Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Investigate updater not restarting some qubes #1127

Closed
deeplow opened this issue Jul 8, 2024 · 3 comments · Fixed by #1128
Closed

Investigate updater not restarting some qubes #1127

deeplow opened this issue Jul 8, 2024 · 3 comments · Fixed by #1128

Comments

@deeplow
Copy link
Contributor

deeplow commented Jul 8, 2024

Description

The 4.2 updater integration does restart some qubes, but not all. This is undesirable behavior since we want to enforce all qubes to restart.

Steps to Reproduce

SDW 1.0.0rc2

Expected Behavior

All running qubes based on templates that were updated should have been restarted.

Actual Behavior

Only a hand-full of qubes actually restarted.

qubes which got restarted qubes (still) running after updater finished with pending updates
which-restarted which-restarted2

Comments

  • when I encountered this I confirmed that sd-{small,large} did in fact have updates pending (via apt list --upgradable)
  • If this ends up being an upstream bug, for the time being we should just force-restart all workstation-based app qubes.
@deeplow
Copy link
Contributor Author

deeplow commented Jul 8, 2024

qubes which got restarted

From the looks of this, the qubes which got restarted (sys-whonix and sd-whonix) were either because they were whonix-based (I doubt it) or because they were sys-* (i.e. provides_network=True). Let's investigate...

@deeplow deeplow changed the title Investigate updater vm restarts Investigate updater not restarting some qubes Jul 8, 2024
@deeplow
Copy link
Contributor Author

deeplow commented Jul 8, 2024

At least on the GUI updater only the sys-* qubes are selected by default:

If this is anything to go by, my bet is that the default behavior on the CLI (qubes-vm-update) is similar.

@deeplow
Copy link
Contributor Author

deeplow commented Jul 8, 2024

Turns out this change in behavior was a consequence of a bug we opened. In short, --restart now is equivalent to --apply-to-sys (see diff) and there is a new flag which should fix it. This flag is --apply-to-all. I'll open up a PR for this.

deeplow added a commit to deeplow/securedrop-workstation that referenced this issue Jul 8, 2024
After an update to qubes-vm-update [1] (which the SDW updater uses
under the hood) `--restart` was changed to only restart `sys-*`
qubes. The new qubes-vm-update flag --apply-to-all has the behavior
we intend.

Fixes freedomofpress#1127

[1]: QubesOS/qubes-core-admin-linux@93078d0b
@legoktm legoktm moved this to In Progress in SecureDrop dev cycle Jul 8, 2024
@github-project-automation github-project-automation bot moved this from In Progress to Done in SecureDrop dev cycle Jul 8, 2024
legoktm pushed a commit that referenced this issue Jul 8, 2024
After an update to qubes-vm-update [1] (which the SDW updater uses
under the hood) `--restart` was changed to only restart `sys-*`
qubes. The new qubes-vm-update flag --apply-to-all has the behavior
we intend.

Fixes #1127

[1]: QubesOS/qubes-core-admin-linux@93078d0b

(cherry picked from commit 4a0a0df)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Archived in project
Development

Successfully merging a pull request may close this issue.

2 participants