Updating sys-usb template

[Zbigniew Łukasiak]

My sys-usb uses a very old template. I tried some googling - but
failed to find any advice about update it without locking me out of
the system.
I guess I could remove it - there is a description on how to do that
in https://www.qubes-os.org/doc/usb-qubes/ - and then add it again
with a new template. But it is kind of complicated and looks
dangerous.

--
Zbigniew Lukasiak
https://medium.com/@zby
http://brudnopis.blogspot.com/

[dhorf-hfre...@hashmail.org]

On Thu, May 28, 2020 at 09:26:34AM +0200, Zbigniew Łukasiak wrote:
> My sys-usb uses a very old template. I tried some googling - but
> failed to find any advice about update it without locking me out of
> the system.

disable sys-usb autostart. and reboot.
now you can replace the sys-usb template.
and try to start sys-usb with the new template.
if that fails, you will have to reboot again, and retry.

but basicly this reduces the problem from "locked out and need a
recovery disk" to "additional unplanned reboots" (which are not
that critical if you shut down all other VMs first)

[haaber]

maybe "lock out" refers to a USB keyboard ? That is how I read the
question. We let Zbigniew explain.

[dhorf-hfre...@hashmail.org]

> > disable sys-usb autostart.

> maybe "lock out" refers to a USB keyboard ?

yes, that is how i read it, and that is what my suggestions for
dealing with the update are about.

[Zbigniew Łukasiak]

Yes - I have an USB keyboard. So just to be sure - when I checkout
"start qube automatically on boot" in the sys-usb Qube Settings and
reboot - then the system will use my USB keyboard directly without any
problems?

--
ZŁ

[dhorf-hfre...@hashmail.org]

On Sat, May 30, 2020 at 09:46:57AM +0200, Zbigniew Łukasiak wrote:
> > > > disable sys-usb autostart.
> > > maybe "lock out" refers to a USB keyboard ?
> > yes, that is how i read it, and that is what my suggestions for
> > dealing with the update are about.
>
> Yes - I have an USB keyboard. So just to be sure - when I checkout
> "start qube automatically on boot" in the sys-usb Qube Settings and
> reboot - then the system will use my USB keyboard directly without any
> problems?

if you are entering your disk encryption passphrase during boot
using an USB keyboard that means your usb keyboard is directly
connected to dom0 during boot.
and it will stay there until you (try to) start sys-usb.

so my general recommendation for people who rely on usb keyboards
in their qubes setup is to disable sys-usb autostart.
(not just for replacing templates, but in general)

[unman]

On Sat, May 30, 2020 at 12:11:31PM +0200, dhorf-hfre...@hashmail.org wrote:

There's a simpler route, which I often use for template changes like
this, without need for reboot. Almost foolproof.

Make sure the new template has the necessary packages installed, and
then use a basic script to shutdown sys-usb, change template and
restart sys-usb. Use sleep to ensure sys-usb is down before you try to
change the template.
Put in a `sleep 120` statement, and then revert the change : that will
give you long enough to check that your keyboard/mouse are working
properly with the new configuration.
If all goes well, delete the sleep and reversion lines, and then run the
script again. If not, correct whatever is wrong and test again.

Something like:

```
#!/usr/bin/bash

qvm-shutdown sys-usb
sleep 10
qvm-prefs sys-usb template <NEW_TEMPLATE>
qvm-start sys-usb

## Delete this section after testing
sleep 120
qvm-shutdown sys-usb
sleep 10
qvm-prefs sys-usb template <OLD_TEMPLATE>
sleep 5
qvm-start sys-usb
## Delete this section after testing

```

You could use salt too, of course, but KISS

unman

[unman]

On Thu, May 28, 2020 at 01:39:57PM -0700, TheGardner wrote:
> Always using for updates of sys-usb the following commands in Terminal in
> dom0:
>
> Just a restart:
> qvm-shutdown --wait sys-usb; qvm-start sys-usb
>
>
> A change of the (already installed) new template, when all other vms
> already working with this new template:
> qvm-shutdown --wait sys-usb; qvm-prefs -s sys-usb template <new-templatename
> -number>; qvm-start sys-usb
>
>
> So for an update to Fedora-32 it would work with:
> qvm-shutdown --wait sys-usb; qvm-prefs -s sys-usb template fedora-32; qvm-start
> sys-usb
>
>
> Sometimes it crash and the cube won't starting proper again, so I have to
> turn the machine off and start new, but in 80% of the cases it's working
> this way.

And *that* is exactly why I suggest testing first with an automatic roll
back to use the original template

[TheGardner]

Hi unman,

you mean, those crashes didn't happen on Fedora-31 ?

Cheers :)