Qubesd can be perma-crashed by setting devices_denied to an empty string

[marmarta]

How to file a helpful issue

Qubes OS release

r.4.3

Brief summary

Setting devices_denied to an empty string (in an attempt to clear this property) made my qubesd unable to start on next load.

Steps to reproduce

qvm-prefs VM_NAME devices_denied "m******"
qvm-prefs VM_NAME devices_denied ""

restart qubesd (for me it was complete system reboot), cry when qubesd fails to start.

Expected behavior

No explosions, empty string is a valid value.

Actual behavior

Pain, nothing starts, despair.
Output of journalctl -u qubesd:

[marmarta]

@piotrbartman look what I found 😆

[ben-grande]

Although this issue was created before #10254, I linked my PR QubesOS/qubes-core-admin#776 to that issue, so closing this as duplicate.

[github-actions]

This issue has been closed as a "duplicate." This means that another issue exists that is very similar to or subsumes this one. If any useful information on this issue is not already present on the other issue, please add it in a comment on the other issue. Here are some common cases of duplicate issues:

• The other issue is closed. The other issue being closed does not prevent this issue from duplicating it. We will examine the closed issue and, if appropriate, reopen it.
• The other issue is for a different Qubes release. We usually maintain only one issue for all affected Qubes releases.
• The other issue is very old. The mere age of an issue is not, by itself, a relevant factor when determining duplicates.

By default, the newer issue will be closed in favor of the older issue. However, we make exceptions when we determine that it would be significantly more useful to keep the newer issue open instead of the older one.

We respect the time and effort you have taken to file this issue, and we understand that this outcome may be unsatisfying. Please accept our sincere apologies and know that we greatly value your participation and membership in the Qubes community.

If anyone reading this believes that this issue was closed in error or that the resolution of "duplicate" is not accurate, please leave a comment below saying so, and we will review this issue again. For more information, see How issues get closed.