Backup: Restoring a qube with large root and private volumes fails due to scrypt error

[jharveyb]

Qubes OS version:

R4.0

Affected component(s):

qubes-backup-restore

---

Steps to reproduce the behavior:

Create a Standalone qube
Expand private volume to 100 GiB and root volume to 50 GiB
Fill both volumes to ~80% capacity
Create a backup without compression including this qube and ~10 other much smaller qubes such that this large qube is ~80% of the backup size
Freshly install Qubes on the same machine used to create the backup
Try to restore the large qube by itself after updating dom0 and restoring the other qubes

Expected behavior:

qube is restored successfully, with some delay due to the size of the qube.

Actual behavior:

The private volume seemed to restore to the correct size, but the restore tool finished returning errors from tar and scrypt. Specifically, on a particular chunk of the root.img, tar failed because scrypt failed to decrypt the chunk, reporting that "Decrypting the file would take too much CPU time."

General notes:

I fixed this by modifying line 235 of qubesadmin/backup/restore.py to
command_line = ['scrypt', action, '-f', input_name, output_name]

According to the scrypt manpage the -f flag disables the CPU time and memory usage estimate checking before decryption, which worked - I'm writing this from the restored qube. This machine has a i5-6300U and 16GB of RAM - which does not seem like an exceptionally slow platform for running Qubes.

The next largest qube I was restoring has a 20 GiB root volume that is at >85% capacity but restored without issue. The total backup size was ~160 GiB.

---

Related issues:

Possibly #3468

[qubesos-bot]

Automated announcement from builder-github

The package core-admin-client has been pushed to the r4.0 testing repository for the CentOS centos7 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package python2-qubesadmin-4.0.25-0.1.fc25 has been pushed to the r4.0 testing repository for dom0.
To test this update, please install it with the following command:

sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-admin-client_4.0.25-1 has been pushed to the r4.0 testing repository for the Debian template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing (or appropriate equivalent for your template version), then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package core-admin-client has been pushed to the r4.0 stable repository for the CentOS centos7 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package python2-qubesadmin-4.0.25-0.1.fc25 has been pushed to the r4.0 stable repository for dom0.
To install this update, please use the standard update command:

sudo qubes-dom0-update

Or update dom0 via Qubes Manager.

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-admin-client_4.0.25-1+deb9u1 has been pushed to the r4.0 stable repository for the Debian template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update