use qubes.VMRootExec/qubes.VMRootShell services when root needed

[marmarek]

When running a command as root is requested, use
qubes.VMRootExec/qubes.VMRootShell services, instead of specifying
target user directly. The explicit target user can be specified only
from dom0, but alternative qrexec service can be used also from GUI
domain - if policy allows of course.

QubesOS/qubes-issues#4186

[codecov]

Codecov Report

❌ Patch coverage is 61.11111% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.07%. Comparing base (a5ea121) to head (f38c1d4).
⚠️ Report is 13 commits behind head on main.

Files with missing lines	Patch %	Lines
qubesadmin/vm/__init__.py	44.44%	5 Missing ⚠️
qubesadmin/tools/qvm_run.py	77.77%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #403      +/-   ##
==========================================
- Coverage   76.10%   76.07%   -0.03%     
==========================================
  Files          53       53              
  Lines        9287     9305      +18     
==========================================
+ Hits         7068     7079      +11     
- Misses       2219     2226       +7     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[qubesos-bot]

OpenQA test summary

Complete test suite and dependencies: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2026011018-4.3-debian&flavor=pull-requests

Test run included the following:

• Add option to wait for GUI session qubes-app-linux-input-proxy#42 (QubesOS/qubes-app-linux-input-proxy@cd6d205)
• Clean up list options before passing them to GnuPG qubes-app-linux-split-gpg#111 (QubesOS/qubes-app-linux-split-gpg@6d97051)
• Add Arch packaging #332 (40487bc)
• use qubes.VMRootExec/qubes.VMRootShell services when root needed #403 (f38c1d4)
• tests: log more info on failure qubes-core-admin#736 (QubesOS/qubes-core-admin@a3fc21c)
• Wait for user session for preloaded disposables qubes-core-admin#757 (QubesOS/qubes-core-admin@7b42702)
• Discard preloaded disposables with outdated props qubes-core-admin#771 (QubesOS/qubes-core-admin@38d6003)
• Allow GUIVM clients to know if GUIVM has session qubes-core-agent-linux#625 (QubesOS/qubes-core-agent-linux@e7db241)
• dom0-update: put options after the dnf action qubes-core-agent-linux#630 (QubesOS/qubes-core-agent-linux@96876ff)
• Query GUIVM session or GUID from client in GUIVM qubes-core-qrexec#217 (QubesOS/qubes-core-qrexec@5dc1b28)
• Make icons bluer qubes-desktop-linux-manager#289 (QubesOS/qubes-desktop-linux-manager@de2020d)
• Delay connecting with gui-daemon until after starting Xorg qubes-gui-agent-linux#251 (QubesOS/qubes-gui-agent-linux@a981e36)
• Don't hang is-system-running when GUI is disabled qubes-gui-agent-linux#255 (QubesOS/qubes-gui-agent-linux@9129d1c)
• Make icons blue qubes-manager#441 (QubesOS/qubes-manager@793cb91)
• Allow GUIVM clients to know if GUIVM has session qubes-mgmt-salt-dom0-virtual-machines#88 (QubesOS/qubes-mgmt-salt-dom0-virtual-machines@4c3007f)
• Wait for GUI session on the server side qubes-notification-proxy#14 (QubesOS/qubes-notification-proxy@6da96ee)

New failures, excluding unstable

Compared to: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2025111104-4.3&flavor=update

Failed tests

No failures!

Fixed failures

Compared to: https://openqa.qubes-os.org/tests/158999#dependencies

10 fixed

• system_tests_dispvm

  • system_tests: Fail (unknown)
    Tests qubes.tests.integ.dispvm failed (exit code 1), details report...

  • system_tests: Failed (test died)
    # Test died: Some tests failed at qubesos/tests/system_tests.pm lin...

  • TC_20_DispVM_whonix-workstation-18: test_030_edit_file (failure)
    AssertionError: Timeout waiting for editor window

  • TC_20_DispVM_whonix-workstation-18: test_100_open_in_dispvm (failure)
    AssertionError: './open-file test.txt' failed with ./open-file test...

• system_tests_dispvm_perf@hw7

  • system_tests: Fail (unknown)
    Tests qubes.tests.integ.dispvm_perf failed (exit code 1), details r...

  • system_tests: Failed (test died)
    # Test died: Some tests failed at qubesos/tests/system_tests.pm lin...

  • TC_00_DispVMPerf_debian-13-xfce: test_411_dom0_dispvm_preload_gui_concurrent_api (failure)
    AssertionError: '/usr/lib/qubes/tests/dispvm_perf.py --dvm=test-ins...

  • TC_00_DispVMPerf_debian-13-xfce: test_900_reader (failure)
    AssertionError: '/usr/lib/qubes/tests/dispvm_perf_reader.py --templ...

  • TC_00_DispVMPerf_whonix-workstation-18: test_409_dom0_dispvm_preload_gui_api (failure)
    AssertionError: '/usr/lib/qubes/tests/dispvm_perf.py --dvm=test-ins...

  • TC_00_DispVMPerf_whonix-workstation-18: test_900_reader (failure)
    AssertionError: '/usr/lib/qubes/tests/dispvm_perf_reader.py --templ...

Unstable tests

Details

Performance Tests

Performance degradation:

No issues

Remaining performance tests:

13 tests

• debian-13-xfce_dom0-dispvm-api (mean:6.405): 76.86 🟢 ( previous job: 84.68, improvement: 90.77%)
• debian-13-xfce_dom0-dispvm-gui-api (mean:7.593): 91.12 🟢 ( previous job: 98.62, improvement: 92.39%)
• debian-13-xfce_dom0-dispvm-preload-2-api (mean:3.095): 37.14
• debian-13-xfce_dom0-dispvm-preload-2-delay-0-api (mean:2.92): 35.04
• debian-13-xfce_dom0-dispvm-preload-2-delay-minus-1d2-api (mean:3.168): 38.02
• debian-13-xfce_dom0-dispvm-preload-4-api (mean:2.607): 31.29
• debian-13-xfce_dom0-dispvm-preload-4-delay-0-api (mean:2.664): 31.97
• debian-13-xfce_dom0-dispvm-preload-4-delay-minus-1d2-api (mean:2.386): 28.63
• debian-13-xfce_dom0-dispvm-preload-2-gui-api (mean:4.493): 53.91
• debian-13-xfce_dom0-dispvm-preload-4-gui-api (mean:3.701): 44.41
• debian-13-xfce_dom0-dispvm-preload-6-gui-api (mean:3.167): 38.00
• debian-13-xfce_dom0-vm-api (mean:0.045): 0.54 🟢 ( previous job: 0.59, improvement: 91.20%)
• debian-13-xfce_dom0-vm-gui-api (mean:0.042): 0.50 🟢 ( previous job: 0.58, improvement: 86.87%)