search

QubesOS / qubes-issues

The Qubes OS Project issue tracker
https://www.qubes-os.org/doc/issue-tracking/
536 stars 48 forks source link

Can't attach Yubikey 4 or webcam to any qube after QSB#38 updates #3612

Open n1m1 opened 6 years ago

n1m1 commented 6 years ago

Qubes OS version:

4.0 rc4

Affected TemplateVMs:

dom0 debian-9 (work-gpg and voip VMs) fedor-26-minimal (sys-usb)

Steps to reproduce the behavior:

  1. I plug in a Yubikey 4 in sys-usb.
  2. I try to attach it to work-gpg. In dom0 I type

qvm-usb attach work-gpg sys-usb:2-1

Or

  1. I try to attach the webcam to a VM

qvm-usb attach voip sys-usb:2-8

Expected behavior:

Yubikey is attached to work-gpg and can be used in order to decrypt emails.

Webcam is attached to the voip vm and can be regularly used.

Actual behavior:

Can't attach Yubikey to work-gpg

In dom0 I get this output:

"Device attach failed: No device info received, connection failed, check backend side for details"

In work-gpg I get this output

Feb 20 15:13:42 localhost qrexec-agent[444]: executed root:QUBESRPC qubes.USBAttach dom0 pid 986
Feb 20 15:13:42 localhost systemd[1]: Created slice User Slice of root.
Feb 20 15:13:42 localhost systemd[1]: Starting User Manager for UID 0...
Feb 20 15:13:42 localhost systemd[1]: Started Session c9 of user root.
Feb 20 15:13:42 localhost systemd[987]: Starting D-Bus User Message Bus Socket.
Feb 20 15:13:42 localhost systemd[987]: Listening on GnuPG network certificate management daemon.
Feb 20 15:13:42 localhost systemd[987]: Reached target Timers.
Feb 20 15:13:42 localhost systemd[987]: Listening on GnuPG cryptographic agent (ssh-agent emulation).
Feb 20 15:13:42 localhost systemd[987]: Reached target Paths.
Feb 20 15:13:42 localhost systemd[987]: Listening on GnuPG cryptographic agent and passphrase cache (restricted).
Feb 20 15:13:42 localhost systemd[987]: Listening on GnuPG cryptographic agent (access for web browsers).
Feb 20 15:13:42 localhost systemd[987]: Listening on GnuPG cryptographic agent and passphrase cache.
Feb 20 15:13:42 localhost systemd[987]: Listening on D-Bus User Message Bus Socket.
Feb 20 15:13:42 localhost systemd[987]: Reached target Sockets.
Feb 20 15:13:42 localhost systemd[987]: Reached target Basic System.
Feb 20 15:13:42 localhost systemd[987]: Reached target Default.
Feb 20 15:13:42 localhost systemd[987]: Startup finished in 16ms.
Feb 20 15:13:42 localhost systemd[1]: Started User Manager for UID 0.
Feb 20 15:13:42 localhost qubes.USBAttach-dom0: No device info received, connection failed, check backend side for details
Feb 20 15:13:42 localhost qrexec-agent[444]: send exit code 1
Feb 20 15:13:42 localhost qrexec-agent[444]: pid 986 exited with 1
Feb 20 15:13:42 localhost qrexec-agent[444]: eintr
Feb 20 15:13:42 localhost systemd[1]: Stopping User Manager for UID 0...
Feb 20 15:13:42 localhost systemd[987]: Stopped target Default.
Feb 20 15:13:42 localhost systemd[987]: Stopped target Basic System.
Feb 20 15:13:42 localhost systemd[987]: Stopped target Timers.
Feb 20 15:13:42 localhost systemd[987]: Stopped target Paths.
Feb 20 15:13:42 localhost systemd[987]: Stopped target Sockets.
Feb 20 15:13:42 localhost systemd[987]: Closed GnuPG cryptographic agent (ssh-agent emulation).
Feb 20 15:13:42 localhost systemd[987]: Closed GnuPG cryptographic agent and passphrase cache (restricted).
Feb 20 15:13:42 localhost systemd[987]: Closed GnuPG network certificate management daemon.
Feb 20 15:13:42 localhost systemd[987]: Closed D-Bus User Message Bus Socket.
Feb 20 15:13:42 localhost systemd[987]: Closed GnuPG cryptographic agent and passphrase cache.
Feb 20 15:13:42 localhost systemd[987]: Closed GnuPG cryptographic agent (access for web browsers).
Feb 20 15:13:42 localhost systemd[987]: Reached target Shutdown.
Feb 20 15:13:42 localhost systemd[987]: Starting Exit the Session...
Feb 20 15:13:42 localhost systemd[987]: Received SIGRTMIN+24 from PID 1004 (kill).
Feb 20 15:13:42 localhost systemd[1]: Stopped User Manager for UID 0.
Feb 20 15:13:42 localhost systemd[1]: Removed slice User Slice of root.

Can't attach the webcam to a VM

In dom0 I get this error:

"Device attach failed: No device info received, connection failed, check backend side for details"

And in the voip VM I get this error:

Feb 20 19:40:49 localhost qrexec-agent[505]: executed root:QUBESRPC qubes.USBAttach dom0 pid 1890
Feb 20 19:40:49 localhost systemd[1]: Created slice User Slice of root.
Feb 20 19:40:49 localhost systemd[1]: Starting User Manager for UID 0...
Feb 20 19:40:49 localhost systemd[1]: Started Session c9 of user root.
Feb 20 19:40:49 localhost systemd[1891]: Listening on GnuPG cryptographic agent and passphrase cache (restricted).
Feb 20 19:40:49 localhost systemd[1891]: Listening on GnuPG cryptographic agent and passphrase cache.
Feb 20 19:40:49 localhost systemd[1891]: Listening on GnuPG network certificate management daemon.
Feb 20 19:40:49 localhost systemd[1891]: Listening on GnuPG cryptographic agent (access for web browsers).
Feb 20 19:40:49 localhost systemd[1891]: Listening on GnuPG cryptographic agent (ssh-agent emulation).
Feb 20 19:40:49 localhost systemd[1891]: Starting D-Bus User Message Bus Socket.
Feb 20 19:40:49 localhost systemd[1891]: Reached target Paths.
Feb 20 19:40:49 localhost systemd[1891]: Reached target Timers.
Feb 20 19:40:49 localhost systemd[1891]: Listening on D-Bus User Message Bus Socket.
Feb 20 19:40:49 localhost systemd[1891]: Reached target Sockets.
Feb 20 19:40:49 localhost systemd[1891]: Reached target Basic System.
Feb 20 19:40:49 localhost systemd[1891]: Reached target Default.
Feb 20 19:40:49 localhost systemd[1]: Started User Manager for UID 0.
Feb 20 19:40:49 localhost systemd[1891]: Startup finished in 19ms.
Feb 20 19:40:49 localhost qubes.USBAttach-dom0: No device info received, connection failed, check backend side for details
Feb 20 19:40:49 localhost qrexec-agent[505]: send exit code 1
Feb 20 19:40:49 localhost qrexec-agent[505]: pid 1890 exited with 1
Feb 20 19:40:49 localhost qrexec-agent[505]: eintr
Feb 20 19:40:49 localhost systemd[1891]: Stopped target Default.
Feb 20 19:40:49 localhost systemd[1891]: Stopped target Basic System.
Feb 20 19:40:49 localhost systemd[1891]: Stopped target Timers.
Feb 20 19:40:49 localhost systemd[1891]: Stopped target Sockets.
Feb 20 19:40:49 localhost systemd[1891]: Closed D-Bus User Message Bus Socket.
Feb 20 19:40:49 localhost systemd[1891]: Closed GnuPG cryptographic agent and passphrase cache (restricted).
Feb 20 19:40:49 localhost systemd[1891]: Closed GnuPG cryptographic agent (ssh-agent emulation).
Feb 20 19:40:49 localhost systemd[1891]: Closed GnuPG cryptographic agent and passphrase cache.
Feb 20 19:40:49 localhost systemd[1891]: Stopped target Paths.
Feb 20 19:40:49 localhost systemd[1891]: Closed GnuPG cryptographic agent (access for web browsers).
Feb 20 19:40:49 localhost systemd[1891]: Closed GnuPG network certificate management daemon.
Feb 20 19:40:49 localhost systemd[1891]: Reached target Shutdown.
Feb 20 19:40:49 localhost systemd[1891]: Starting Exit the Session...
Feb 20 19:40:49 localhost systemd[1]: Stopping User Manager for UID 0...
Feb 20 19:40:49 localhost systemd[1891]: Received SIGRTMIN+24 from PID 1908 (kill).
Feb 20 19:40:49 localhost systemd[1]: Stopped User Manager for UID 0.
Feb 20 19:40:49 localhost systemd[1]: Removed slice User Slice of root.

General notes:

Related issues:

andrewdavidwong commented 6 years ago

Duplicate of #3524

andrewdavidwong commented 6 years ago

This appears to be a duplicate of an existing issue. If you believe this is not really a duplicate, please leave a comment briefly explaining why. We'll be happy to take another look and, if appropriate, reopen this issue. Thank you.

n1m1 commented 6 years ago

Thanks for your answer and for taking care of this. Just one note: I might be wrong, but I am not sure that this issue is a duplicate of #3524 (even though it might be related). In my case, the problem turned up only after QSB 38 updates: before, either the webcam and my Yubikey were perfectly working and it was possible to attach them to VMs. Thanks.

na-- commented 6 years ago

I'm not sure that this is a duplicate as well. Yesterday evening I could attach a USB device to a VM without problems, this morning I updated dom0 and the templates with security-testing enabled to mitigate QSB 38 and right now I can't attach that same USB device that worked yesterday. I think that nothing else has been installed or changed in the configuration.

My error is a bit different though, qvm-device usb a vm-name sys-usb:<device> produces only Device attach failed:. That's it, no error message after. journalctl output in dom0 contains only qubes.USB+1-3: vm-name -> sys-usb: allowed to sys-usb.

Edit: journalctl in sys-usb has the error /usr/lib/qubes/usb-export: line 82: modprobe: command not found, so that seems promising. I'll investigate later and post if I can fix it.

rustybird commented 6 years ago

Edit: journalctl in sys-usb has the error /usr/lib/qubes/usb-export: line 82: modprobe: command not found, so that seems promising.

Sounds like a duplicate of a different issue: https://github.com/QubesOS/qubes-issues/issues/3615#issuecomment-367297613

na-- commented 6 years ago

Yeah, seems like it could be. Anyway, I edited /usr/lib/qubes/usb-export manually to use the full path of modprobe and the qvm-device usb a vm-name sys-usb:<device> issue didn't change. I don't have time to properly debug right now, will try later today.

na-- commented 6 years ago

I think this whole issue is caused by the root cause of #3615 ... I added export PATH="/sbin:/usr/sbin:/usr/local/sbin:${PATH:-/bin:/usr/bin:/usr/local/bin}" in the beginning of /usr/lib/qubes/usb-export in sys-usb (copied from @rustybird's temporary fixes of split-dm-crypt) and that solved the issue, USB devices can now be attached without problems.

I assume that some of the commits from here or here are responsible, maybe this.

na-- commented 6 years ago

Actually, when I tried to attach a USB device to a fedora-26 AppVM, it was also necessary to add export PATH="/sbin:/usr/sbin:/usr/local/sbin:${PATH:-/bin:/usr/bin:/usr/local/bin}" in the beginning of /usr/lib/qubes/usb-import in the AppVM as well as the change in sys-usb. The strange thing is that wasn't necessary for attaching USB devices to an Archlinux AppVM, possibly because of the somewhat different filesystem hierarchy in Arch.

n1m1 commented 6 years ago

Thanks. On my laptop the solution proposed by @na-- and based on @rustybird 's code seems to solve the problem for the Yubikey (in my case, it has been enough to modify/usr/lib/qubes/usb-export in sys-usb) but not for the webcam.

Indeed, if I try to attach the webcam to the voip VM,

  1. I get this output in/var/log/syslog:
Feb 21 22:32:01 localhost qrexec-agent[509]: executed root:QUBESRPC qubes.USBAttach dom0 pid 1606
Feb 21 22:32:01 localhost systemd[1]: Created slice User Slice of root.
Feb 21 22:32:01 localhost systemd[1]: Starting User Manager for UID 0...
Feb 21 22:32:01 localhost systemd[1]: Started Session c6 of user root.
Feb 21 22:32:01 localhost systemd[1607]: Listening on GnuPG network certificate management daemon.
Feb 21 22:32:01 localhost systemd[1607]: Listening on GnuPG cryptographic agent and passphrase cache.
Feb 21 22:32:01 localhost systemd[1607]: Starting D-Bus User Message Bus Socket.
Feb 21 22:32:01 localhost systemd[1607]: Reached target Timers.
Feb 21 22:32:01 localhost systemd[1607]: Listening on GnuPG cryptographic agent and passphrase cache (restricted).
Feb 21 22:32:01 localhost systemd[1607]: Listening on GnuPG cryptographic agent (ssh-agent emulation).
Feb 21 22:32:01 localhost systemd[1607]: Listening on GnuPG cryptographic agent (access for web browsers).
Feb 21 22:32:01 localhost systemd[1607]: Reached target Paths.
Feb 21 22:32:01 localhost systemd[1607]: Listening on D-Bus User Message Bus Socket.
Feb 21 22:32:01 localhost systemd[1607]: Reached target Sockets.
Feb 21 22:32:01 localhost systemd[1607]: Reached target Basic System.
Feb 21 22:32:01 localhost systemd[1607]: Reached target Default.
Feb 21 22:32:01 localhost systemd[1607]: Startup finished in 18ms.
Feb 21 22:32:01 localhost systemd[1]: Started User Manager for UID 0.
Feb 21 22:32:01 localhost kernel: [  517.462098] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(0)
Feb 21 22:32:01 localhost kernel: [  517.462115] vhci_hcd vhci_hcd.0: devid(65539) speed(3) speed_str(high-speed)
Feb 21 22:32:01 localhost kernel: [  517.681355] usb 1-1: new high-speed USB device number 3 using vhci_hcd
Feb 21 22:32:02 localhost kernel: [  517.796386] usb 1-1: SetAddress Request (3) to port 0
Feb 21 22:32:02 localhost kernel: [  517.857612] usb 1-1: New USB device found, idVendor=13d3, idProduct=5248
Feb 21 22:32:02 localhost kernel: [  517.857694] usb 1-1: New USB device strings: Mfr=3, Product=1, SerialNumber=2
Feb 21 22:32:02 localhost kernel: [  517.857774] usb 1-1: Product: Integrated Camera
Feb 21 22:32:02 localhost kernel: [  517.857834] usb 1-1: Manufacturer: Azurewave
Feb 21 22:32:02 localhost kernel: [  517.857884] usb 1-1: SerialNumber: NULL
Feb 21 22:32:02 localhost kernel: [  517.875492] uvcvideo: Found UVC 1.00 device Integrated Camera (13d3:5248)
Feb 21 22:32:02 localhost kernel: [  517.879009] uvcvideo: Failed to initialize entity for entity 6
Feb 21 22:32:02 localhost kernel: [  517.879031] uvcvideo: Failed to register entites (-22).
Feb 21 22:32:02 localhost kernel: [  517.879202] input: Integrated Camera: Integrated C as /devices/platform/vhci_hcd.0/usb1/1-1/1-1:1.0/input/input2
Feb 21 22:32:02 localhost mtp-probe: checking bus 1, device 3: "/sys/devices/platform/vhci_hcd.0/usb1/1-1"
Feb 21 22:32:02 localhost mtp-probe: bus: 1, device: 3 was not an MTP device
  1. The applet freezes. In order to unblock it I have to type in dom0

qvm-usb -d voip sys-usb:1-8

marmarek commented 6 years ago

@n1m1 does it also apply to yubikey after modifying usb-export script?

BTW the modification is not needed anymore if you update to qubes-core-agent 4.0.23

marmarek commented 6 years ago

Oh, you've said that already.

Anyway, check with qubes-core-agent updated.

n1m1 commented 6 years ago

Hello. I do apologize for the late answer but I've been very busy in the last two days.

qubes-core-agent 4.0.23 fixed the problem for Yubikey, but not for the webcam. I am experiencing the same behavior reported above. Actually, I noticed one more detail:

  1. When I try to attach the webcam to the voip VM using the USB applet it freezes.
  2. However, if I type qvm-usb in dom0 the webcam seems to be attached to the voip VM.
  3. In order to unblock the USB applet, I type qvm-usb d voip sys-usb:2-8
  4. The applet is now responsive again and, according to qvm-usb, the webcam is not attached anymore to voip VM.
  5. ... but, if now I plugin a USB device (i.e. a Yubikey or a USB stick), it is not detected by the USB applet (whereas I can see it in a dom0 terminal typing qvm-usb)
marmarek commented 6 years ago

Check ~/.xsession-errors in dom0 for any python stack trace (especially related to devices.py).

marmarek commented 6 years ago

You can also restart that widget and retry: look for process python3 -mqui.tray.devices, kill it and start again manually.

ThierryIT commented 6 years ago

Hi, I do have exactly the same problem. I am running Qubes 4 rc4. When speaking about qubes-core-agent, you are speaking about "qubes-core-dom0 version 4.0.23 ?

marmarek commented 6 years ago

Nope, the qubes-core-agent* packages in VM - check in both sys-usb and the VM where you attach the device to.

ThierryIT commented 6 years ago

Heu ... the original problem is that I cannot attached it (device attached failed) :) And even if I have done all the modifications from "na--" post, I do still have the same problem. My sys-usb has been done with the fedora-26 template.

What I have done: 1) clone fedora-26 template 2) change the default template in Qubes settings to the fedora-26 clone template 3) add all the modification to the clone template 4) building the sys-usb

When checking in my sys-usb, I can see that all the modifications have been taken into account.

ThierryIT commented 6 years ago

from the VM I would like to attached my device to ...

Feb 24 18:01:03 localhost systemd[2408]: Closed GnuPG network certificate management daemon.
Feb 24 18:01:03 localhost systemd[2408]: Closed GnuPG cryptographic agent and passphrase cache (restricted).
Feb 24 18:01:03 localhost systemd[2408]: Closed GnuPG cryptographic agent and passphrase cache.
Feb 24 18:01:03 localhost systemd[2408]: Closed GnuPG cryptographic agent (access for web browsers).
Feb 24 18:01:03 localhost systemd[2408]: Reached target Shutdown.
Feb 24 18:01:03 localhost systemd[2408]: Starting Exit the Session...
Feb 24 18:01:03 localhost systemd[2408]: Stopped target Paths.
Feb 24 18:01:03 localhost systemd[2408]: Received SIGRTMIN+24 from PID 2427 (kill).
Feb 24 18:01:03 localhost systemd[1]: Stopped User Manager for UID 0.
Feb 24 18:01:03 localhost systemd[1]: Removed slice User Slice of root.
Feb 24 18:01:52 localhost qrexec-agent[616]: executed root:QUBESRPC qubes.USBAttach dom0 pid 2437
Feb 24 18:01:52 localhost systemd[1]: Created slice User Slice of root.
Feb 24 18:01:52 localhost systemd[1]: Starting User Manager for UID 0...
Feb 24 18:01:52 localhost systemd[1]: Started Session c12 of user root.
Feb 24 18:01:52 localhost systemd[2438]: Reached target Paths.
Feb 24 18:01:52 localhost systemd[2438]: Listening on GnuPG cryptographic agent (ssh-agent emulation).
Feb 24 18:01:52 localhost systemd[2438]: Listening on GnuPG network certificate management daemon.
Feb 24 18:01:52 localhost systemd[2438]: Reached target Timers.
Feb 24 18:01:52 localhost systemd[2438]: Starting D-Bus User Message Bus Socket.
Feb 24 18:01:52 localhost systemd[2438]: Listening on GnuPG cryptographic agent (access for web browsers).
Feb 24 18:01:52 localhost systemd[2438]: Listening on GnuPG cryptographic agent and passphrase cache.
Feb 24 18:01:52 localhost systemd[2438]: Listening on GnuPG cryptographic agent and passphrase cache (restricted).
Feb 24 18:01:52 localhost systemd[2438]: Listening on D-Bus User Message Bus Socket.
Feb 24 18:01:52 localhost systemd[2438]: Reached target Sockets.
Feb 24 18:01:52 localhost systemd[2438]: Reached target Basic System.
Feb 24 18:01:52 localhost systemd[2438]: Reached target Default.
Feb 24 18:01:52 localhost systemd[2438]: Startup finished in 17ms.
Feb 24 18:01:52 localhost systemd[1]: Started User Manager for UID 0.
Feb 24 18:01:53 localhost qubes.USBAttach-dom0: No device info received, connection failed, check backend side for details
Feb 24 18:01:53 localhost qrexec-agent[616]: send exit code 1
Feb 24 18:01:53 localhost qrexec-agent[616]: pid 2437 exited with 1
Feb 24 18:01:53 localhost qrexec-agent[616]: eintr
Feb 24 18:01:53 localhost systemd[1]: Stopping User Manager for UID 0...
Feb 24 18:01:53 localhost systemd[2438]: Stopped target Default.
Feb 24 18:01:53 localhost systemd[2438]: Stopped target Basic System.
Feb 24 18:01:53 localhost systemd[2438]: Stopped target Timers.
Feb 24 18:01:53 localhost systemd[2438]: Stopped target Paths.
Feb 24 18:01:53 localhost systemd[2438]: Stopped target Sockets.
Feb 24 18:01:53 localhost systemd[2438]: Closed GnuPG cryptographic agent (ssh-agent emulation).
Feb 24 18:01:53 localhost systemd[2438]: Closed GnuPG cryptographic agent (access for web browsers).
Feb 24 18:01:53 localhost systemd[2438]: Closed GnuPG cryptographic agent and passphrase cache (restricted).
Feb 24 18:01:53 localhost systemd[2438]: Closed GnuPG cryptographic agent and passphrase cache.
Feb 24 18:01:53 localhost systemd[2438]: Closed GnuPG network certificate management daemon.
Feb 24 18:01:53 localhost systemd[2438]: Closed D-Bus User Message Bus Socket.
Feb 24 18:01:53 localhost systemd[2438]: Reached target Shutdown.
Feb 24 18:01:53 localhost systemd[2438]: Starting Exit the Session...
Feb 24 18:01:53 localhost systemd[2438]: Received SIGRTMIN+24 from PID 2457 (kill).
Feb 24 18:01:53 localhost systemd[1]: Stopped User Manager for UID 0.
marmarek commented 6 years ago

@ThierryIT do you get anything more useful from sys-usb at that time?

protoEvangelion commented 6 years ago

@marmarek Do I have to be running Qubes 4.0 to benefit from the updates of qubes-core-agent 4.0.23? Currently I am running Qubes 3.2

I am getting the same error reported by @n1m1 at the beginning of this issue:

"Device attach failed: No device info received, connection failed, check backend side for details"

marmarek commented 6 years ago

Equivalent qubes-core-agent version for 3.2 is 3.2.25

protoEvangelion commented 6 years ago

If I've updated my VMs through the Qubes VM Manager gui will that upgrade the core agent?

If not, are there docs on how to upgrade qubes-core-agent?

marmarek commented 6 years ago

By default it include only stable updates, see here for info about testing: https://www.qubes-os.org/doc/software-update-vm/#testing-repositories

protoEvangelion commented 6 years ago

@marmarek That fixed it for me thanks!

ThierryIT commented 6 years ago

@marmarek : I am updating my system through this command: qubes-dom0-update --enablerepo=qubes-dom0-current-testing Concerning sys-usb, I will provide what you need, I have done a new reinstall from the fedora-26 template but still do have the same pb. How to know the qubes-core-agent version my system is using ? Thx for your support

marmarek commented 6 years ago

Checking package version: Fedora: rpm -q qubes-core-agent Debian: dpkg -l qubes-core-agent

ThierryIT commented 6 years ago

Hi, It is not installed. When trying to install it in the template of my sys-usb, I do have:

marmarek commented 6 years ago

Are you sure if this is the template you've got with Qubes OS 4.0 installation? Isn't that a template restored from 3.2? On 3.2, the package was named qubes-core-vm.

ThierryIT commented 6 years ago

I don't remember it ... I am going to reinstall a new fedora-26 template. I will let you know.

ThierryIT commented 6 years ago

Ok, upgrade to the right fedora 26 template has been done, I am now running qubes-core-agent 4.0.23. But ....

qvm-block doesn't detect the Yubico

sudo qvm-usb usb a vm-comms sys-usb:3-2:

Device attached failed: /usr/lib/qubes/usb-import: 33: /usr/lib/qubes/usb-import: cannot open /sys/devices/platform/vhci_hcd Directory nonexistant ....

Same for line 51

usb-import doesn't exist

the logs of my targeting VM is strictely identical than what I have posted three days ago.

ThierryIT commented 6 years ago

After the upgrade of my targeted VM alias "vm-comms" I am able to attach the Yubico .... It seems that the packages "qubes-usb-proxy" has been updated too ....

How to mount it now ? xvdi doesn't exist

marmarek commented 6 years ago

Mount? Does Yubikey provide some storage? Mine doesn't, it's visible as HID device. You can try for example U2F on this site: https://demo.yubico.com/u2f

ThierryIT commented 6 years ago

Yubico working with "Chromium" but not with "Firefox-esr" ... What browser are you using to make it working ?

marmarek commented 6 years ago

Last time tried with Firefox 56 (with addon installed).

ThierryIT commented 6 years ago

In firefox u2f is not activated by defaut, you have to "about:config" in the URL and switch "security.webauth.u2f to "True"

marmarek commented 6 years ago

Does it solve the problem?

ThierryIT commented 6 years ago

Under Windows .... Yes :) Under Linux .... No, the device is not flashing if using firefox ...

marmarek commented 6 years ago

Fedora? Do you have u2f-hidraw-policy package installed? Try install it (run sudo udevadm control -R afterwards).

ThierryIT commented 6 years ago

Are you talking about the VM where the device is attached ? If yes, I am running Debian on it ...

marmarek commented 6 years ago

I believe equivalent files on Debian are in libu2f-host0 package, see here: https://wiki.debian.org/Smartcards/YubiKey4#udev

Anyway, after plugging it in, check permissions on /dev/hidraw*, and adjust if necessary - you should have read and write access.

ThierryIT commented 6 years ago

Is it not better to have a look there instead : https://www.yubico.com/support/knowledge-base/categories/articles/can-set-linux-system-use-u2f/

the device should be "hidraw" (Yubico link) not "usb" (debian link) no ?

Anf for the permission, I have to check the template that I have used to build my "sys-usb" ?

If yes, I do have for all my "hidraw*"

crw-------- root:root

marmarek commented 6 years ago

the device should be "hidraw" (Yubico link) not "usb" (debian link) no ?

Both should work.

If yes, I do have for all my "hidraw*"

crw-------- root:root

Try changing to 666 and try with firefox. If that helps, then it is permissions problem, if not - something else.

ThierryIT commented 6 years ago

There is no /dev/hidraw* in my template, so I have done the permissions change directly in my sys-usb but it doesn't work ... I will have to stay with Chromium I suppose :(

marmarek commented 6 years ago

No, in the VM where you have firefox running, after attaching yubikey there.

pgporada commented 4 years ago

Hi,

I'm having a similar issue to the OP. I use a split-gpg setup with private key material stored on a Yubikey 4. When I come to work in the morning I'll boot my laptop, sign into Qubes, open a terminal in dom0 to attach the Yubikey to a VM and go about my work. This has worked well for years now. Yesterday I ran a dom0 update as I typically do, rebooted my computer, and could no longer attach the Yubikey to sys-usb or any other VM.

[me@dom0 ~]$ sudo qubes-dom0-update --enablerepo=*

Versions:

[me@dom0 ~]$ cat /etc/qubes-release
Qubes release 4.0 (R4.0)
[user@sys-usb ~]$ cat /etc/fedora-release 
Fedora release 31 (Thirty One)

[user@sys-usb ~]$ uname -a
Linux sys-usb 5.7.4-1.qubes.x86_64 #1 SMP Sun Jun 21 04:00:58 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

[user@sys-usb ~]# rpm -q qubes-core-agent
qubes-core-agent-4.0.55-1.fc31.x86_64

View of USB devices plugged into my Qubes machine from sys-usb

[user@sys-usb ~]$ lsusb
Bus 003 Device 002: ID 05e3:0617 Genesys Logic, Inc. USB3.0 Hub
Bus 003 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 002 Device 005: ID 138a:0097 Validity Sensors, Inc. 
Bus 002 Device 003: ID 13d3:5682 IMC Networks Integrated Camera
Bus 002 Device 008: ID 1050:0407 Yubico.com Yubikey 4 OTP+U2F+CCID
Bus 002 Device 007: ID 04b4:0060 Cypress Semiconductor Corp. Wireless optical mouse
Bus 002 Device 006: ID 046d:c534 Logitech, Inc. Unifying Receiver
Bus 002 Device 002: ID 05e3:0610 Genesys Logic, Inc. 4-port hub
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 002: ID 0627:0001 Adomax Technology Co., Ltd QEMU USB Tablet
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Attempting to attach the Yubikey in dom0

[me@dom0 ~]$ qvm-usb | grep Yubico
sys-usb:2-1.4 Yubico_Yubikey_4_OTP+U2F+CCID

[me@dom0 ~]$  qvm-usb attach work-gpg sys-usb:2-1.4
Device attach failed: No device info received, connection failed, check backend side for details

Logs from sys-usb checking "backend side for details" from the error message above.

[user@sys-usb ~]$ sudo journalctl -f
...
Jun 23 09:46:12 sys-usb systemd[1]: Started User Manager for UID 0.
Jun 23 09:46:12 sys-usb systemd[1]: Started Session c7 of user root.
Jun 23 09:46:12 sys-usb systemd[2836]: Condition check resulted in Sound Service being skipped.
Jun 23 09:46:12 sys-usb systemd[2836]: Reached target Main User Target.
Jun 23 09:46:12 sys-usb systemd[2836]: Startup finished in 80ms.
Jun 23 09:46:12 sys-usb audit[2834]: USER_START pid=2834 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits,pam_systemd,pam_unix,pam_umask,pam_lastlog acct="root" exe="/usr/lib/qubes/qrexec-agent" hostname=? addr=? terminal=? res=success'
Jun 23 09:46:12 sys-usb qrexec-agent[2834]: pam_unix(qrexec:session): session opened for user root by (uid=0)
Jun 23 09:46:12 sys-usb qubes.USB+2-1.4-work-gpg[2870]: /usr/lib/qubes/usb-export: line 95: echo: write error: No such device
Jun 23 09:46:12 sys-usb qrexec-agent[2834]: pam_unix(qrexec:session): session closed for user root
Jun 23 09:46:12 sys-usb audit[2834]: USER_END pid=2834 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits,pam_systemd,pam_unix,pam_umask,pam_lastlog acct="root" exe="/usr/lib/qubes/qrexec-agent" hostname=? addr=? terminal=? res=success'
Jun 23 09:46:12 sys-usb audit[2834]: CRED_DISP pid=2834 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_rootok acct="root" exe="/usr/lib/qubes/qrexec-agent" hostname=? addr=? terminal=? res=success'
Jun 23 09:46:12 sys-usb qrexec-agent[1036]: send exit code 1
Jun 23 09:46:12 sys-usb qrexec-agent[1036]: pid 2834 exited with 1
Jun 23 09:46:12 sys-usb qrexec-agent[1036]: eintr
Jun 23 09:46:12 sys-usb systemd[1]: session-c7.scope: Succeeded.
Jun 23 09:46:23 sys-usb systemd[1]: Stopping User Manager for UID 0...
Jun 23 09:46:23 sys-usb systemd[2836]: Stopped target Main User Target.
Jun 23 09:46:23 sys-usb systemd[2836]: Stopped target Basic System.
Jun 23 09:46:23 sys-usb systemd[2836]: Stopped target Paths.
Jun 23 09:46:23 sys-usb systemd[2836]: Stopped target Sockets.
Jun 23 09:46:23 sys-usb systemd[2836]: Stopped target Timers.
Jun 23 09:46:23 sys-usb systemd[2836]: dbus.socket: Succeeded.
Jun 23 09:46:23 sys-usb systemd[2836]: Closed D-Bus User Message Bus Socket.
Jun 23 09:46:23 sys-usb systemd[2836]: pipewire.socket: Succeeded.
Jun 23 09:46:23 sys-usb systemd[2836]: Closed Multimedia System.
Jun 23 09:46:23 sys-usb systemd[2836]: Reached target Shutdown.
Jun 23 09:46:23 sys-usb systemd[2836]: systemd-exit.service: Succeeded.
Jun 23 09:46:23 sys-usb systemd[2836]: Started Exit the Session.
Jun 23 09:46:23 sys-usb systemd[2836]: Reached target Exit the Session.
...

I'm pretty sure this is the most relevant line from the logs

Jun 23 09:46:12 sys-usb qubes.USB+2-1.4-work-gpg[2870]: /usr/lib/qubes/usb-export: line 95: echo: write error: No such device

I'm not entirely sure what argument to pass into sys-usb /usr/ib/qubes/usb-export to try and tease out more information.

[root@sys-usb ~]$ /usr/lib/qubes/usb-export 2-1.4
/usr/lib/qubes/usb-export: line 85: kill: `': not a pid or valid job spec

[root@sys-usb ~]# ls -al /sys/bus/usb/devices/2-1.4
lrwxrwxrwx 1 root root 0 Jun 23 09:45 /sys/bus/usb/devices/2-1.4 -> ../../../devices/pci0000:00/0000:00:06.0/usb2/2-1/2-1.4

Edit: I added the following to /usr/lib/qubes/usb-export

# Request that both IN and OUT be handled on a single (stdin) socket
if [ -z "${QREXEC_AGENT_PID}" ]; then
        QREXEC_AGENT_PID=$(pgrep qrexec-agent)
fi
kill -USR1 "$QREXEC_AGENT_PID" || exit 1

and that allowed me to progress to 

[root@sys-usb ~]# QREXEC_AGENT_PID=1027 /usr/lib/qubes/usb-export 2-1.4
/usr/lib/qubes/usb-export: line 98: echo: write error: No such device

However, it appears that the device does exist.

[root@sys-usb ~]# ll /sys/bus/usb/drivers/usbip-host
total 0
--w------- 1 root root 4096 Jun 23 12:19 bind
-rw-r--r-- 1 root root 4096 Jun 23 12:19 match_busid
lrwxrwxrwx 1 root root    0 Jun 23 12:19 module -> ../../../../module/usbip_host
--w------- 1 root root 4096 Jun 23 12:19 rebind
--w------- 1 root root 4096 Jun 23 12:19 uevent
--w------- 1 root root 4096 Jun 23 12:19 unbind

Double Edit: It was a problem with the 5.7.4 kernel. I've switched back to a 5.6 kernel and sys-usb attachments are working.

andrewdavidwong commented 4 years ago

It was a problem with the 5.7.4 kernel. I've switched back to a 5.6 kernel and sys-usb attachments are working.

I'm glad you were able to find a workaround, but it sounds like your problem might be different from this issue.

hast0011 commented 3 years ago

I have a similar problem with my webcam in certain conditions. Don't know if that's related to update QSB#38

My webcam works fine within a virtualmachine1 (hvm) running fedora32. The pci-usb controller with the webcam is assigned to that virtualmachine1.

Once I forward the camera to another virtualmachine2, i.e. personal (pvh) the cam is not working there.

journalctl shows this...

Mar 18 18:18:28 personal systemd[1851]: Started Virtual filesystem service. Mar 18 18:18:28 personal kernel: vhci_hcd vhci_hcd.0: USB/IP Virtual Host Controller Mar 18 18:18:28 personal kernel: vhci_hcd vhci_hcd.0: new USB bus registered, assigned bus number 1 Mar 18 18:18:28 personal kernel: vhci_hcd: created sysfs vhci_hcd.0 Mar 18 18:18:28 personal kernel: usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 5.04 Mar 18 18:18:28 personal kernel: usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 Mar 18 18:18:28 personal kernel: usb usb1: Product: USB/IP Virtual Host Controller Mar 18 18:18:28 personal kernel: usb usb1: Manufacturer: Linux 5.4.98-1.fc25.qubes.x86_64 vhci_hcd Mar 18 18:18:28 personal kernel: usb usb1: SerialNumber: vhci_hcd.0 Mar 18 18:18:28 personal kernel: hub 1-0:1.0: USB hub found Mar 18 18:18:28 personal kernel: hub 1-0:1.0: 8 ports detected Mar 18 18:18:28 personal kernel: vhci_hcd vhci_hcd.0: USB/IP Virtual Host Controller Mar 18 18:18:28 personal kernel: vhci_hcd vhci_hcd.0: new USB bus registered, assigned bus number 2 Mar 18 18:18:28 personal kernel: usb usb2: We don't know the algorithms for LPM for this host, disabling LPM. Mar 18 18:18:28 personal kernel: usb usb2: New USB device found, idVendor=1d6b, idProduct=0003, bcdDevice= 5.04 Mar 18 18:18:28 personal kernel: usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 Mar 18 18:18:28 personal kernel: usb usb2: Product: USB/IP Virtual Host Controller Mar 18 18:18:28 personal kernel: usb usb2: Manufacturer: Linux 5.4.98-1.fc25.qubes.x86_64 vhci_hcd Mar 18 18:18:28 personal kernel: usb usb2: SerialNumber: vhci_hcd.0 Mar 18 18:18:28 personal kernel: hub 2-0:1.0: USB hub found Mar 18 18:18:28 personal kernel: hub 2-0:1.0: 8 ports detected Mar 18 18:18:29 personal kernel: vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(0) Mar 18 18:18:29 personal kernel: vhci_hcd vhci_hcd.0: devid(131074) speed(3) speed_str(high-speed) Mar 18 18:18:29 personal kernel: usb 1-1: new high-speed USB device number 2 using vhci_hcd Mar 18 18:18:29 personal kernel: usb 1-1: SetAddress Request (2) to port 0 Mar 18 18:18:29 personal kernel: usb 1-1: New USB device found, idVendor=046d, idProduct=09a6, bcdDevice= 0.09 Mar 18 18:18:29 personal kernel: usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=2 Mar 18 18:18:29 personal kernel: usb 1-1: SerialNumber: 0A17FD10 Mar 18 18:18:29 personal mtp-probe[1937]: checking bus 1, device 2: "/sys/devices/platform/vhci_hcd.0/usb1/1-1" Mar 18 18:18:29 personal mtp-probe[1937]: bus: 1, device: 2 was not an MTP device Mar 18 18:18:29 personal kernel: mc: Linux media interface: v0.10 Mar 18 18:18:29 personal kernel: videodev: Linux video capture interface: v2.00 Mar 18 18:18:30 personal kernel: usb 1-1: Warning! Unlikely big volume range (=5120), cval->res is probably wrong. Mar 18 18:18:30 personal kernel: usb 1-1: [5] FU [Mic Capture Volume] ch = 1, val = 2816/7936/1 Mar 18 18:18:30 personal kernel: usbcore: registered new interface driver snd-usb-audio Mar 18 18:18:30 personal kernel: uvcvideo: Found UVC 1.00 device (046d:09a6) Mar 18 18:18:30 personal kernel: input: UVC Camera (046d:09a6) as /devices/platform/vhci_hcd.0/usb1/1-1/1-1:1.0/input/input1 Mar 18 18:18:30 personal kernel: usbcore: registered new interface driver uvcvideo Mar 18 18:18:30 personal kernel: USB Video Class driver (1.1.1) Mar 18 18:18:30 personal mtp-probe[1977]: checking bus 1, device 2: "/sys/devices/platform/vhci_hcd.0/usb1/1-1" Mar 18 18:18:30 personal mtp-probe[1977]: bus: 1, device: 2 was not an MTP device Mar 18 18:18:30 personal kernel: vhci_hcd: unlink->seqnum 40 Mar 18 18:18:30 personal kernel: vhci_hcd: urb->status -104 Mar 18 18:18:30 personal kernel: vhci_hcd: unlink->seqnum 42 Mar 18 18:18:30 personal kernel: vhci_hcd: urb->status -104 Mar 18 18:18:30 personal systemd[1851]: Reached target Sound Card. Mar 18 18:18:30 personal kernel: audit: type=1130 audit(1616087910.257:92): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=alsa-state comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' Mar 18 18:18:30 personal audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=alsa-state comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' Mar 18 18:18:30 personal systemd[1]: Started Manage Sound Card State (restore and store). Mar 18 18:18:30 personal systemd[1]: Reached target Sound Card. Mar 18 18:18:30 personal systemd[609]: Reached target Sound Card. Mar 18 18:18:30 personal kernel: vhci_hcd: unlink->seqnum 44 Mar 18 18:18:30 personal kernel: vhci_hcd: urb->status -104 Mar 18 18:18:30 personal alsactl[1986]: alsactl 1.2.3 daemon started Mar 18 18:18:30 personal alsactl[1986]: /usr/sbin/alsactl: load_state:1683Cannot open /var/lib/alsa/asound.state for reading: No such file or directory Mar 18 18:18:30 personal alsactl[1986]: alsa-lib main.c:983:(snd_use_case_mgr_open) error: failed to import hw:0 use case configuration -2 Mar 18 18:18:30 personal alsactl[1986]: Found hardware: "USB-Audio" "USB Mixer" "USB046d:09a6" "" "" Mar 18 18:18:30 personal alsactl[1986]: Hardware is initialized using a generic method Mar 18 18:18:30 personal kernel: vhci_hcd: unlink->seqnum 46 Mar 18 18:18:30 personal kernel: vhci_hcd: urb->status -104 Mar 18 18:18:30 personal qrexec-agent[1849]: pam_unix(qrexec:session): session closed for user root Mar 18 18:18:30 personal audit[1849]: USER_END pid=1849 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits,pam_systemd,pam_unix,pam_umask,pam_lastlog acct="root" exe="/usr/lib/qubes/qrexec-agent" hostname=? addr=? terminal=? res=success' Mar 18 18:18:30 personal audit[1849]: CRED_DISP pid=1849 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_rootok acct="root" exe="/usr/lib/qubes/qrexec-agent" hostname=? addr=? terminal=? res=success' Mar 18 18:18:30 personal qrexec-agent[1847]: send exit code 0 Mar 18 18:18:30 personal qrexec-agent[1847]: pid 1849 exited with 0 Mar 18 18:18:30 personal qrexec-agent[446]: eintr Mar 18 18:18:30 personal pulseaudio[861]: Disabling timer-based scheduling because running inside a VM. Mar 18 18:18:30 personal rtkit-daemon[862]: Supervising 4 threads of 4 processes of 1 users. Mar 18 18:18:30 personal rtkit-daemon[862]: Successfully made thread 1991 of process 861 (/usr/bin/pulseaudio) owned by '1000' RT at priority 5. Mar 18 18:18:30 personal rtkit-daemon[862]: Supervising 5 threads of 4 processes of 1 users. Mar 18 18:18:30 personal kernel: usb usb1: Not yet implemented Mar 18 18:18:30 personal kernel: usb usb1: Not yet implemented Mar 18 18:18:30 personal kernel: usb usb1: Not yet implemented Mar 18 18:18:30 personal kernel: usb usb1: Not yet implemented Mar 18 18:18:30 personal kernel: usb usb1: Not yet implemented Mar 18 18:18:30 personal kernel: usb usb1: Not yet implemented Mar 18 18:18:30 personal kernel: usb usb1: Not yet implemented Mar 18 18:18:30 personal kernel: usb usb1: Not yet implemented Mar 18 18:18:30 personal kernel: usb usb1: Not yet implemented Mar 18 18:18:30 personal kernel: usb usb1: Not yet implemented Mar 18 18:18:35 personal kernel: vhci_get_frame_number: 4990 callbacks suppressed Mar 18 18:18:35 personal kernel: usb usb1: Not yet implemented Mar 18 18:18:35 personal kernel: usb usb1: Not yet implemented Mar 18 18:18:35 personal kernel: usb usb1: Not yet implemented Mar 18 18:18:35 personal kernel: usb usb1: Not yet implemented Mar 18 18:18:35 personal kernel: vhci_hcd: unlink->seqnum 5083 Mar 18 18:18:35 personal kernel: vhci_hcd: the urb (seqnum 5083) was already given back Mar 18 18:18:35 personal kernel: vhci_hcd: unlink->seqnum 5084 Mar 18 18:18:35 personal kernel: vhci_hcd: urb->status -104 Mar 18 18:18:35 personal kernel: vhci_hcd: unlink->seqnum 5085 Mar 18 18:18:35 personal kernel: vhci_hcd: urb->status -104 Mar 18 18:18:35 personal kernel: vhci_hcd: unlink->seqnum 5086 Mar 18 18:18:35 personal kernel: vhci_hcd: urb->status -104 Mar 18 18:18:35 personal kernel: vhci_hcd: unlink->seqnum 5087 Mar 18 18:18:35 personal kernel: vhci_hcd: urb->status -104 Mar 18 18:18:35 personal kernel: vhci_hcd: unlink->seqnum 5088 Mar 18 18:18:35 personal kernel: vhci_hcd: urb->status -104 Mar 18 18:18:35 personal kernel: vhci_hcd: unlink->seqnum 5089 Mar 18 18:18:35 personal kernel: vhci_hcd: urb->status -104 Mar 18 18:18:35 personal kernel: vhci_hcd: unlink->seqnum 5090 Mar 18 18:18:35 personal kernel: vhci_hcd: urb->status -104 Mar 18 18:18:35 personal kernel: vhci_hcd: unlink->seqnum 5091 Mar 18 18:18:35 personal kernel: vhci_hcd: urb->status -104 Mar 18 18:18:35 personal kernel: vhci_hcd: unlink->seqnum 5092 Mar 18 18:18:35 personal kernel: vhci_hcd: urb->status -104 Mar 18 18:18:35 personal kernel: vhci_hcd: unlink->seqnum 5093 Mar 18 18:18:35 personal kernel: vhci_hcd: urb->status -104 Mar 18 18:18:35 personal kernel: vhci_hcd: unlink->seqnum 5094 Mar 18 18:18:35 personal kernel: vhci_hcd: urb->status -104 Mar 18 18:18:46 personal xdg-desktop-por[1773]: Failed to get application states: GDBus.Error:org.freedesktop.portal.Error.Failed: Could not get window list

Then I switch the camera back to the virtualmachine1 (hvm) and it won't work there either. However when unplugging and reconnect it becomes functional again in the hvm.

Hope this helps to trace down the issue.

jamke commented 1 year ago

@hast0011 Maybe this will be useful #4035 as it looks similar.

andrewdavidwong commented 1 year ago

Is this still a problem in 4.1?

hast0011 commented 1 year ago

I can write what hardware I have and what works and what does not work. Maybe that's all not related to the original topic of this ticket. Conditions have changed since my last post and the behaviour is reproducable now.

There is a Logitech webcam connected to a PCI-USB card and the latest qubes updates are installed. (all on fedora 37 templates). The PCI-USB card is assigned to a HVM.

What works: Within that HVM the webcam works well and I can use skype or element or cheese app... I can "transfer" the webcam with "Qubes Devices" on the GUI to another PVM qube and it will work there. That is how I use now it and that is "OK"

Won't work: The way back from PVM to origianl HVM. I can't get back the webcam to the original HVM. That won't work until I restart the OS. My use case for that would be a "work VM" to use the webcam for work purpose and then back to HVM an possibly to a "private VM".

HMV ---------> PVM(work) ----x----> HVM ----------> PVM(privat)

x: not possible

Thank you for all the efforts and the good work:-) and I hope that helps.