Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

qubes.UpdatesProxy fails with "Refusing to execute executable service" error #9299

Closed
marmarek opened this issue Jun 12, 2024 · 21 comments · Fixed by QubesOS/qubes-core-qrexec#168
Closed

qubes.UpdatesProxy fails with "Refusing to execute executable service" error #9299

marmarek opened this issue Jun 12, 2024 · 21 comments · Fixed by QubesOS/qubes-core-qrexec#168
Labels
affects-4.2 This issue affects Qubes OS 4.2. C: updates diagnosed Technical diagnosis has been performed (see issue comments). P: default Priority: default. Default priority for new issues, to be replaced given sufficient information. pr submitted A pull request has been submitted for this issue. r4.2-host-stable r4.2-vm-bookworm-stable r4.2-vm-fc37-stable r4.2-vm-fc38-stable r4.2-vm-fc39-stable r4.2-vm-fc40-stable r4.2-vm-trixie-stable r4.3-host-cur-test r4.3-vm-bookworm-cur-test r4.3-vm-fc39-cur-test r4.3-vm-fc40-cur-test r4.3-vm-trixie-cur-test

Comments

@marmarek
Copy link
Member

marmarek commented Jun 12, 2024 •
edited by andrewdavidwong
Loading

Originally posted by @tvondra in #9151 (comment):

I think I ran into this issue today, after switching sys-net from fedora-38-xfce to fedora-39-xfce. Updating any template fails with this:

Updating fedora-39-xfce
Install requirements
Refreshing package info
Errors during downloading metadata for repository 'fedora':
  - Curl error (56): Failure when receiving data from the peer for https://mirrors.fedoraproject.org/metalink?repo=fedora-39&arch=x86_64 [Proxy CONNECT aborted]
Failed to download metadata for repo 'fedora': Cannot prepare internal mirrorlist: Curl error (56): Failure when receiving data from the peer for https://mirrors.fedoraproject.org/metalink?repo=fedora-39&arch=x86_64 [Proxy CONNECT aborted]

and restarting the sys-net VM, or the qubes-updates-proxy did not help at all.

journalctl on sys-net however shows this, which I did not see mentioned here:

Jun 12 19:18:29 sys-net qrexec-agent[1085]: 2024-06-12 19:18:29.792 qrexec-agent[1085]: qrexec-agent-data.c:242:handle_new_process_common: failed to spawn process
Jun 12 19:18:29 sys-net qrexec-agent[1085]: 2024-06-12 19:18:29.792 qrexec-agent[1085]: exec.c:751:find_qrexec_service: Refusing to execute executable service /etc/qubes-rpc/qubes.UpdatesPr>
Jun 12 19:18:29 sys-net qrexec-agent[1083]: 2024-06-12 19:18:29.673 qrexec-agent[1083]: qrexec-agent-data.c:242:handle_new_process_common: failed to spawn process
Jun 12 19:18:29 sys-net qrexec-agent[1083]: 2024-06-12 19:18:29.673 qrexec-agent[1083]: exec.c:751:find_qrexec_service: Refusing to execute executable service /etc/qubes-rpc/qubes.UpdatesPr>
Jun 12 19:18:29 sys-net qrexec-agent[1081]: 2024-06-12 19:18:29.537 qrexec-agent[1081]: qrexec-agent-data.c:242:handle_new_process_common: failed to spawn process
Jun 12 19:18:29 sys-net qrexec-agent[1081]: 2024-06-12 19:18:29.537 qrexec-agent[1081]: exec.c:751:find_qrexec_service: Refusing to execute executable service /etc/qubes-rpc/qubes.UpdatesPr>

The timestamps match the attempted template update. I have not found the reason for this, but switching sys-net to fedora-40-xfce resolved the issue for me for now.
@marmarek marmarek mentioned this issue Jun 12, 2024
Closed
@marmarek
Copy link
Member Author

Can you check what you have in /etc/qubes-rpc/qubes.UpdatesProxy ? It should be a symlink to /dev/tcp/127.0.0.1/8082. Maybe you have some modified version and it got created as .rpmnew file or such?

marmarek added a commit to marmarek/qubes-core-qrexec that referenced this issue Jun 12, 2024
@marmarek
Downgrade errors about incompatible service config to warnings
52a732d 
If service type is changed from socket to executable, some config
options are not applicable anymore. Do not fail execution but just log a
warning. This is also relevant for migration in the other direction - if
user has an executable service that is updated to a socket service, user
may want preserve the executable variant (which is also done by the
package manager if user has modified said service) - in which case, the
config for socket variant should not prevent this configuration from
working.

This has been reported to happen with qubes.UpdatesProxy service.

Fixes QubesOS/qubes-issues#9299
@marmarek marmarek mentioned this issue Jun 12, 2024
Merged
marmarek added a commit to marmarek/qubes-core-qrexec that referenced this issue Jun 12, 2024
@marmarek
Downgrade errors about incompatible service config to warnings
5a9f179 
If service type is changed from socket to executable, some config
options are not applicable anymore. Do not fail execution but just log a
warning. This is also relevant for migration in the other direction - if
user has an executable service that is updated to a socket service, user
may want preserve the executable variant (which is also done by the
package manager if user has modified said service) - in which case, the
config for socket variant should not prevent this configuration from
working.

This has been reported to happen with qubes.UpdatesProxy service.

Fixes QubesOS/qubes-issues#9299
@tvondra
Copy link

tvondra commented Jun 12, 2024

Interesting. In sys-net (running fedora-40-xfce) I see just this:

lrwxrwxrwx. 1 root root   23 May  9 02:00 qubes.UpdatesProxy -> /dev/tcp/127.0.0.1/8082

but in the fedora-39-xfce template I see this:

-rwxr-xr-x. 1 root root   37 Apr 10 22:32 qubes.UpdatesProxy
lrwxrwxrwx. 1 root root   23 May  9 02:00 qubes.UpdatesProxy.rpmnew -> /dev/tcp/127.0.0.1/8082

So yeah, there is a .rpmnew, but I really don't recall ever touching these files. But I see the qubes.UpdatesProxy contains this:

exec socat STDIO TCP4:127.0.0.1:8082

Could this be due to the fix to force IPv4?

@marmarek
Copy link
Member Author

marmarek commented Jun 12, 2024 •
edited
Loading

Could this be due to the fix to force IPv4?

Very likely.

Move qubes.UpdatesProxy.rpmnew over to qubes.UpdatesProxy.

@tvondra
Copy link

tvondra commented Jun 12, 2024

Yes, moving .rpmnew over to the original file fixed this and sys-net became usable with the f39 template for me. I'll keep using the f40 one anyway, I just wanted to test this.

@andrewdavidwong andrewdavidwong added T: bug P: default Priority: default. Default priority for new issues, to be replaced given sufficient information. diagnosed Technical diagnosis has been performed (see issue comments). pr submitted A pull request has been submitted for this issue. C: updates affects-4.2 This issue affects Qubes OS 4.2. labels Jun 13, 2024
@marmarek marmarek mentioned this issue Jun 13, 2024
Closed
@qubesos-bot qubesos-bot mentioned this issue Jun 14, 2024
Closed
@qubesos-bot
Copy link

Automated announcement from builder-github

The package core-qrexec has been pushed to the r4.3 testing repository for the Debian template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing bookworm-testing (or appropriate equivalent for your template version), then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

@qubesos-bot qubesos-bot mentioned this issue Jun 14, 2024
Closed
Closed
@qubesos-bot
Copy link

Automated announcement from builder-github

The package core-qrexec has been pushed to the r4.3 testing repository for the Debian template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing trixie-testing (or appropriate equivalent for your template version), then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

@qubesos-bot
Copy link

Automated announcement from builder-github

The package core-qrexec has been pushed to the r4.2 testing repository for the Debian template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing bookworm-testing (or appropriate equivalent for your template version), then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

@qubesos-bot
Copy link

Automated announcement from builder-github

The package core-qrexec has been pushed to the r4.2 testing repository for the Debian template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing trixie-testing (or appropriate equivalent for your template version), then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

@qubesos-bot
Copy link

Automated announcement from builder-github

The component core-qrexec (including package core-qrexec) has been pushed to the r4.3 testing repository for the Fedora template.
To test this update, please install it with the following command:

sudo dnf update --enablerepo=qubes-vm-r4.3-current-testing

Changes included in this update

@alimirjamali
Copy link

alimirjamali commented Jun 20, 2024 •
edited
Loading

Could this be due to the fix to force IPv4?

Very likely.

Move qubes.UpdatesProxy.rpmnew over to qubes.UpdatesProxy.

I just realized about the broken qubes.UpdateProxy and checked the templates. All Fedora templates (fedora-39-xfce, fedora-39-minimal, fedora-40-xfce, fedora-40-minimal) had the rpmnew ones and needed manual overwriting of the old socat solution with the new symlink. Is it normal?

@qubesos-bot
Copy link

Automated announcement from builder-github

The package core-qrexec has been pushed to the r4.2 stable repository for the Debian template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

@qubesos-bot
Copy link

Automated announcement from builder-github

The package core-qrexec has been pushed to the r4.2 stable repository for the Debian template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

@qubesos-bot qubesos-bot mentioned this issue Jun 27, 2024
Closed
@qubesos-bot
Copy link

Automated announcement from builder-github

The component core-qrexec (including package core-qrexec) has been pushed to the r4.2 testing repository for the Fedora template.
To test this update, please install it with the following command:

sudo dnf update --enablerepo=qubes-vm-r4.2-current-testing

Changes included in this update

@qubesos-bot
Copy link

Automated announcement from builder-github

The component core-qrexec (including package core-qrexec) has been pushed to the r4.2 testing repository for the Fedora template.
To test this update, please install it with the following command:

sudo dnf update --enablerepo=qubes-vm-r4.2-current-testing

Changes included in this update

@qubesos-bot
Copy link

Automated announcement from builder-github

The component core-qrexec (including package core-qrexec) has been pushed to the r4.2 testing repository for the Fedora template.
To test this update, please install it with the following command:

sudo dnf update --enablerepo=qubes-vm-r4.2-current-testing

Changes included in this update

@qubesos-bot
Copy link

Automated announcement from builder-github

The component core-qrexec (including package core-qrexec) has been pushed to the r4.2 testing repository for the Fedora template.
To test this update, please install it with the following command:

sudo dnf update --enablerepo=qubes-vm-r4.2-current-testing

Changes included in this update

@qubesos-bot
Copy link

Automated announcement from builder-github

The component core-qrexec (including package core-qrexec) has been pushed to the r4.2 stable repository for the Fedora template.
To install this update, please use the standard update command:

sudo dnf update

Changes included in this update

@qubesos-bot
Copy link

Automated announcement from builder-github

The component core-qrexec (including package core-qrexec) has been pushed to the r4.2 stable repository for the Fedora template.
To install this update, please use the standard update command:

sudo dnf update

Changes included in this update

@qubesos-bot
Copy link

Automated announcement from builder-github

The component core-qrexec (including package core-qrexec) has been pushed to the r4.2 stable repository for the Fedora template.
To install this update, please use the standard update command:

sudo dnf update

Changes included in this update

@qubesos-bot
Copy link

Automated announcement from builder-github

The component core-qrexec (including package core-qrexec) has been pushed to the r4.2 stable repository for the Fedora template.
To install this update, please use the standard update command:

sudo dnf update

Changes included in this update

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
affects-4.2 This issue affects Qubes OS 4.2. C: updates diagnosed Technical diagnosis has been performed (see issue comments). P: default Priority: default. Default priority for new issues, to be replaced given sufficient information. pr submitted A pull request has been submitted for this issue. r4.2-host-stable r4.2-vm-bookworm-stable r4.2-vm-fc37-stable r4.2-vm-fc38-stable r4.2-vm-fc39-stable r4.2-vm-fc40-stable r4.2-vm-trixie-stable r4.3-host-cur-test r4.3-vm-bookworm-cur-test r4.3-vm-fc39-cur-test r4.3-vm-fc40-cur-test r4.3-vm-trixie-cur-test
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Downgrade errors about incompatible service config to warnings marmarek/qubes-core-qrexec
5 participants
@tvondra @marmarek @alimirjamali @andrewdavidwong @qubesos-bot