"Boot qube from DISK or block device" in Qube Settings doesn't work in 4.3

[faklapant23]

How to file a helpful issue

Qubes OS release

R4.3 rc1

Brief summary

"Boot qube from DISK or block device" in Qube Settings doesn't work Qubes OS 4.3 (clean install, dom0 updated to the latest testing updates).
Booting with ISO work fine from dom0 terminal using qvm-start with ISO from exposed loop device, so it's a problem with GUI.

Steps to reproduce

Try to boot from ISO in a standalone qube not based on a template using Qube Settings GUI.
The ISO is stored in the app qube based on a default debian-12-xfce template with latest updates.
When you go to the standalone qube's Qube Settings -> Advanced -> press on "Boot qube from DISK or block device" -> from file in qube -> select the qube and press a ... button -> it'll open a file selection dialog and you choose the ISO from this qube.
After confirming the chosen file, it'll display a window with this error:

[Dom0] Failed to display file selection dialog
Check if the qube storage can be started and has a file manager installed.

The same problem happens when using different ISOs.

Another issue is with booting "from existing block device".
Created loopback device with ISO in the qube:

sudo losetup -f /path/to/iso

Then try to boot it from the GUI, but choosing "from existing block device" instead of "from file in qube" this time.
It doesn't work as well.
After choosing block device and pressing OK, the Qube Settings closes, but the qube with this image doesn't start.

Expected behavior

It's possible to boot a standalone qube not based on a template with ISO using GUI.

Actual behavior

Both booting "from existing block device" and "from file in qube" in GUI don't work.

Additional information

[andrewdavidwong]

Possibly related: #4438

[ArrayBolt3]

Then try to boot it from the GUI, but choosing "from existing block device" instead of "from file in qube" this time.
It doesn't work as well.
After choosing block device and pressing OK, the Qube Settings closes, but the qube with this image doesn't start.

Can reproduce reliably on R4.3.0 rc3:

• Ensure sys-usb is running
• Insert into the system a USB drive that has previously had a hybrid-bootable ISO (such as Kicksecure's) flashed to it, ensure it shows up in the Qubes Devices widget
• Create a new standalone HVM qube named (for instance) ks-iso, ensure that both "Launch Qube Settings after creation" and "Install system from device (also available from settings)" are unchecked before clicking "Create new qube"
• In Qube Manager, click on the new HVM, and click Settings
• In the Basic tab, set system storage max size to 32 GB
• In the Advanced tab, set initial memory to 4000 MB and disable memory balancing
• Click "Apply"
• Click "Boot qube from DISC or block device"
• In the popup window, click "from existing block device"
• Select sys-usb:sda:<big long string here> as the device
• Click "OK"

Expected result: A notification should appear that "ks-iso" is starting, then a window for the VM's console should appear shortly thereafter.

Actual result: Both the "Boot ks-iso from device" and "Settings: ks-iso" windows vanish, then nothing happens thereafter. No notification, no VM console. Complete silent failure from a typical end-user standpoint.

If I run qubes-qube-manager in a terminal, then attempt to boot from the block device, I see the line Error: Got empty response from qubesd. See journalctl in dom0 for details. appear after clicking "OK" in the last step of the reproduction steps. Upon running journalctl --boot -u qubesd in dom0, I see the following line at the end of the log (typed manually, may contain typos):

Nov 27 00:14:155 dom0 qubesd[3313]: WARNING: protocol error for call b'admin.vm.device.block.Assign'+b'sys-usb+sda:154b:1006:071C4983299C2216:u080650:1.0:*' (b'dom0' → b'ks-iso') with payload of 184 bytes

[ben-grande]

@faklapant23 @ArrayBolt3 Fixed in:

• Deserialize device from qrexec arg properly qubes-core-admin#759

?

You can also emulate the GUI:

import qubesadmin, qubesmanager.utils
app = qubesadmin.Qubes(); domains = app.domains
qube = domains["sys-firewall"]
qubesmanager.utils.get_path_from_vm(qube, "qubes.SelectFile")

If the above doesn't long an exception, see following validations that you may try to run manually.

https://github.com/QubesOS/qubes-manager/blob/0ca0407c19d5653bcf152d8ff634586cb5784a3d/qubesmanager/utils.py#L460

Validations:

• strips whitespace on edges
• has 512 max length
• has a regex for allowed characters
• must be ascii encoded
• blocks path transversal and possibly symlinks