Fix bug in qubesvm.py incorrectly treating "False" config values as True#829
Merged
Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #829 +/- ##
==========================================
- Coverage 70.37% 70.37% -0.01%
==========================================
Files 61 61
Lines 14098 14100 +2
==========================================
+ Hits 9922 9923 +1
- Misses 4176 4177 +1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This was referenced Jun 15, 2026
OpenQA test summaryComplete test suite and dependencies: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2026061720-devel&flavor=pull-requests Test run included the following:
New failures, excluding unstableCompared to: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2026050504-devel&flavor=update
Failed tests20 failures
Fixed failuresCompared to: https://openqa.qubes-os.org/tests/176874#dependencies 27 fixed
Unstable testsDetails
Performance TestsPerformance degradation:26 performance degradations
Remaining performance tests:85 tests
|
This was referenced Jun 15, 2026
Contributor
Author
|
Tagging @marmarek |
Contributor
Author
|
New, related finding: The |
marmarek
approved these changes
Jun 18, 2026
Member
|
Nice catch, I'm surprised it didn't exploded in more ways before! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The code in qubesvm.py on lines ~1128-1150 incorrectly treats configuration values which are set to "False" in the XML. The "True" case is explicitly handled correctly,
but the "False" case falls through to
and since
bool("False") == True, this will result in incorrect behavior. I discovered this when analyzing suspiciously no-op behavior ofrw="False"in the qubes.xml configuration. The fix is simple, but it might have unintended side effects if someone relies on the buggy behavior. It is, of course, up to your discretion whether this is a problem.Specifically, the behavioral changes are:
Cannot connect to qrexec agent for 60 seconds, see /var/log/xen/console/guest-sys-firewall.log for details.3With all of this in mind, this seems to be a much bigger change than anticipated. However, as far as I understand
rw="False"is NOT used anywhere in Qubes by default. Therefore, even if this change is merged we would not be altering any default setups, and given that nobody has fixed this yet I don't think many people are using therwfunctionality in general. If you think this is worth a proper discussion, I'm ready to continue inqubes-devel.Footnotes
Causes a
FileNotFoundError: [Errno 2] No such file or directory: '/var/lib/qubes/vm-templates/TEMPLATE_NAME/root-cow.img'upon attempting to kill the qube IF after starting it, qubesd is restarted. Full sequence to reproduce:qvm-start sys-firewall && sudo systemctl restart qubesd && qvm-kill sys-firewall. Not unique to sys-firewall, similar issue occurs with sys-net. ↩I propose that this could be resolved by extending qubes_cow_setup.sh to handle /dev/xvdb (private /rw). ↩
I propose that this could be resolved by falling back to a RAM device backed by domU memory. ↩