date:20161210

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

On 2016-12-10 21:45, Andrew Morgan wrote:
> After testing again is seems as if that does fix the shutdown
> problem.
> 
> I'm shutting down through a dom0 `shutdown now`. Perhaps this isn't
> allowing Qubes to shutdown the VM properly on it's own?
> 

Yes, this is a known issue:

https://github.com/QubesOS/qubes-issues/issues/1581


P.S. - Please don't top-post.

> On December 10, 2016 8:37:04 PM PST, Andrew David Wong
>  wrote: On 2016-12-09 23:52, Andrew M wrote:
 Shutting down takes ages, and I often have to force shut-down
 after ~5m, though I see other users with the same problem so
 unknown if hardware specific.
 
> 
> Does dom0 shut down any faster if you shut down all domUs first?
> 

- -- 
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-BEGIN PGP SIGNATURE-

iQIcBAEBCgAGBQJYTPcbAAoJENtN07w5UDAw0o0P/if+2tfiQibudNjef1CL09a7
Zm+nAKPLamvH2J2yAPtr4xPXVHALofSbwwAxzVbxw6hIsrxmuCbv23wGpjb3u+To
D+NT0SVW8Gk+hGuLlWW1W1w3lVQsKZ8sHg2vbvMYUTIivRLcI9m+OyYzep+jqYig
oEPh17iS9xHJjFKea+nBnW6BybLjhXVq51pqToigjoxvMZwSeLv9ZQvx7UKX5ClH
MFXlVKloQUYtXYWAO/i68TICMcDivbqh2Lhem2fp1YAu0sdgT/03/St+7U+yhuCj
/ohgkt7yBDiA4hqgPpO1dUj7iATzheTPHlUuhEH99eq/lkrMS0hNQNpU2VXUXzey
8I3JEPhcfOX0Ernpe/lg6Kx2RqVUU0vR43o4bN8Emea8YOqlTK0cWwnST7SwXU2Z
8Azu/R7/hH13DDocmNtg1xnhNYxnKvCfLzDR8fGXtI+mLwPa9u0q1Y3UF4AKyTkp
I01TadNpT1a79fqlM0Dt51rj6jLMFtxZJVDuYaG2VZjj/6ODvF1yKGWEiTzIIeeu
SvrLqbQzujo4MDXPLV5bFdbHHEcYlzWXXxfEmV+xUh3uD4kby5UHGmEWB/2iH/e6
gmGo18M9jK7YDMu2MneUf5uGVVrgHT8FNUalHy/4oRIcfHP52xolSJi37GfOviDr
mIzHLGs1dhtL9GbcYIEN
=kRr3
-END PGP SIGNATURE-

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/3887387d-608d-e8f2-0593-4eab5e369a0d%40qubes-os.org.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] How to enable permanent full screen mode in appvm ?

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

On 2016-12-10 15:36, Marek Marczykowski-Górecki wrote:
> On Sat, Dec 10, 2016 at 02:40:11PM -0800, joe bobby wrote:
>> nothing really works mentioned here about enabling full screen
>> mode in my  fedora appvm.
> 
>> all I want is watch youtube videos in full screen. it does not
>> matter if I still have a colored bar on the top of my screen.
> 
>> just whenever I press full screen on youtube videos, the appvm
>> freezes...
> 
> 
> 
>> how to enable youtube fullscreen permanently without having to
>> type in a command every time?
> 
> Take a look here: https://www.qubes-os.org/doc/config-files/
> 

Also here:
https://www.qubes-os.org/doc/full-screen-mode/

- -- 
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-BEGIN PGP SIGNATURE-

iQIcBAEBCgAGBQJYTPXFAAoJENtN07w5UDAw/1kQAMLChwY4VpHlyyQSDBsdfG8e
LlF9OlNYnrobhCGov15UhVm2RTxKa/8ehb+xviLLMtV/nfIYvVZRSS8j3OR0Tl3z
m/gh5SK9/KrDpwmV5TTmDje2iCxiZfS1EiYPz4VnJtT47KVCViQ0J0JrCzDDuqCs
/hck5RpkKB8wQ1/4DQaH7/5NA/TFgHcRmojMZd3iq3E4GPckyXNyLxh0rF+6zd2G
7u7cbAwjpswAK6rJt9H79qpq0c/pf9+QGPFWP1yG1TNgQnqWMHHRRKuyec7WRsfh
MPGBjqHlYTaA3gAalBEbuVulpVBED0ewHB9PNIxpdnscwnJ1MjmjCXwreSpKqzh+
bQSkBIgM1vv5CN/p51iEfoJz++amDfakL7f0blEBTt3i6ngTC8sqNq6VV+nuanyx
pgTe0fnGzgtaUogTs1t4uzRyP9QiPh1Rw5ybuNJsltpNolLUfViODzyEU9KFZISj
XGH3LKyH5iZ6y6TSm1bOrKxWPua1Jy0AVNNH3lqE0sfPrs01tHEnIiwMerBxfgoX
Kronxk072posqtcPImka+5WOESZHy/24N978F30jasu83EszU5znWGL4lwoaJxBH
C5xBIvr6T2GeY5+p6/p2eK0FNntjEMSj4JezEo8HjwlzbM/3JCkTMIwigWVY1aRc
6tZt+nPhcVvlS0Njkcvt
=//or
-END PGP SIGNATURE-

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/a59abb3c-2869-7d0a-b1e7-ecd14c9accc1%40qubes-os.org.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] How to rollback Dom0 updates?

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

On 2016-12-10 01:51, Simon wrote:
> Hello everybody,
> 
> Is there a way to rollback updates which corrupted a Qubes-OS system?
> 
> I checked DNF history, but it seems to have been disabled / bypassed for all 
> events following the OS installation back in September:
> 
> - 8< --
> 
> [user@dom0 ~]$ sudo dnf history
> ID | Command line | Date and time| Action(s)  | 
> Altered
> ---
>  5 | --exclude=qubes-template | 2016-09-19 21:10 | Install|1  
> <
>  4 | remove cairo-dock-plug-i | 2016-09-07 18:19 | Erase  |   19 >
>  3 | --exclude=qubes-template | 2016-09-07 14:34 | Install|   14  
> <
>  2 | --exclude=qubes-template | 2016-09-07 14:24 | Install|5 
> ><
>  1 |  | 2016-09-04 17:57 | Install|  937 
> >E
> 
> - 8< --
> 
> Is there any equivalent feature allowing update rollback in Qubes-OS for the 
> Dom0 domain?
> 
> Thanks by advance,
> Simon. 

That's strange. My dom0 dnf history shows all my updates, including recent ones.

Are you sure your dom0 has been getting updated? How are you performing updates?

- -- 
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-BEGIN PGP SIGNATURE-

iQIcBAEBCgAGBQJYTPPUAAoJENtN07w5UDAwDr4P/3oO0gkaeH/x1grbCNe93Qa7
gzy50wk+8u1aF1KiJbJpDzJ2U3xsHC097paQU5nyP5jhmpfojB/V9M0VbSV5Kh3Q
r37l20z3cFL6xXjXENzH6ef5gNGwfLsJbWzBIOKJf8KWni5k/XMUetLUwm3Xv06S
/VxVZDkI5TYM1tpvU0MbNApJAwxGsEOm5+KUvqpWvpcrdBMDoygfSEXCoc+iEGfR
FbF+CIw3SgVY5l2NrfTQyRcrr9CYdBLtsByRQHOYhbymqSi1mL7WDMYmAxcoMphd
g2XCnlQUgrrsA3WuXXK2gM+i784uIdditvcKdhiBsMS6GcVt0XGYEHYnzGR8/A8h
asjwfxNTLVia3qt4zg5GTXDiCZPtK/04cN97lARMXleaf4zSDhfQ1hTqsqji+iRd
lx352Vby2KTvZE38eWJZG7Nc4X+OQxUfc5g2xpR7BJ14WZHejLK6iHimCKshDgNW
liF6sYGryPCFMtjTANh6lPS7LaN3tO/IJV2w27ayy1kOZtq+F8OigebaqIPhEy3s
22FsjXkn1+EhtclSvb/I4YwgI+Dg7STrIz54QIMR5yGDrd+V47tH2486+hBlgfTR
xddDdRhCFYtp452ie9orLZyBvFTC2Wh1XAVEka8EEoUANLkrEh/05DtZBdSC2owf
BA4wRJhNIFB4oKeXKK5a
=RT7P
-END PGP SIGNATURE-

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/64970928-c4d9-528d-c859-d852aaf8329a%40qubes-os.org.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] HCL - Lenovo Thinkpad T540p

2016-12-10 Thread Andrew Morgan

After testing again is seems as if that does fix the shutdown problem.

I'm shutting down through a dom0 `shutdown now`. Perhaps this isn't allowing 
Qubes to shutdown the VM properly on it's own?

On December 10, 2016 8:37:04 PM PST, Andrew David Wong  
wrote:
>-BEGIN PGP SIGNED MESSAGE-
>Hash: SHA512
>
>On 2016-12-09 23:52, Andrew M wrote:
>> Shutting down takes ages, and I often have to force shut-down after
>> ~5m, though I see other users with the same problem so unknown if
>> hardware specific.
>> 
>
>Does dom0 shut down any faster if you shut down all domUs first?
>
>- -- 
>Andrew David Wong (Axon)
>Community Manager, Qubes OS
>https://www.qubes-os.org
>-BEGIN PGP SIGNATURE-
>
>iQIcBAEBCgAGBQJYTNfuAAoJENtN07w5UDAwlH8QAKmYJ1OYn2IElPIWWF0NssQm
>U7ARTdsRlP+nFiUXJ+Gq+6uZsIBGhnR3ysIMM3VdiFJumKYlCJH18ucpzMAJz9WQ
>sfrp3CUM6CfVa6BrJYl8er8aRHjZrgcSpxK1b2RD4qrRKv0Z2mWkwFMfr4XE57rJ
>VRGaufWUzc8pISM0PDqJIwK8Up6o+urKmvcJrjxjpfzvU1T8vHYwKMEUjryS0wZr
>yhpp8+rrRKRYFnGO1fl8pnP/fecHCeRwv+700t9SCRhH0iwzdS3Yg6s3nluHHzat
>bbk1GKALLRmSOV4r/Xi5xrBk2NI5tTAIyl7ZCfYu+hwOQ8FcScoPoyn9eOb7CqtX
>TpWx1adLTdAyPaCuexRgRCQIT/Co8O2vshl+uMM8jecEXzBeluGX5Uwd2iWafg5+
>Wm0i18m/fmi1me0QOzRlVabVd7iysQWnjnf25Yx8NT2tbbDj6Ybjj9pgg59GmVKc
>cPpXgFlsfUoPv8UtpFSwpHusxwH+pWqYQlGxUDem2jcb7jqwcE3d0Bcdnvh2Dvro
>5RJY67dv2SLmGK1261T8A6CByZs1gfJfBtPUG25BA2y3YHpNwEgYZ5pxtMMJ8TA9
>ArJ71arUtgO2xik75oKwNdyF4DnmKvmyPpLiRN4Aw6D/3j0v/jxbNAAB/3sEFhZu
>U9q8372sAKTa1E5Mo8ck
>=c9s2
>-END PGP SIGNATURE-

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/08F15B51-E27A-4216-A64D-594574CF75AB%40openmailbox.org.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] HCL - Lenovo Thinkpad T540p

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

On 2016-12-09 23:52, Andrew M wrote:
> Shutting down takes ages, and I often have to force shut-down after
> ~5m, though I see other users with the same problem so unknown if
> hardware specific.
> 

Does dom0 shut down any faster if you shut down all domUs first?

- -- 
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-BEGIN PGP SIGNATURE-

iQIcBAEBCgAGBQJYTNfuAAoJENtN07w5UDAwlH8QAKmYJ1OYn2IElPIWWF0NssQm
U7ARTdsRlP+nFiUXJ+Gq+6uZsIBGhnR3ysIMM3VdiFJumKYlCJH18ucpzMAJz9WQ
sfrp3CUM6CfVa6BrJYl8er8aRHjZrgcSpxK1b2RD4qrRKv0Z2mWkwFMfr4XE57rJ
VRGaufWUzc8pISM0PDqJIwK8Up6o+urKmvcJrjxjpfzvU1T8vHYwKMEUjryS0wZr
yhpp8+rrRKRYFnGO1fl8pnP/fecHCeRwv+700t9SCRhH0iwzdS3Yg6s3nluHHzat
bbk1GKALLRmSOV4r/Xi5xrBk2NI5tTAIyl7ZCfYu+hwOQ8FcScoPoyn9eOb7CqtX
TpWx1adLTdAyPaCuexRgRCQIT/Co8O2vshl+uMM8jecEXzBeluGX5Uwd2iWafg5+
Wm0i18m/fmi1me0QOzRlVabVd7iysQWnjnf25Yx8NT2tbbDj6Ybjj9pgg59GmVKc
cPpXgFlsfUoPv8UtpFSwpHusxwH+pWqYQlGxUDem2jcb7jqwcE3d0Bcdnvh2Dvro
5RJY67dv2SLmGK1261T8A6CByZs1gfJfBtPUG25BA2y3YHpNwEgYZ5pxtMMJ8TA9
ArJ71arUtgO2xik75oKwNdyF4DnmKvmyPpLiRN4Aw6D/3j0v/jxbNAAB/3sEFhZu
U9q8372sAKTa1E5Mo8ck
=c9s2
-END PGP SIGNATURE-

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/b2fdc542-9819-e97e-d06a-0f539366200b%40qubes-os.org.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: FYI: Experimental Qubes coldkernel support now available

On 12/10/2016 08:42 PM, raahe...@gmail.com
wrote:

> 
> I'e had the problem of being green for a second and immediately turning 
> yellow with installing just a regular distro debian kernel with pvgrub.  In 
> other words the gui is not working, but you can verify the kernel is booting 
> properly with using sudo xl console VMNAME in dom0.   Marek says you have to 
> compile the u2mfn module and make sure its installed.  But I have no idea how 
> to do this.
> 

Ah, I see!

OK, I think I may know what *might* have happened.

I think the make script did try to do what it said in the instructions
here when it started to install the generated deb packages:

https://www.qubes-os.org/doc/managing-vm-kernel/

but I remember it throwing an error somewhere along the line saying it
couldn't find the kernel header files. But *that* was because it was
installing the kernel header file deb package afterwards; or in other
words, the gresecurity kernel header package wasn't installed yet at
that point in time. So maybe a step was missed.

That said, I now have a properly booting debian 8 template with a
gresecurity kernel. What you need to do is this:

After you follow the github instructions but before you reboot, run:

sudo dkms autoinstall -k 4.8.12-coldkernel-grsec-1
sudo update-initramfs -u
sudo update-grub2

which is essentially the final part of the "Installing kernel in Debian
VM" instructions. And then the machine should boot up fine when you
switch to the pvgrub2 kernel. Or, at least it did for me.

Thanks for the hint!!

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/o2ijj0%249m5%241%40blaine.gmane.org.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: How to enable permanent full screen mode in appvm ?

On Saturday, December 10, 2016 at 5:40:11 PM UTC-5, joe bobby wrote:
> nothing really works mentioned here about enabling
> full screen mode in my  fedora appvm.
> 
> all I want is watch youtube videos in full screen.
> it does not matter if I still have a colored bar on the top of my screen.
> 
> just whenever I press full screen on youtube videos, the appvm freezes...
> 
> 
> 
> how to enable youtube fullscreen permanently without having to type in a 
> command every time?

also,  firefox browsers freeze when fullscreen,  you have to use chrome or 
chromium.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/f07243fc-52c5-41f8-b9a4-cbc157fb2b98%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: How to enable permanent full screen mode in appvm ?

On Saturday, December 10, 2016 at 5:40:11 PM UTC-5, joe bobby wrote:
> nothing really works mentioned here about enabling
> full screen mode in my  fedora appvm.
> 
> all I want is watch youtube videos in full screen.
> it does not matter if I still have a colored bar on the top of my screen.
> 
> just whenever I press full screen on youtube videos, the appvm freezes...
> 
> 
> 
> how to enable youtube fullscreen permanently without having to type in a 
> command every time?

put vid player in full screen. then for xfce the top left of the colored window 
bar,  click and set to fullscreen.  To leave fullscreen,  hit alt+space

In kde to get fullscreen set alt f3 to get the options.  

I'm not sure if that button in top left of browser is contingent on what theme 
you are using. alt space might also be the shortcut to enter fullscreen on xfce.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/095dd5ee-40f4-4fd9-b70b-cbda3ee7c03d%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: HP PRINTER PROBLEM

On Saturday, December 10, 2016 at 2:52:25 PM UTC-5, higgin...@gmail.com wrote:
> Have Color Laser Jet Pro MFP M477fdw.
> 
> Works fine in my standard DEBIAN 8.6 setup - did a manual install of latest 
> HPLIP to achieve this.
> 
> 
> 
> Am experimenting with QUBES - and progressing OK - but just can't get printer 
> working.
> 
> Have tried full install of latest HPLIP within QUBES in Debian, similar in 
> Fedora - in templates and APPVm's.
> 
> Have tried to add USB controllers to particular VM's, read endless summaries 
> of problems for previous users - all to no avail.
> 
> Can anyone suggest a simple summary of actions that I can follow - so I can 
> get QUBES DEBIAN to recognise printer. 
> 
> 
> Thanks in advance.

make sure to shut down template and reboot appvm.  test the printer within the 
templatevm before trying in appvm,  temporarily allow it net access.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/fe29b388-6a3a-4a87-bb7d-a938818d299a%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: FYI: Experimental Qubes coldkernel support now available

On Saturday, December 10, 2016 at 10:24:47 PM UTC-5, Reg Tiangha wrote:
> On 12/10/2016 05:40 PM, Reg Tiangha wrote:
> 
> > Well, I'm currently in the middle of compiling it; haven't had to
> > compile a kernel since my Gentoo days and I've forgotten how long it
> > used to take. One piece of advice at this point: If you're using a fresh
> > template, you'll definitely want to allocate more space to /home; the
> > default 2GB isn't enough. I've doubled it to 4G and am keeping an eye on
> > how much it grows. I can't remember how much disk space it used to take
> > to compile an old Gentoo kernel so I'll be babysitting this one until
> > it's done.
> > 
> > In the meantime:
> > 
> > 1) I would assume it would work; their instructions imply Debian 7+, but
> > I suppose the only way to find out if it would work on a Debian 9
> > template under Qubes would be to compile it and find out.
> > 
> > 2) I've never used a Gresecurity kernel before (I almost did under
> > Gentoo but at the time, the kernel they were using was an older one
> > lacking a driver I needed so I ended up going with the vanilla sources
> > instead), but here's how the gresecurity folks feel in terms of how they
> > would stack up:
> > 
> > https://grsecurity.net/compare.php
> > 
> > If you want to try a regular 4.8 kernel either in dom0 or in a vm,
> > there's already one (4.8.12) in the Qubes unstable repository that you
> > can play with right now.
> > 
> > 
> 
> Just to update: It took about 5 hours to compile on my quad core 2.2GHz
> Intel i7-2720M, so your millage may vary. The coldkernel compile
> directory was about 3.2GB large after compilation, so you'll want to
> make sure your /home directory has at least 4.0GB free before attempting
> this. I used a fresh stock but updated debian-8 template vm to compile
> this on.
> 
> The machine boots, which is the good news. The bad news is that qrexec
> momentarily connects and then disconnects (i.e. the light turns green in
> Qubes VM Manager for about a second once it finishes booting, and then
> immediately turns yellow).
> 
> However, I didn't follow the instructions exactly as git said there was
> no tag marked coldkernel-0.9a-4.8.12 when I typed out the verify-tag and
> checkout commands as written. So I switched to the 0.9a branch instead
> using git checkout 0.9a. That said, I'm essentially a git newb. Did I do
> that part right or should I have done something else?
> 
> Anyway, I don't know much about gresecurity and paxctl either, so while
> I wait for someone else to post some success on this, there is lots to
> read up on in the meantime.

scroll down to installing kernel in debian vm 
https://www.qubes-os.org/doc/managing-vm-kernel/

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/f7c18222-0778-4908-88d3-39a4a3f6b6e1%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: FYI: Experimental Qubes coldkernel support now available

On Saturday, December 10, 2016 at 10:24:47 PM UTC-5, Reg Tiangha wrote:
> On 12/10/2016 05:40 PM, Reg Tiangha wrote:
> 
> > Well, I'm currently in the middle of compiling it; haven't had to
> > compile a kernel since my Gentoo days and I've forgotten how long it
> > used to take. One piece of advice at this point: If you're using a fresh
> > template, you'll definitely want to allocate more space to /home; the
> > default 2GB isn't enough. I've doubled it to 4G and am keeping an eye on
> > how much it grows. I can't remember how much disk space it used to take
> > to compile an old Gentoo kernel so I'll be babysitting this one until
> > it's done.
> > 
> > In the meantime:
> > 
> > 1) I would assume it would work; their instructions imply Debian 7+, but
> > I suppose the only way to find out if it would work on a Debian 9
> > template under Qubes would be to compile it and find out.
> > 
> > 2) I've never used a Gresecurity kernel before (I almost did under
> > Gentoo but at the time, the kernel they were using was an older one
> > lacking a driver I needed so I ended up going with the vanilla sources
> > instead), but here's how the gresecurity folks feel in terms of how they
> > would stack up:
> > 
> > https://grsecurity.net/compare.php
> > 
> > If you want to try a regular 4.8 kernel either in dom0 or in a vm,
> > there's already one (4.8.12) in the Qubes unstable repository that you
> > can play with right now.
> > 
> > 
> 
> Just to update: It took about 5 hours to compile on my quad core 2.2GHz
> Intel i7-2720M, so your millage may vary. The coldkernel compile
> directory was about 3.2GB large after compilation, so you'll want to
> make sure your /home directory has at least 4.0GB free before attempting
> this. I used a fresh stock but updated debian-8 template vm to compile
> this on.
> 
> The machine boots, which is the good news. The bad news is that qrexec
> momentarily connects and then disconnects (i.e. the light turns green in
> Qubes VM Manager for about a second once it finishes booting, and then
> immediately turns yellow).
> 
> However, I didn't follow the instructions exactly as git said there was
> no tag marked coldkernel-0.9a-4.8.12 when I typed out the verify-tag and
> checkout commands as written. So I switched to the 0.9a branch instead
> using git checkout 0.9a. That said, I'm essentially a git newb. Did I do
> that part right or should I have done something else?
> 
> Anyway, I don't know much about gresecurity and paxctl either, so while
> I wait for someone else to post some success on this, there is lots to
> read up on in the meantime.

I'e had the problem of being green for a second and immediately turning yellow 
with installing just a regular distro debian kernel with pvgrub.  In other 
words the gui is not working, but you can verify the kernel is booting properly 
with using sudo xl console VMNAME in dom0.   Marek says you have to compile the 
u2mfn module and make sure its installed.  But I have no idea how to do this.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/1d3cac4c-baea-45af-b0ef-a0cde1736fd2%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: FYI: Experimental Qubes coldkernel support now available

On 12/10/2016 05:40 PM, Reg Tiangha wrote:

> Well, I'm currently in the middle of compiling it; haven't had to
> compile a kernel since my Gentoo days and I've forgotten how long it
> used to take. One piece of advice at this point: If you're using a fresh
> template, you'll definitely want to allocate more space to /home; the
> default 2GB isn't enough. I've doubled it to 4G and am keeping an eye on
> how much it grows. I can't remember how much disk space it used to take
> to compile an old Gentoo kernel so I'll be babysitting this one until
> it's done.
> 
> In the meantime:
> 
> 1) I would assume it would work; their instructions imply Debian 7+, but
> I suppose the only way to find out if it would work on a Debian 9
> template under Qubes would be to compile it and find out.
> 
> 2) I've never used a Gresecurity kernel before (I almost did under
> Gentoo but at the time, the kernel they were using was an older one
> lacking a driver I needed so I ended up going with the vanilla sources
> instead), but here's how the gresecurity folks feel in terms of how they
> would stack up:
> 
> https://grsecurity.net/compare.php
> 
> If you want to try a regular 4.8 kernel either in dom0 or in a vm,
> there's already one (4.8.12) in the Qubes unstable repository that you
> can play with right now.
> 
> 

Just to update: It took about 5 hours to compile on my quad core 2.2GHz
Intel i7-2720M, so your millage may vary. The coldkernel compile
directory was about 3.2GB large after compilation, so you'll want to
make sure your /home directory has at least 4.0GB free before attempting
this. I used a fresh stock but updated debian-8 template vm to compile
this on.

The machine boots, which is the good news. The bad news is that qrexec
momentarily connects and then disconnects (i.e. the light turns green in
Qubes VM Manager for about a second once it finishes booting, and then
immediately turns yellow).

However, I didn't follow the instructions exactly as git said there was
no tag marked coldkernel-0.9a-4.8.12 when I typed out the verify-tag and
checkout commands as written. So I switched to the 0.9a branch instead
using git checkout 0.9a. That said, I'm essentially a git newb. Did I do
that part right or should I have done something else?

Anyway, I don't know much about gresecurity and paxctl either, so while
I wait for someone else to post some success on this, there is lots to
read up on in the meantime.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/o2igth%2453g%241%40blaine.gmane.org.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: off topic - invite codes to 'riseup'

2016-12-10 Thread notindoctrinated via qubes-users

On Tuesday, October 28, 2014 at 1:26:49 PM UTC-5, 
bm-2cu9wcijafoqtf6...@bitmessage.ch wrote:
> Dear qubes-users,
> 
> I am long time qubes follower and user. I apologize in advance if anyone 
> feels this request is spam.
> 

 I'm looking for two invite codes as well, can anyone help me out. Would be 
greatly appreciated ...


> I am looking for two invite codes needed to sign up to anonymous 
> riseup.net email service.
> 
> I am hoping there are some qubes users who are riseup.net account 
> holders.
> 
> Can anyone please send me a couple of invite codes that I might be able 
> to sign up?
> 
> Thank you in advance.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/12068960-c556-4602-bc19-97725182dc16%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: FYI: Experimental Qubes coldkernel support now available

On 12/10/2016 03:06 PM, Chris Laprise wrote:
> On 12/10/2016 03:36 PM, Reg Tiangha wrote:
>> I haven't tried it myself yet, but it looks like the coldkernel crew
>> pushed out experimental support for Debian templates to one of their
>> test branches yesterday:
>>
>> https://github.com/coldhakca/coldkernel/tree/0.9a
>>
>> Has anyone out there tried it yet? Thoughts, tips or tricks?
>>
> 
> I look forward to building this soon. Two questions:
> 
> 1. What probability it will work with Debian 9 Stretch?
> 
> 2. How does this compare to using newer (4.8+) kernels and AppArmor,
> which are two easy options for Qubes users?
> 
> Chris
> 

Well, I'm currently in the middle of compiling it; haven't had to
compile a kernel since my Gentoo days and I've forgotten how long it
used to take. One piece of advice at this point: If you're using a fresh
template, you'll definitely want to allocate more space to /home; the
default 2GB isn't enough. I've doubled it to 4G and am keeping an eye on
how much it grows. I can't remember how much disk space it used to take
to compile an old Gentoo kernel so I'll be babysitting this one until
it's done.

In the meantime:

1) I would assume it would work; their instructions imply Debian 7+, but
I suppose the only way to find out if it would work on a Debian 9
template under Qubes would be to compile it and find out.

2) I've never used a Gresecurity kernel before (I almost did under
Gentoo but at the time, the kernel they were using was an older one
lacking a driver I needed so I ended up going with the vanilla sources
instead), but here's how the gresecurity folks feel in terms of how they
would stack up:

https://grsecurity.net/compare.php

If you want to try a regular 4.8 kernel either in dom0 or in a vm,
there's already one (4.8.12) in the Qubes unstable repository that you
can play with right now.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/o2i7ab%24o46%241%40blaine.gmane.org.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] UEFI install menu loop

2016-12-10 Thread Lightning777

Hello

Trying to install Qubes os on my laptop in UEFI mode. However the grub boot 
menu only loops back to itself, each time showing this message momentarily. 

/EndEntire
file path: /ACPI(a0341d0,0)/PCI(2,1f)/Sata(2,,0)/File(\EFI\BOOT)
/File(xen.efi)
/endEntire


I have tried the direction here 
https://www.qubes-os.org/doc/uefi-troubleshooting/ but the installer will still 
not launch.

Has any one else had this happen to them, and managed to fix it?

Thank you

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/cbb556fb-f6a3-424d-92ac-dab0da68af91%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] How to enable permanent full screen mode in appvm ?

2016-12-10 Thread Marek Marczykowski-Górecki

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

On Sat, Dec 10, 2016 at 02:40:11PM -0800, joe bobby wrote:
> nothing really works mentioned here about enabling
> full screen mode in my  fedora appvm.
> 
> all I want is watch youtube videos in full screen.
> it does not matter if I still have a colored bar on the top of my screen.
> 
> just whenever I press full screen on youtube videos, the appvm freezes...
> 
> 
> 
> how to enable youtube fullscreen permanently without having to type in a 
> command every time?

Take a look here:
https://www.qubes-os.org/doc/config-files/

- -- 
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-BEGIN PGP SIGNATURE-
Version: GnuPG v2

iQEcBAEBCAAGBQJYTJF+AAoJENuP0xzK19csXhMH/ilucDcHdMs9rKNyOPadJ68q
EGX5rerDOJTETrC4G6ifTBl5/c9lhTq48YKB96Ebpkh/DyjM3xaHrgAlqFEIFjxR
on2SZDFmGYeLn81t5yHIv1/9d6eIct8gs3PDmQMNz515JleWHDjC72h/UUAdXPjd
vuL95bYcq4qmDjlL51wiO5+lv567efmgi3rSKZTAWF7nc0On6JrWLuvioDUEUz3e
LSkEnYvBatUQtHVaOxuLBakQzShXAQulODsKbljwe4oRmSucrQzkGAsZJgYeU0BY
SzIiWRB8/AHKlpR4AFONHHLFMlTIsHZQdY98f0gwq3F+QU+AVLEyAPkCBznjmW8=
=MbF5
-END PGP SIGNATURE-

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/20161210233630.GR16264%40mail-itl.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] How to enable permanent full screen mode in appvm ?

2016-12-10 Thread joe bobby

nothing really works mentioned here about enabling
full screen mode in my  fedora appvm.

all I want is watch youtube videos in full screen.
it does not matter if I still have a colored bar on the top of my screen.

just whenever I press full screen on youtube videos, the appvm freezes...



how to enable youtube fullscreen permanently without having to type in a 
command every time?

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/6eff5bab-114a-4c1a-9fad-f9b7e884f434%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: How can I put the installer on a new partition with win10 to install Qubes on an USB stick?

On Saturday, December 10, 2016 at 4:11:15 PM UTC-5, Reg Tiangha wrote: ...
> 
> Hmm...can that external hard drive be placed inside the laptop? If so,
> maybe remove the Windows drive, install the other hard drive, install
> Qubes to that and then take it out and use the BIOS to boot to it.
> 
> But if memory serves, I think you said that you already installed Qubes
> to a different hard drive? If you put that drive in an external
> enclosure, can you boot to it using the BIOS menu? If so, then problem
> solved.

yeah, tried that. The pointers go to internal hd... for the pointers to be 
correct, I'd have to install to the external hd. There are security 
implications, which I get/understand. None the less, I like Qubes and want to 
run it... I just don't want to have to swap hd(s) every time...

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/742ffe00-0271-446d-8755-492bfd04d370%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] USB hardware firewall

2016-12-10 Thread Robert Fisk

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

On 12/10/2016 08:25 AM, Marek Marczykowski-Górecki wrote:
> On Sun, Sep 04, 2016 at 06:35:42PM +1200, Robert Fisk wrote:
>> On 09/01/2016 06:55 PM, johnyju...@sigaint.org wrote:
>>> I was thinking earlier that some form of a "USB Firewall"
>>> hardware device might be cool to create; one that goes into
>>> each USB port in between each device and the PC, and only
>>> passes a specific device, or only a HID device (and doesn't
>>> permit a drive to add another HID identity).  Yet another side
>>> project for winter. :)  There may be existing products.
> 
> 
>> Ahem. Allow me to introduce you to a project I have been working
>> on for a while now:
> 
>> https://github.com/robertfisk/usg/wiki 
>> https://github.com/robertfisk/USG/wiki/FAQ
> 
>> The USG (which is Good, not Bad) is a hardware firewall for your
>> USB ports. It connects between your computer and your untrusted
>> USB device, isolating the badness with two dedicated processors.
> 
>> Features: - Isolates low-level USB exploits by using a simple
>> internal protocol with minimal attack surface
> 
>> - No hub support blocks 'hidden' malicious devices
> 
>> - Prevents devices changing their enumerated class after
>> connection, stopping malicious class changes.
> 
> 
>> Device support: mass storage (flash drives), keyboards, mice.
> 
>> Project status: You can build your own USG v0.9 hardware out of 
>> development boards if you are handy with a soldering iron. End
>> user hardware is approaching production-ready status, samples
>> will be available in the coming months.
> 
>> Feedback / pull requests / sales leads are welcome!
> 
> This project have great potential! The USB proxy hardware can be
> used for somehow more secure USB keyboard usage on Qubes OS, when
> only a single USB controller is available. Take a look at this
> idea[1]:
> 
> Have a piece of hardware plugged between USB keyboard and PC (based
> on https://github.com/robertfisk/USG?), to encrypt and
> integrity-protect the events. And then decrypt them in dom0 and
> check integrity protection, and only then pass them down to input
> devices stack. This should at least partially guard against
> malicious USB VM. It still will be able to perform timing based
> attacks to guess what you're typing - not sure how accurate such
> attacks are currently. Such device could introduce artificial delay
> (like - inject queued events every 50ms) to at least partially
> mitigate such attacks.
> 
> What do you think about it? I think the hardware you've designed
> is perfect for this!
> 
> [1] 
> https://github.com/QubesOS/qubes-issues/issues/2507#issuecomment-265894809
>
> 
> 

This sounds like a great idea, and I am keen to be involved. There is
plenty of flash space available on the embedded CPUs to implement some
form of encryption, although the best method of doing so on bare-metal
ARM is certainly open for discussion.

A recent batch of hardware samples sold out in November. Due to Real
Life(TM) the next batch of hardware is likely to be ready late January
or early February. Pricing is currently NZ$80 each (approx US$57).

Regards,
Robert
-BEGIN PGP SIGNATURE-
Version: GnuPG v2

iQIcBAEBCgAGBQJYTINVAAoJEN65WsAVra66UqgP/js8V9oHjYtsVs8wHhBs0Iq+
NL4pWUUtceGlCPBJZnKhmPM2Q7gNve3CS4K1i3JikSGIMw4BTqH59JqRmHIv1UDW
jH3DHfbGRLNXAJQTAUFQVV+M43rMQXcM0BT5xrTUdlwG8dQhe44cS+cW1BzmSBtn
FsszZVEp7UU6IJ/YZMYfEIbd/dhq92YBU5fU16F6PVdAFq8ObQoLCMPxWN8GLSKy
JgYkcRHiC2mjzYWN5hv+iZYFVWfxR33jkUoo7n2Iyaz27bYjHyKCy83sBsnhUaLg
Xr2+HJxGoxtScG9Q42ay1/40W5LQyhLRyvnYg1Yih1p18JrY54oe4k2F5jGnj953
giQri7lg6xWk9Md9rDRKvq7Xc2Kd6VdRAp1ooPfehGSIidGRdyYEAVttaqMxmZB3
7U1j35ELDTN3q79++LxnQr01yERsQHM6cKYQsog5/mOHtSG2+iOK2RoNK5M2fhQB
wrULmBTmwNruRGO+W2RBCcOZCvmP8WTthEb85BSVwHlrra6Vv02oFyAvDTj4Q8RI
NLV9HqwXILW1eICCoQUOzcW41SAYrn3ykX/eWgksg221Lks9RWzfxDItBXtrjXSR
pqKtbqRVZIT0k35GJug8RjTuG2JRaMbSEepblmWCvm9cN4bl/RRkOy9uRgfBLKsx
+k6vRfW54/ly/WT/XVJh
=1NhG
-END PGP SIGNATURE-

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/1fe8b1eb-4de2-ca63-c91f-4b5d3387bfeb%40fastmail.fm.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Re: Question to Mirage OS firewall users

2016-12-10 Thread Chris Laprise


On 12/10/2016 12:36 PM, rtian...@gmail.com wrote:

On Saturday, December 10, 2016 at 6:03:17 AM UTC-7, jkitt wrote:

What's it like to update - is it relatively simple? Would you say it's more 
secure than Debian or Fedora?

It's easy. Shut down your Mirage OS Firewall VMs, copy over the new kernel 
files to the relevant directory in /var/lib/qubes/vm-kernels in dom0, and then 
restart the Mirage firewalls.

However, I don't know if it's more secure than using a Debian or Fedora based 
sys-firewall; it *might* help guard against a 0 day cascade though.


My feeling is this is a good step in exploring minimal resource use and 
attack surface. But in this particular role--firewalls--the risk is 
fairly low. Qubes configures sys-firewall as 'green' I think for this 
reason.


Where this kind of minimization may be more valuable is in running 
high-risk VMs like sys-net and sys-usb, but that is understandably more 
complex.


Chris

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/7f0309d3-207b-6b0a-40ce-a02124572066%40openmailbox.org.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] FYI: Experimental Qubes coldkernel support now available

2016-12-10 Thread Chris Laprise


On 12/10/2016 03:36 PM, Reg Tiangha wrote:

I haven't tried it myself yet, but it looks like the coldkernel crew
pushed out experimental support for Debian templates to one of their
test branches yesterday:

https://github.com/coldhakca/coldkernel/tree/0.9a

Has anyone out there tried it yet? Thoughts, tips or tricks?



I look forward to building this soon. Two questions:

1. What probability it will work with Debian 9 Stretch?

2. How does this compare to using newer (4.8+) kernels and AppArmor, 
which are two easy options for Qubes users?


Chris

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/b7969745-989d-dc51-ea33-f57363617973%40openmailbox.org.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: HCL - Custom AMD APU build

> Plus I forgot to mention that my Tor browser in the Whonix app vm doesn't 
> work even though I did the Whonix check. It told me to update things through 
> the command line. So I did. Now it shows green on all checks. But it still 
> can't load a web page. Any help please?

I got Tor browser on Whonix vm to work by updating the whonix-ws template vm

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/79565e2b-d471-4f62-9353-607008674255%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: How can I put the installer on a new partition with win10 to install Qubes on an USB stick?

On Saturday, December 10, 2016 at 3:33:42 PM UTC-5, crane...@gmail.com wrote:
> On Saturday, December 10, 2016 at 1:35:11 PM UTC-5, Reg Tiangha wrote:
> ...
> > 
> > Well, if that laptop has at least two USB ports...
> 
> 
> Hadn't tried that... Thanks

What's up with the installer? The usb hd isn't even an option, just the hd...

What would happen if I pulled the hd, leaving only the usb hd? Oh, that doesn't 
work either... just says there's no media to install to... anyone with any 
other options?

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/7d44fcc8-e744-4ac0-92fa-bf11b166c8e7%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: HCL - Custom AMD APU build

On Saturday, December 10, 2016 at 1:40:13 AM UTC-8, Foppe de Haan wrote:

> Check out (dom0) ~/.gnome/apps/, ~/.config/menus/ and ~/.local/share/

Thank you. I cd into those directories and rm the old app vm files. It no 
longer shows up in my Xfce menu. Thanks again!

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/bd50eb4e-ff74-4ed7-b766-e71e7562fdee%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] FYI: Experimental Qubes coldkernel support now available

I haven't tried it myself yet, but it looks like the coldkernel crew
pushed out experimental support for Debian templates to one of their
test branches yesterday:

https://github.com/coldhakca/coldkernel/tree/0.9a

Has anyone out there tried it yet? Thoughts, tips or tricks?

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/o2hp14%24lgi%241%40blaine.gmane.org.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: How can I put the installer on a new partition with win10 to install Qubes on an USB stick?

On Saturday, December 10, 2016 at 1:35:11 PM UTC-5, Reg Tiangha wrote:
...
> 
> Well, if that laptop has at least two USB ports...


Hadn't tried that... Thanks

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/00681f61-cae5-4ef8-83ea-e190fdfac9ab%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: HCL - Custom AMD APU build

apg now works in app vms based on the template I installed apg from. I remember 
trying it before. I guess I just needed a reboot.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/71753e05-803e-4049-b61a-9cb2516517f2%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] HP PRINTER PROBLEM

2016-12-10 Thread higginsonjim2

Have Color Laser Jet Pro MFP M477fdw.

Works fine in my standard DEBIAN 8.6 setup - did a manual install of latest 
HPLIP to achieve this.



Am experimenting with QUBES - and progressing OK - but just can't get printer 
working.

Have tried full install of latest HPLIP within QUBES in Debian, similar in 
Fedora - in templates and APPVm's.

Have tried to add USB controllers to particular VM's, read endless summaries of 
problems for previous users - all to no avail.

Can anyone suggest a simple summary of actions that I can follow - so I can get 
QUBES DEBIAN to recognise printer. 


Thanks in advance.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/5e3f17e0-01b0-436b-82aa-a60136114fe6%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Chainloading to the Qubes bootloader

2016-12-10 Thread Marek Marczykowski-Górecki

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

On Tue, Dec 06, 2016 at 03:17:37PM -0800, justin.h.holg...@gmail.com wrote:
> On Tuesday, December 6, 2016 at 1:52:00 PM UTC-8, Marek Marczykowski-Górecki 
> wrote:
> > -BEGIN PGP SIGNED MESSAGE-
> > Hash: SHA256
> > 
> > On Tue, Dec 06, 2016 at 12:18:09PM -0800, justin.h.holg...@gmail.com wrote:
> > > My primary OS is Ubuntu and it's likely to stay that way (I need 
> > > vagrant/virtualbox for work), but I'd like to spend some time using Qubes 
> > > when I can. 
> > > 
> > > In my ideal setup, my laptop would boot into Ubuntu by default, but have 
> > > a grub entry to switch over to the Qubes bootloader on demand.
> > > 
> > > This setup isn't covered by https://www.qubes-os.org/doc/multiboot/ so I 
> > > figured I'd give it a shot myself.
> > > 
> > > I installed Qubes, but elected not to make the install device bootable 
> > > (since I want to keep Ubuntu in charge of booting). Then I found the 
> > > Qubes bootloader partition at /dev/sda7 and attempted to add a 
> > > chainloader entry to /etc/grub.d/40_custom like this:
> > > 
> > > menuentry "Qubes Chainloader" {
> > >   insmod chain
> > >   insmod ext2
> > >   set root=(hd0,gpt7)
> > >   chainloader /EFI/qubes/xen-4.6.1.efi
> > > }
> > > 
> > > I can select 'Qubes Chainloader' at the grub menu, but it just flashes a 
> > > message (I think it's something like "Loading xen-4.6.1.efi") for the 
> > > briefest instant before dumping me back into grub. For what it's worth, I 
> > > know it's at least finding the .efi file because it no longer complains 
> > > that it can't.
> > > 
> > > TL/DR: what can I put in /etc/grub.d/40_custom to chainload the Qubes 
> > > /boot partition at /dev/sda7?
> > 
> > Is /dev/sda7 your ESP? If so, remove 'set root' line.
> 
> I'm not sure it qualifies as "the" ESP (I don't know EFI very well), but 
> /dev/sda7 holds the Qubes /boot partition. It's not the partition that boots 
> by default; that would be /dev/sda1.
> 
> If I do remove the setroot line, how will grub know that xen.efi is on 
> /dev/sda7?

It will not know that. I think to work with this, you need to copy/move
EFI/qubes directory into your primary EFI partition.

- -- 
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-BEGIN PGP SIGNATURE-
Version: GnuPG v2

iQEcBAEBCAAGBQJYTFMZAAoJENuP0xzK19csfyEH/RGH5bu9bnb7YGz8gdzTGuZw
WFIisMOnjK9s9EyVber6XZTuo9ENbPY0picx9e/Wzhx5RfRES6z38C4aUsDcnHo2
1yAZCymxcAST/1qdRbboe4lLm+Ii76bDV9+8qBuZz4nW0kvqnMfoa0kZd2n/cIho
o98/tfAyGpvcFKFFGnM8SjuyvtlsnamA+0VydhqXT5eY4RHVFzxQRHEN1i5nJPSA
zVo3wJsUwdFrdW9UKZY6DlCKXFzAI41i8pMI29D/ELDffj55lQJZmyvWfzcjbr6P
tgAoRXToJvOu4Bxg/kMnf5Z0CEsOePz1JVwkX3/DJRDEqcAyXGNEVlSYuhxbbOY=
=+4kN
-END PGP SIGNATURE-

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/20161210191017.GO16264%40mail-itl.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Chainloading to the Qubes bootloader

On Tuesday, December 6, 2016 at 6:17:37 PM UTC-5, justin.h...@gmail.com wrote:
> > 
> > Is /dev/sda7 your ESP? If so, remove 'set root' line.
> 
> If I do remove the setroot line, how will grub know that xen.efi is on 
> /dev/sda7?

I'm waiting for that answer as well.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/256321c1-4dc4-4e40-ae7f-7e7769784e52%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: How can I put the installer on a new partition with win10 to install Qubes on an USB stick?

On 12/10/2016 11:20 AM,
crane.m...@gmail.com wrote:
> How can I put the installer on a new partition with win10 to install Qubes on 
> an USB stick?
> 
> I believe I can install to the USB, but I have no cdrom. The only option is 
> to run the installer from a bootable partiton on a windows10 hd.
> 
> I originally intalled Qubes from the installer from USB on a second hd. I 
> loved it.
> 
> The problem was, when the wife wanted to use her laptap, she wanted windows 
> 10. Then I had to put her hd back in. It would be easier for me, if I could 
> just put qubes on an usb stick and run from there.
> 
> I could do usb external hd or usb stick. I get/understand the security 
> warnings. But I like Qubes. I show it off to every one who will look. 
> 
> It would be nice to just clone Qubes from the #2 hd to usb, but all the 
> pointers would point back to the hd.
> 
> I considered installing Qubes to a partition on the same hd with windows but 
> I've read all the warnings and agree dual booting might not be such a good 
> idea. Yeah, that scares me.
> 
> Rufus sounded good except it only shows the USB.
> 

Well, if that laptop has at least two USB ports and you've got one USB
flash drive and an external USB hard drive, what you could do is use
Windows to copy the installer to the flash drive using Rufus or
UNetBootIn or something similar, then boot to the flash drive and then
install Qubes not onto the laptop hard drive, but onto the external hard
drive instead. I don't know where it'll end up installing grub, but if
it doesn't do it to the laptop hard drive, then you can just use the
BIOS menu to boot off of the external HD. I think that might work.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/o2hhkr%24bce%241%40blaine.gmane.org.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] How can I put the installer on a new partition with win10 to install Qubes on an USB stick?

How can I put the installer on a new partition with win10 to install Qubes on
an USB stick?

I believe I can install to the USB, but I have no cdrom. The only option is to
run the installer from a bootable partiton on a windows10 hd.

I originally intalled Qubes from the installer from USB on a second hd. I loved
it.

The problem was, when the wife wanted to use her laptap, she wanted windows 10.
Then I had to put her hd back in. It would be easier for me, if I could just
put qubes on an usb stick and run from there.

I could do usb external hd or usb stick. I get/understand the security
warnings. But I like Qubes. I show it off to every one who will look.

It would be nice to just clone Qubes from the #2 hd to usb, but all the
pointers would point back to the hd.

I considered installing Qubes to a partition on the same hd with windows but
I've read all the warnings and agree dual booting might not be such a good
idea. Yeah, that scares me.

Rufus sounded good except it only shows the USB.

--
You received this message because you are subscribed to the Google Groups
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/qubes-users/04c449e0-fbaa-442b-8baf-3b52d4d63a64%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: Question to Mirage OS firewall users

2016-12-10 Thread rtiangha

On Saturday, December 10, 2016 at 6:03:17 AM UTC-7, jkitt wrote:
> What's it like to update - is it relatively simple? Would you say it's more
> secure than Debian or Fedora?

It's easy. Shut down your Mirage OS Firewall VMs, copy over the new kernel
files to the relevant directory in /var/lib/qubes/vm-kernels in dom0, and then
restart the Mirage firewalls.

However, I don't know if it's more secure than using a Debian or Fedora based
sys-firewall; it *might* help guard against a 0 day cascade though.

That said, because the Mirage firewall doesn't seem to work with a dispVM (at
least for me, even running the latest code off of github), I still have
sys-firewall running in the background anyways. So what I do is run my
mirage-firewall behind sys-firewall (which in turn is behind sys-net). I don't
know if that's best practice or even has any effect in guarding against a 0-day
cascade, but things still work normally for the machines where I don't do any
custom vm iptables filter rules and the ram hit isn't too much (I use 32MB).

Note that if you're trying to compile the latest mirage firewall code from
github (which isn't reflected on the Release pages yet; there have been some
minor changes since the last one), it might be a bit tricky since if you follow
the default github instructions, the compilation will eventually fail as
mirage-nat tries to pull in older versions of its package dependencies by
default.

What I had to do was follow the github instructions until it failed, run 'opam
upgrade' to update what mirage-nat pulled in, then manually install the latest
version of the tcpip package by running 'opam install tcpip' and then finally
run 'opam install mirage-nat.' After that, following the rest of the github
instructions should be fine. That'll work with both the 4.02.3 OCAML compiler,
and the 4.03.0+flambda compiler. Compiling mirage-firewall won't work yet with
the 4.04 series compilers because the version of mirage-xen in the repository
only works with up to version 4.03. The code on mirage-xen's github page has
been updated to work with 4.04 a while back, but a release roll up hasn't been
pushed out to the repositories yet; not sure when that'll happen.

--
You received this message because you are subscribed to the Google Groups
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/qubes-users/811bb4e9-0f2a-46fa-96b8-7e8d1f6d190a%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Installing on macOS Macbook

2016-12-10 Thread Jean-Philippe Ouellet

On Fri, Dec 9, 2016 at 7:45 PM, Andrew David Wong  wrote:
> On 2016-12-08 21:11, Jean-Philippe Ouellet wrote:
>> On Thu, Dec 8, 2016 at 6:37 AM, Andrew David Wong wrote:
>>> Qubes isn't supported on VirtualBox or on Macbooks
>>
>> This is the first I've heard of MacBooks being "not supported".
>>
>
> By "not supported," I mean that there are a lot of known problems
> specific to Macbook compatibility, and we don't have any particular
> commitment to changing Qubes in order to fix/circumvent those problems.
>
>> I know at least one person personally who is currently running
>> Qubes on a recent (<2yo) MacBook, and it is completely usable.
>>
>
> "Not supported" does not (and has never) meant "unusable" or "cannot
> be done." I'm not sure why you would think it does. (Frankly, your
> interpretation is uncharitable, given that I pointed out that there
> are threads on accomplishing each one separately and that it might be
> possible through DIY hacking.)

Err, perhaps it came across wrong. My intention was simply to claim
from first-hand accounts that Qubes is in fact more usable on MacBooks
than it may be given credit for :)

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/CABQWM_CkemoEXbub9wXYAACSPQtvvzq7%2BTP%2BTNotb4EzzECOxA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Newbie surprises

2016-12-10 Thread Jean-Philippe Ouellet

Another (perhaps hacky solution) is to replace pacat-simple on dom0
with a script which invokes pacat-simple in sys-usb over qrexec. This
would have a much smaller attack surface than USB passthrough.

You may also need to configure some pulseaudio settings in sys-usb.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/CABQWM_DPBB%3Do6LENaFD-hhTqa17TtNbnrGk%3DPtdHU2ZozHyNWA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Question to Mirage OS firewall users

2016-12-10 Thread jkitt

What's it like to update - is it relatively simple? Would you say it's more 
secure than Debian or Fedora?

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/795512a4-318c-46c5-a0fc-1d6afea965e4%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] How to rollback Dom0 updates?

2016-12-10 Thread Simon


Hello everybody,

Is there a way to rollback updates which corrupted a Qubes-OS system?

I checked DNF history, but it seems to have been disabled / bypassed for 
all events following the OS installation back in September:


- 8< --

[user@dom0 ~]$ sudo dnf history
ID | Command line | Date and time| Action(s)  | 
Altered

---
 5 | --exclude=qubes-template | 2016-09-19 21:10 | Install|  
  1  <
 4 | remove cairo-dock-plug-i | 2016-09-07 18:19 | Erase  |  
 19 >
 3 | --exclude=qubes-template | 2016-09-07 14:34 | Install|  
 14  <
 2 | --exclude=qubes-template | 2016-09-07 14:24 | Install|  
  5 ><
 1 |  | 2016-09-04 17:57 | Install|  
937 >E


- 8< --

Is there any equivalent feature allowing update rollback in Qubes-OS for 
the Dom0 domain?


Thanks by advance,
Simon.

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/180ee5b747bdffc3c0d20e83853ba47f%40whitewinterwolf.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: HCL - Custom AMD APU build

2016-12-10 Thread Foppe de Haan

On Saturday, December 10, 2016 at 9:20:08 AM UTC+1, superlative wrote:
App VMs I've deleted still show up in the Xfce start menu. How do I get rid of 
those?

Check out (dom0) ~/.gnome/apps/, ~/.config/menus/ and ~/.local/share/

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/bce3fe9f-59f0-4d4d-a2ef-33ff1bbd8b62%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] HCL - Custom AMD APU build