Add privleap support#33
Conversation
Under Kicksecure and Whonix 18, sudo is no longer executable by "normal" users, and is only accessible when booting in a special "sysmaint mode". This prevents QVC from loading v4l2loopback. Kicksecure introduces a more limited escalation framework, privleap, which can be used by explicitly authorized normal users (including the `user` account present by default in most AppVMs). Add a privleap rule to QVC that allows users in the sudo, privleap, and qubes groups to load the v4l2loopback module on demand. If sudo is not executable or execution of sudo fails, try to use privleap instead.
OpenQA test summaryComplete test suite and dependencies: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2025111904-4.3&flavor=pull-requests Test run included the following:
Upload failures
New failures, excluding unstableCompared to: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2025111104-4.3&flavor=update
Failed tests30 failures
Fixed failuresCompared to: https://openqa.qubes-os.org/tests/158999#dependencies 13 fixed
Unstable testsDetailsPerformance TestsPerformance degradation:27 performance degradations
Remaining performance tests:150 tests
|
|
All of the whonixcheck failures show something like sys-whonix also spit out this: Not exactly sure what happened there. |
qubes.SetMonitorLayout service uses it. Reported at QubesOS/qubes-video-companion#33 (comment)
This looks to be caused by
This one is kinda expected for VMs started before user logs in. It's about notifications proxy, but at that time there is no notification daemon running in dom0 yet. This is a side effect of QubesOS/qubes-gui-agent-linux#251, as user session in VM starts earlier. |
Ah, good, those are the ones I was really worried about. I'll silence them in systemcheck then. It sounds like the other message will resolve itself automatically once your PR is merged, so I won't silence the corresponding warning for it. |
qubes.SetMonitorLayout service uses it. Reported at QubesOS/qubes-video-companion#33 (comment) (cherry picked from commit d689f6b)
3 participants
Under Kicksecure and Whonix 18, sudo is no longer executable by "normal" users, and is only accessible when booting in a special "sysmaint mode". This prevents QVC from loading v4l2loopback. Kicksecure introduces a more limited escalation framework, privleap, which can be used by explicitly authorized normal users (including the
useraccount present by default in most AppVMs).Add a privleap rule to QVC that allows users in the sudo, privleap, and qubes groups to load the v4l2loopback module on demand. If sudo is not executable or execution of sudo fails, try to use privleap instead.
Fixes: QubesOS/qubes-issues#10163