeHRtZX9QO
UjXyIToKJAksBer1f5xOIqVcKaM0ffkXuezQgO79Zx227v3ZNb4hbovSo3E6CzXv
3YI2qZl+SdjVeBco2J9xeQzgpEx36eALgQm/sOynwbc3CMrcbZ9aWKnsYBogshXW
aUDSARs+KKB/ppwUEAEO
=LtJ3
-----END PGP SIGNATURE-----

[zack...@gmail.com]

Alright, added the bumblebee repos. But when trying to install anything from them or run a qubes-dom0-update (this is all from dom0 terminal), I get "Failed to synchronize cache for repo 'bumblebee', disabling"

Are there some kind of special exceptions I need to add to the sys-firewall vm?

[Andrew David Wong]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 2016-08-16 18:46, zack...@gmail.com wrote:
> On Tuesday, August 16, 2016 at 8:25:03 PM UTC-4, Andrew David Wong wrote:
> On 2016-08-16 17:20, zack...@gmail.com wrote:
>>>> Unfortunately, I need to install bumblebee for better power
>>>> management for my laptop. Copying over the rpms and installing them
>>>> are easy enough but my concern is with any dependencies that may be
>>>> needed
>>>>
>
> Maybe there's a way to define your own repo and piggyback on the usual
> dom0 update mechanism, but I've never really played around with this (due
> to the security risks), so I don't know if it's possible.
>
> The predefined repos are in /etc/yum.repos.d/. Here are the basics of the
> dom0 update system:
>
> https://www.qubes-os.org/doc/software-update-dom0/
>
> Here are the technical details:
>
> https://www.qubes-os.org/doc/dom0-secure-updates/
>
> And, in case it helps, an explanation of networking in Qubes:
>
> https://www.qubes-os.org/doc/networking/
>
>

> Alright, added the bumblebee repos. But when trying to install anything
> from them or run a qubes-dom0-update (this is all from dom0 terminal), I
> get "Failed to synchronize cache for repo 'bumblebee', disabling"
>
> Are there some kind of special exceptions I need to add to the sys-firewall
> vm?
>

Are you downloading updates via Tor (sys-whonix)? If so, try requesting a new
identity (press 'n' in tor-arm) or just wait 10 minutes, then try again.

- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJXs89sAAoJENtN07w5UDAwcA4P/0VW6+igD47pX5eOa+5t3vm/
M8WO4VKKFxRGAX0M5nweRq3J4esxaITKschfsXlpd0eHdEdbRJVB1HP+KzOeGLp7
CyJzjqBUnxgoorDLbBcGribyg3Z2k7fVh0H/XGP2wz3StsC7LnJbRpxVq2Y4om+n
hPsJELiJ0krO0/yYYtcd5E2tD9OhEuGgkrifc/KmBzM6HWUEdOlPpmMGDl5UT1FV
k1NZu8hhd5TkcxdCn3MQAbMPaVhdAXe46t7C+6g4o+c4wS9AsuQYa/o/nMIVosTQ
bA9mHcMLXKPMfUoIvgUWE+K7JbK/OJZTrVScOW3rnnm6CTcpUafKqATDLBSe8WGp
RLYvN6xMBxZDm9gn6CMxY02fc6he9YHXMt1i9num53bn1NeDSzTyMjqIyuGJk1Aa
nV/e5jP2V1UL1JHbbBy/PMyXzh8gj6VY7dbEaVvnMHCNvYJ5+fdnozz7QZlvbg2J
AdB9wmPF9JrsvxOHlp+XRMXH3FkMSWRxquisGZYwIGXpxy3ags6P66g7GXJvE+8i
x4OCLEDSGMpGI1By2h4xVbD5e+rFqHkwB5cDTVM51gjNjJZlEwf/g4w388IlMpm/
t3VOSqljMlBzEPLVl74YdP8j6rP+06DDJmwEJDoduhqDSNmWvkBV+7cegrgsVKXu
u+AoapfMWl/Nj6AAwmzq
=lNtT
-----END PGP SIGNATURE-----

[zack...@gmail.com]

I did not install the tor network for the whole system so it shouldn't be using tor. Any ideas on the cache error?

[Andrew David Wong]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 2016-08-16 20:00, zack...@gmail.com wrote:
> On Tuesday, August 16, 2016 at 10:44:06 PM UTC-4, Andrew David

> I did not install the tor network for the whole system so it
> shouldn't be using tor. Any ideas on the cache error?
>

Well, the cache error is why I asked. I frequently get that error when
updating over Tor, but not otherwise. What is your default UpdateVM?
(Qubes Manager -> System -> Global settings -> UpdateVM)

And what is that VM's NetVM?

- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJXtKQNAAoJENtN07w5UDAwgCAQALBilZjsa427/RgmJLZROGQQ
nPBW72xPCH4uh8T/mY35O40N2ueEXjfYnkbuSc1g6K/w1ne75fGNzOhhE7RbpDFl
8hBM7BGWFq9wsoG5tzdaWAiO5NrozkFF3N1TPUwDvlav9Q+h4yrrcyY06TXroaWM
h/Kxj7JnLLR/HUAOUCHykhX2f0JGf32Xk56sEFXGdTooWbDu4uO8SHtYOFbNyxWA
mc98MqzjAQJq//2VcqlbfS9w7TUnr40aN9njUOg6q87WvXxYjq7TPdlX2ohCpknL
DZXSyXjZ24RV2ywH8sGwyPV4u6sRuMAJEvcUzdsKHMDGs7p4LEaiQxxnjKL7J2/1
Zv4TJE4Hl3EdPmwVoe5v8rusSIYAeJzFP0WMNkW0LPFjaqZ2PMN48Ei/I0r9fWAw
yaL6ES1usDLZRS2AC4gK7DqUkfwqH0HqhNurvd1VXTyQVnsPGLuSksi0OC5FKKXy
Noc0iCwT7qUMbya7UmkEReDAg4jWJL+BCPy+2uSouIMmy5oPFU0VO9d5KCFkfmUT
QqW30Un3iI5wEM3IZH/F5w/T/rTexr/Aftog3gPK0wBV5L2QTdncICngKW8iY+Nn
+6O7zm7l5M2z9DCQXyCr0b13vrpD0bAFhVHTefbjpFWjnhP9QfpvKbT0+bS04t8a
xU89APHg0+2iPCnme6SQ
=Als4
-----END PGP SIGNATURE-----

[zack...@gmail.com]

All default settings: update vm is sys-firewall and it's net is sys-net

[zack...@gmail.com]

Perhaps I'm adding the repos to the wrong place. I added them in dom0. Should I instead add them to the sys-firewall template vm?

[Andrew David Wong]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

>> All default settings: update vm is sys-firewall and it's net is
>> sys-net
>
> Perhaps I'm adding the repos to the wrong place. I added them in
> dom0. Should I instead add them to the sys-firewall template vm?
>

Sorry, I don't know. As I said, I've never tried playing around with
the system in that way. Maybe someone else can offer you better advice.

- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJXtLPDAAoJENtN07w5UDAwcy0P/2RWResVquLBpGCkQF844NW7
i65lOq+VrwFqZ8ZJ3ufoPAc3+DmMz3URLXvwbWDcW/zOdhSRMLZKmTWG7kUIQp7r
CHi5+0I9VjX4Wda4QpvJFeX1UtNHpF+jBonEVoUhqOBwnz0EQZP+9WBvUhBewTr8
hcF1K2/Rl/I/MYKvz5oubfvq5R6dtOFssSs3u52z+wJq4Fm3vnJXGwh8cv6D5LTm
Jq5R5nqkUFNrueueM2qfdNSjSqBfmklJZ7hhbacSZbI0je/MXwBYSaH+5PrEvMgs
wBaAHGx4BUycQ12vfDfP4hzWcnBQDWCTLP+TW7sbMe38F3C6GyjBl6Wf+6KMWC4A
tbrVvGjcauzxev/u8ysz1hLu2KiXRuIo26J2TPY7yqStwE0rsNdKEkd5JWAjCtzN
MogRUcWKP4NsoOWJa1SjxBHKrMibSo6T1kiQSBI+7XuGw+D5rEg5wvd1h7a9eyP8
QwdZ6FvNLLhDwFeSZvscYArPPg539tHBzPaNWikdlUAJDXHaEi9JI2gdaD3B7r7z
DDf5H1yHDQSAakQWKbAGScR0HG+SgRF+mgMGpSU2vkkG5URvtYFAfn/3z7wndKPD
Y5Mtqj+5dwogBd6LM0wRWiEh5AbdFR8zxV2f2pa/6P4QncWq9rcqKup/w8uEhJKU
+aiJXA8+HF6EugFDbfai
=V65s
-----END PGP SIGNATURE-----

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

If you want to install package from other repository to dom0, then yes,
add it in dom0 /etc/yum.repos.d. You also need to import package signing
key (sudo rpm --import /path/to/the/key).
As usual - be very careful when installing additional stuff in dom0, as
it may compromise system security.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJXtMt0AAoJENuP0xzK19csdf8H/jZnFQsU4ZFK6HaZqZQZrNQM
KLkxYHgLK5qIc2gwfigeTEjbvsNFEewqp5q1QZkdqGT2eUTH6BcyloLH3PFN66k7
jQSxUi7BwOWbLlJd/tXsevKK8Y9JNHxWwbk9ALQ5xtrb4a0HscCREM+YRbiHq0pT
sQvw6b9MrRQW03iX24xqOsWzI7wARVf8f6FsMZ1PVo6cdV2pDXBRghlv+zfxxxn8
ELTkQarUFZKx39OUJpQg6NBzw+6g9WNfypGcB2ZliRlHuIbAaeetKUMjuoIK0eLA
MS3Ak2rmjhH+qDF9Wd3z05eq6o1Mms15a42vgLnQb46a4vismVOODi9Fiac2Loc=
=9Gpo
-----END PGP SIGNATURE-----

[zack...@gmail.com]

So is it the lack of signing causing the cache errors? I also have no idea where to import the signing key from

[Desobediente]

The bumblebee docs tell you to use yum/dnf without gpg.

I haven't found their keys also. Normally it sits on a keyserver.example.com or keys.example.com

Giving the circumstances, I'd guess there aren't any.

There is a "just works" way to do it, but I'm not the one telling how to do that. Just ask them to generate gpg keys.

--

iuri.neocities.org

[Andrew David Wong]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Is the "just works" method adding "gpgcheck = 0" to the repo file? If so, then
I can understand why you wouldn't want to tell anyone how to do that, since
it'd render them vulnerable to a potential MitM attack.

- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJXt0vNAAoJENtN07w5UDAwQl8QALRLtl7E/d3LLADwDnmD53a0
kq1yxZsHzxYxV/tp6SKaScjk8GJa0p80gX27QEWLx+1/iasEmGFJrNGNY7/KyFUi
yKcs04DJSVi9O3zc/tmFcPAXrC13lhP9ONuBeP5PbJ9R/jbIGzxgxv85lj6kfNy2
bVq1W9YbmzPgORXIZqGNeYXmEcHrou8Qb4xgP9fh1GFuXUy6YiNb0C/ECkqGewHk
8hjoEm5/QjD5BitdqDr32n2GmOpXjs9/15Ae0JTBGGHSGNAD+A/HQ6gk/9aPt1q/
KRJW0ZW118hPLltjuNo99eBD2BTpeaNE1JZ0xic/RV4HhYL28Ivu+qCfpaLHxENG
zF/gNk5PkdbKJhjXoOizXj9q8YwPP60IKYrteN0+TPHSzayscVTn2s4oSi2YlxbE
xHfWSbp+Xqo14f2E+0rSTor44UdRFcOg2UHB+2roCbgN2+Ta+SQRtlEXO+7ehrpN
60LFS7HPTK7GNaVYvmFvSZxDHpLaZymxvYHRpGwiP/x2T75Ceg9XoUnl4iGdMiIO
jo/C+8sXF1Oa8PNHtA+d5bpqh4duELsDGNjV9R9EKNRBUlrVdMdGhjuhhzk3JSsa
TL/u47RoSd4nQYdOPdUgBHZlLVqchBKqrM0lPoYTebRRTxi5Ns9kMFHvrzssLJxy
a25Kb7ATBBPJ8HsEoxNI
=XUBP
-----END PGP SIGNATURE-----

[zack...@gmail.com]

Didn't change anything. Still getting a failed to synchronize cache for repo error