Archlinux: Build step `make template` results in `xenstore-read: xs_open: Permission denied`

[ejose19]

Qubes OS release

R4.1

Brief summary

When issuing the step 6 of the build guide (make template), it errors out with xenstore-read: xs_open: Permission denied, creating only the template rpm but not the install-templates.sh script

Steps to reproduce

• Follow the steps as stated in the guide
• Notice the error on make template command

Expected behavior

Step should finish successfully

Actual behavior

Step fails on stated error

Additional info

As stated in related issues (https://github.com/QubesOS/qubes-issues/issues/6324, https://github.com/QubesOS/qubes-issues/issues/6967), one needs to issue sudo chgrp qubes /dev/xen/* when the step is at: Checking for unpackaged file(s): /usr/lib/rpm/check-files ... for it to success, running it before make template doesn't fix the issue, so the root cause appears to be within make template step and not previous steps.

While further inspecting (running watch -n0.1 ls -la /dev/xen/ alongside make template, I see that the group changes from qubes to 972 during this step builder-archlinux/scripts/04_install_qubes.sh (around --> Installing mandatory qubes packages... / installation of qubes-vm-dependencies)

[ejose19]

With further experimenting, if I make this change to arch-chroot-lite:

diff --git a/scripts/arch-chroot-lite b/scripts/arch-chroot-lite
index b3e3573..2d6271a 100755
--- a/scripts/arch-chroot-lite
+++ b/scripts/arch-chroot-lite
@@ -89,6 +89,7 @@ chroot_setup() {
     # arch-chroot-lite will never have occasion to use efivars, so don't bother
     # mounting efivarfs here
     chroot_add_mount udev "$1/dev" -t devtmpfs -o mode=0755,nosuid &&
+    chroot_add_mount devxen "$1/dev/xen" -t devtmpfs -o mode=0755,nosuid,gid=98 &&
     chroot_add_mount devpts "$1/dev/pts" -t devpts -o mode=0620,gid=5,nosuid,noexec &&
     chroot_add_mount shm "$1/dev/shm" -t tmpfs -o mode=1777,nosuid,nodev &&
     chroot_add_mount run "$1/run" -t tmpfs -o nosuid,nodev,mode=0755 &&

/dev/xen/* never gets its group changed and the command finish without errors, however I'm not sure if this is just a workaround or a proper solution.

[DemiMarie]

@ejose19 have you done make get-sources recently? There was a recent switch to systemd-nspawn and that might have fixed the problem.

[ejose19]

@DemiMarie Yes, this was done yesterday on a fresh qube so the issue was not resolved by these changes

[DemiMarie]

Interesting! I will need to figure that out.

[unman]

I see the same error message building a debian-11 template, on Fedora 34. So not Arch specific.