Skip to content

Add device info to qrexec call argument #40

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Sep 17, 2025
Merged

Add device info to qrexec call argument #40

merged 1 commit into from
Sep 17, 2025

Conversation

marmarek
Copy link
Member

@marmarek marmarek commented Sep 4, 2025

This allows setting policy for individual devices, not only device
types. It relies on USB qube (or wherever the device is connected)
giving accurate device info, but since it's going to be granted at least
partial control it needs to be trusted to some degree anyway.

Build the device info based on type/vendor/product/revision (the PRODUCT
property) and physical location (USB controller + port in case of USB
device). The latter can be disabled, to build a policy that allows
given device in any port.

Fixes QubesOS/qubes-issues#3604

@qubesos-bot
Copy link

qubesos-bot commented Sep 5, 2025 •
edited
Loading

OpenQA test summary

Complete test suite and dependencies: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2025091715-4.3&flavor=pull-requests

Test run included the following:

Upload failures

  • system_tests_network_updates
    • system_tests: Failed (test died)
      # Test died: command 'curl --form upload=@tests-qubes.tests.integ.v...

New failures, excluding unstable

Compared to: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2025081011-4.3&flavor=update

  • system_tests_network

    • system_tests: Fail (unknown)
      Tests qubes.tests.integ.network failed (exit code 1), details repor...

    • VmNetworking_debian-13-xfce: test_001_simple_networking_paused (failure)
      AssertionError: 2 != 0 : Ping by IP on netvm=something -> netvm=som...

  • system_tests_backup

    • system_tests: Fail (unknown)
      Tests qubes.tests.integ.backup failed (exit code 1), details report...

    • TC_00_Backup: test_100_backup_dom0_no_restore (failure)
      AssertionError: QubesException during backup_prepare: Can not backu...

    • TC_00_Backup: test_101_backup_dom0_to_homedir (failure)
      AssertionError: QubesException during backup_prepare: Can not backu...

  • system_tests_network_ipv6

    • system_tests: Fail (unknown)
      Tests qubes.tests.integ.network_ipv6 failed (exit code 1), details ...

    • VmIPv6Networking_debian-13-xfce: test_501_ipv6_simple_networking_paused (failure)
      AssertionError: 2 != 0 : Ping by IP on netvm=something -> netvm=som...

    • VmIPv6Networking_fedora-42-xfce: test_501_ipv6_simple_networking_paused (failure)
      AssertionError: 2 != 0 : Ping by IP on netvm=something -> netvm=som...

  • system_tests_qwt_win10_seamless@hw13

    • windows_clipboard_and_filecopy: unnamed test (unknown)
    • windows_clipboard_and_filecopy: Failed (test died)
      # Test died: no candidate needle with tag(s) 'windows-Edge-address-...

  • system_tests_qwt_win11@hw13

    • windows_clipboard_and_filecopy: unnamed test (unknown)
    • windows_clipboard_and_filecopy: Failed (test died)
      # Test died: no candidate needle with tag(s) 'windows-menu-power' m...

  • system_tests_extra

    • TC_00_QVCTest_whonix-gateway-17: test_010_screenshare (failure)
      ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^... AssertionError: 0 == 0

  • system_tests_guivm_vnc_gui_interactive

    • guivm_manager: unnamed test (unknown)
    • guivm_manager: Failed (test died)
      # Test died: no candidate needle with tag(s) 'qubes-qube-manager' m...

Failed tests

17 failures

  • system_tests_network

    • system_tests: Fail (unknown)
      Tests qubes.tests.integ.network failed (exit code 1), details repor...

    • VmNetworking_debian-13-xfce: test_001_simple_networking_paused (failure)
      AssertionError: 2 != 0 : Ping by IP on netvm=something -> netvm=som...

  • system_tests_backup

    • system_tests: Fail (unknown)
      Tests qubes.tests.integ.backup failed (exit code 1), details report...

    • TC_00_Backup: test_100_backup_dom0_no_restore (failure)
      AssertionError: QubesException during backup_prepare: Can not backu...

    • TC_00_Backup: test_101_backup_dom0_to_homedir (failure)
      AssertionError: QubesException during backup_prepare: Can not backu...

  • system_tests_network_ipv6

    • system_tests: Fail (unknown)
      Tests qubes.tests.integ.network_ipv6 failed (exit code 1), details ...

    • VmIPv6Networking_debian-13-xfce: test_501_ipv6_simple_networking_paused (failure)
      AssertionError: 2 != 0 : Ping by IP on netvm=something -> netvm=som...

    • VmIPv6Networking_fedora-42-xfce: test_501_ipv6_simple_networking_paused (failure)
      AssertionError: 2 != 0 : Ping by IP on netvm=something -> netvm=som...

  • system_tests_qwt_win10_seamless@hw13

    • windows_clipboard_and_filecopy: unnamed test (unknown)
    • windows_clipboard_and_filecopy: Failed (test died)
      # Test died: no candidate needle with tag(s) 'windows-Edge-address-...

  • system_tests_qwt_win11@hw13

    • windows_clipboard_and_filecopy: unnamed test (unknown)
    • windows_clipboard_and_filecopy: Failed (test died)
      # Test died: no candidate needle with tag(s) 'windows-menu-power' m...

  • system_tests_extra

    • system_tests: Fail (unknown)
      Tests qubes.tests.extra failed (exit code 1), details reported sepa...

    • TC_00_QVCTest_whonix-gateway-17: test_010_screenshare (failure)
      ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^... AssertionError: 0 == 0

    • TC_00_QVCTest_whonix-workstation-17: test_010_screenshare (failure)
      AssertionError: 1 != 0 : Timeout waiting for /dev/video0 in test-in...

  • system_tests_guivm_vnc_gui_interactive

    • guivm_manager: unnamed test (unknown)
    • guivm_manager: Failed (test died)
      # Test died: no candidate needle with tag(s) 'qubes-qube-manager' m...

Fixed failures

Compared to: https://openqa.qubes-os.org/tests/149225#dependencies

84 fixed

  • system_tests_kde_gui_interactive

    • gui_keyboard_layout: wait_serial (wait serial expected)
      # wait_serial expected: "echo -e '[Layout]\nLayoutList=us,de' | sud...

    • gui_keyboard_layout: Failed (test died)
      # Test died: command 'test "$(cd ~user;ls e1*)" = "$(qvm-run -p wor...

  • system_tests_audio

    • system_tests: Fail (unknown)
      Tests qubes.tests.integ.audio failed (exit code 1), details reporte...

    • system_tests: Failed (test died)
      # Test died: Some tests failed at qubesos/tests/system_tests.pm lin...

    • TC_20_AudioVM_Pulse_whonix-workstation-17: test_223_audio_play_hvm (error)
      qubes.exc.QubesVMError: Cannot connect to qrexec agent for 120 seco...

    • TC_20_AudioVM_Pulse_whonix-workstation-17: test_224_audio_rec_muted_hvm (error)
      qubes.exc.QubesVMError: Cannot connect to qrexec agent for 120 seco...

    • TC_20_AudioVM_Pulse_whonix-workstation-17: test_225_audio_rec_unmuted_hvm (error)
      qubes.exc.QubesVMError: Cannot connect to qrexec agent for 120 seco...

    • TC_20_AudioVM_Pulse_whonix-workstation-17: test_252_audio_playback_audiovm_switch_hvm (error)
      qubes.exc.QubesVMError: Cannot connect to qrexec agent for 120 seco...

  • system_tests_audio@hw1

    • system_tests: Fail (unknown)
      Tests qubes.tests.integ.audio failed (exit code 1), details reporte...

    • system_tests: Failed (test died)
      # Test died: Some tests failed at qubesos/tests/system_tests.pm lin...

    • TC_20_AudioVM_Pulse_whonix-workstation-17: test_223_audio_play_hvm (error)
      qubes.exc.QubesVMError: Cannot connect to qrexec agent for 60 secon...

    • TC_20_AudioVM_Pulse_whonix-workstation-17: test_224_audio_rec_muted_hvm (error)
      qubes.exc.QubesVMError: Cannot connect to qrexec agent for 60 secon...

    • TC_20_AudioVM_Pulse_whonix-workstation-17: test_252_audio_playback_audiovm_switch_hvm (error)
      qubes.exc.QubesVMError: Cannot connect to qrexec agent for 60 secon...

  • system_tests_dispvm_perf@hw7

  • system_tests_guivm_gpu_gui_interactive@hw13

    • guivm_startup: wait_serial (wait serial expected)
      # wait_serial expected: qr/lEcbc-\d+-/...

    • guivm_startup: Failed (test died + timed out)
      # Test died: command '! qvm-check sys-whonix || time qvm-start sys-...

  • system_tests_dispvm

    • system_tests: Fail (unknown)
      Tests qubes.tests.integ.dispvm failed (exit code 1), details report...

    • system_tests: Failed (test died)
      # Test died: Some tests failed at qubesos/tests/system_tests.pm lin...

    • TC_20_DispVM_debian-13-xfce: test_012_preload_low_mem (failure)
      ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^... AssertionError: 1 != 0

    • TC_20_DispVM_debian-13-xfce: test_013_preload_gui (error)
      raise KeyError(key)... KeyError: 'disp3723'

    • TC_20_DispVM_debian-13-xfce: test_014_preload_nogui (error + cleanup)
      raise TimeoutError from exc_val... TimeoutError

    • TC_20_DispVM_debian-13-xfce: test_015_preload_race_more (error + cleanup)
      raise KeyError(key)... KeyError: 'disp1187'

    • TC_20_DispVM_debian-13-xfce: test_016_preload_race_less (failure + cleanup)
      ^^^^^^^^^^^^^^^^^^^^^^... AssertionError

    • TC_20_DispVM_debian-13-xfce: test_017_preload_autostart (error)
      raise KeyError(key)... KeyError: 'disp7317'

    • TC_20_DispVM_debian-13-xfce: test_018_preload_global (error)
      raise KeyError(key)... KeyError: 'disp8572'

    • TC_20_DispVM_debian-13-xfce: test_019_preload_refresh (error)
      raise KeyError(key)... KeyError: 'disp6425'

    • TC_20_DispVM_fedora-42-xfce: test_012_preload_low_mem (failure)
      ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^... AssertionError: 1 != 0

    • TC_20_DispVM_whonix-workstation-17: test_012_preload_low_mem (failure)
      ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^... AssertionError: 1 != 0

  • system_tests_basic_vm_qrexec_gui_ext4

    • system_tests: Fail (unknown)
      Tests qubes.tests.integ.vm_qrexec_gui failed (exit code 1), details...

    • TC_20_NonAudio_whonix-gateway-17-pool: test_012_qubes_desktop_run (error + cleanup)
      raise TimeoutError from exc_val... TimeoutError

Unstable tests

Performance Tests

Performance degradation:

14 performance degradations
  • whonix-workstation-17_exec-data-simplex: 73.50 🔻 ( previous job: 66.80, degradation: 110.03%)
  • dom0_root_seq1m_q8t1_write 3:write_bandwidth_kb: 116292.00 🔻 ( previous job: 265260.00, degradation: 43.84%)
  • dom0_root_seq1m_q1t1_read 3:read_bandwidth_kb: 88660.00 🔻 ( previous job: 431512.00, degradation: 20.55%)
  • dom0_root_seq1m_q1t1_write 3:write_bandwidth_kb: 103401.00 🔻 ( previous job: 196254.00, degradation: 52.69%)
  • dom0_root_rnd4k_q32t1_read 3:read_bandwidth_kb: 10191.00 🔻 ( previous job: 23940.00, degradation: 42.57%)
  • fedora-42-xfce_root_seq1m_q8t1_write 3:write_bandwidth_kb: 90162.00 🔻 ( previous job: 140215.00, degradation: 64.30%)
  • fedora-42-xfce_root_seq1m_q1t1_write 3:write_bandwidth_kb: 30177.00 🔻 ( previous job: 47575.00, degradation: 63.43%)
  • fedora-42-xfce_root_rnd4k_q32t1_write 3:write_bandwidth_kb: 2352.00 🔻 ( previous job: 3020.00, degradation: 77.88%)
  • fedora-42-xfce_root_rnd4k_q1t1_write 3:write_bandwidth_kb: 998.00 🔻 ( previous job: 1368.00, degradation: 72.95%)
  • fedora-42-xfce_private_seq1m_q8t1_read 3:read_bandwidth_kb: 345836.00 🔻 ( previous job: 387500.00, degradation: 89.25%)
  • fedora-42-xfce_volatile_seq1m_q8t1_read 3:read_bandwidth_kb: 342112.00 🔻 ( previous job: 383531.00, degradation: 89.20%)
  • fedora-42-xfce_volatile_seq1m_q1t1_write 3:write_bandwidth_kb: 16650.00 🔻 ( previous job: 64217.00, degradation: 25.93%)
  • fedora-42-xfce_volatile_rnd4k_q32t1_write 3:write_bandwidth_kb: 2332.00 🔻 ( previous job: 4098.00, degradation: 56.91%)
  • fedora-42-xfce_volatile_rnd4k_q1t1_write 3:write_bandwidth_kb: 1307.00 🔻 ( previous job: 2384.00, degradation: 54.82%)

Remaining performance tests:

160 tests
  • debian-13-xfce_exec: 7.49 🟢 ( previous job: 8.36, improvement: 89.57%)
  • debian-13-xfce_exec-root: 27.69 🔻 ( previous job: 27.36, degradation: 101.18%)
  • debian-13-xfce_socket: 8.02 🟢 ( previous job: 8.57, improvement: 93.59%)
  • debian-13-xfce_socket-root: 8.48 🔻 ( previous job: 8.26, degradation: 102.69%)
  • debian-13-xfce_exec-data-simplex: 71.13 🟢 ( previous job: 72.43, improvement: 98.21%)
  • debian-13-xfce_exec-data-duplex: 70.30 🟢 ( previous job: 76.65, improvement: 91.72%)
  • debian-13-xfce_exec-data-duplex-root: 85.62 🟢 ( previous job: 91.79, improvement: 93.28%)
  • debian-13-xfce_socket-data-duplex: 138.36 🔻 ( previous job: 133.45, degradation: 103.68%)
  • fedora-42-xfce_exec: 9.05 🟢 ( previous job: 9.06, improvement: 99.84%)
  • fedora-42-xfce_exec-root: 60.18 🔻 ( previous job: 58.19, degradation: 103.42%)
  • fedora-42-xfce_socket: 8.39 🟢 ( previous job: 8.48, improvement: 98.93%)
  • fedora-42-xfce_socket-root: 8.73 🔻 ( previous job: 8.18, degradation: 106.71%)
  • fedora-42-xfce_exec-data-simplex: 72.60 🟢 ( previous job: 78.48, improvement: 92.50%)
  • fedora-42-xfce_exec-data-duplex: 71.65 🔻 ( previous job: 67.92, degradation: 105.49%)
  • fedora-42-xfce_exec-data-duplex-root: 94.62 🟢 ( previous job: 96.36, improvement: 98.19%)
  • fedora-42-xfce_socket-data-duplex: 148.09 🔻 ( previous job: 142.58, degradation: 103.87%)
  • whonix-gateway-17_exec: 6.62 🟢 ( previous job: 8.12, improvement: 81.59%)
  • whonix-gateway-17_exec-root: 39.19 🟢 ( previous job: 41.05, improvement: 95.47%)
  • whonix-gateway-17_socket: 7.42 🟢 ( previous job: 8.52, improvement: 87.00%)
  • whonix-gateway-17_socket-root: 6.78 🟢 ( previous job: 8.12, improvement: 83.49%)
  • whonix-gateway-17_exec-data-simplex: 73.60 🟢 ( previous job: 83.60, improvement: 88.04%)
  • whonix-gateway-17_exec-data-duplex: 72.38 🔻 ( previous job: 68.38, degradation: 105.85%)
  • whonix-gateway-17_exec-data-duplex-root: 86.27 🟢 ( previous job: 99.37, improvement: 86.82%)
  • whonix-gateway-17_socket-data-duplex: 153.50 🟢 ( previous job: 167.12, improvement: 91.85%)
  • whonix-workstation-17_exec: 7.86 🔻 ( previous job: 7.57, degradation: 103.83%)
  • whonix-workstation-17_exec-root: 53.60 🟢 ( previous job: 56.76, improvement: 94.44%)
  • whonix-workstation-17_socket: 8.23 🟢 ( previous job: 8.59, improvement: 95.88%)
  • whonix-workstation-17_socket-root: 7.85 🟢 ( previous job: 8.89, improvement: 88.33%)
  • whonix-workstation-17_exec-data-duplex: 69.70 🟢 ( previous job: 74.50, improvement: 93.56%)
  • whonix-workstation-17_exec-data-duplex-root: 91.26 🟢 ( previous job: 102.34, improvement: 89.18%)
  • whonix-workstation-17_socket-data-duplex: 142.30 🟢 ( previous job: 147.97, improvement: 96.16%)
  • dom0_root_seq1m_q8t1_read 3:read_bandwidth_kb: 457294.00 🔻 ( previous job: 497426.00, degradation: 91.93%)
  • dom0_root_rnd4k_q32t1_write 3:write_bandwidth_kb: 4245.00 🟢 ( previous job: 2446.00, improvement: 173.55%)
  • dom0_root_rnd4k_q1t1_read 3:read_bandwidth_kb: 12053.00 🟢 ( previous job: 5874.00, improvement: 205.19%)
  • dom0_root_rnd4k_q1t1_write 3:write_bandwidth_kb: 2538.00 🟢 ( previous job: 29.00, improvement: 8751.72%)
  • dom0_varlibqubes_seq1m_q8t1_read 3:read_bandwidth_kb: 320078.00 🟢 ( previous job: 292489.00, improvement: 109.43%)
  • dom0_varlibqubes_seq1m_q8t1_write 3:write_bandwidth_kb: 133765.00 🟢 ( previous job: 110817.00, improvement: 120.71%)
  • dom0_varlibqubes_seq1m_q1t1_read 3:read_bandwidth_kb: 426077.00 🟢 ( previous job: 137802.00, improvement: 309.20%)
  • dom0_varlibqubes_seq1m_q1t1_write 3:write_bandwidth_kb: 180129.00 🟢 ( previous job: 121719.00, improvement: 147.99%)
  • dom0_varlibqubes_rnd4k_q32t1_read 3:read_bandwidth_kb: 103955.00 🟢 ( previous job: 103932.00, improvement: 100.02%)
  • dom0_varlibqubes_rnd4k_q32t1_write 3:write_bandwidth_kb: 9757.00 🟢 ( previous job: 6356.00, improvement: 153.51%)
  • dom0_varlibqubes_rnd4k_q1t1_read 3:read_bandwidth_kb: 7222.00 🔻 ( previous job: 7695.00, degradation: 93.85%)
  • dom0_varlibqubes_rnd4k_q1t1_write 3:write_bandwidth_kb: 3932.00 🟢 ( previous job: 3925.00, improvement: 100.18%)
  • fedora-42-xfce_root_seq1m_q8t1_read 3:read_bandwidth_kb: 380470.00 🟢 ( previous job: 366891.00, improvement: 103.70%)
  • fedora-42-xfce_root_seq1m_q1t1_read 3:read_bandwidth_kb: 282635.00 🔻 ( previous job: 299764.00, degradation: 94.29%)
  • fedora-42-xfce_root_rnd4k_q32t1_read 3:read_bandwidth_kb: 80305.00 🔻 ( previous job: 86001.00, degradation: 93.38%)
  • fedora-42-xfce_root_rnd4k_q1t1_read 3:read_bandwidth_kb: 8324.00 🔻 ( previous job: 9042.00, degradation: 92.06%)
  • fedora-42-xfce_private_seq1m_q8t1_write 3:write_bandwidth_kb: 197747.00 🟢 ( previous job: 136640.00, improvement: 144.72%)
  • fedora-42-xfce_private_seq1m_q1t1_read 3:read_bandwidth_kb: 341889.00 🟢 ( previous job: 325139.00, improvement: 105.15%)
  • fedora-42-xfce_private_seq1m_q1t1_write 3:write_bandwidth_kb: 103887.00 🟢 ( previous job: 79539.00, improvement: 130.61%)
  • fedora-42-xfce_private_rnd4k_q32t1_read 3:read_bandwidth_kb: 90082.00 🟢 ( previous job: 87396.00, improvement: 103.07%)
  • fedora-42-xfce_private_rnd4k_q32t1_write 3:write_bandwidth_kb: 3997.00 🟢 ( previous job: 3765.00, improvement: 106.16%)
  • fedora-42-xfce_private_rnd4k_q1t1_read 3:read_bandwidth_kb: 8634.00 🔻 ( previous job: 8992.00, degradation: 96.02%)
  • fedora-42-xfce_private_rnd4k_q1t1_write 3:write_bandwidth_kb: 1483.00 🟢 ( previous job: 1251.00, improvement: 118.55%)
  • fedora-42-xfce_volatile_seq1m_q8t1_write 3:write_bandwidth_kb: 166489.00 🟢 ( previous job: 157382.00, improvement: 105.79%)
  • fedora-42-xfce_volatile_seq1m_q1t1_read 3:read_bandwidth_kb: 289342.00 🔻 ( previous job: 293225.00, degradation: 98.68%)
  • fedora-42-xfce_volatile_rnd4k_q32t1_read 3:read_bandwidth_kb: 80242.00 🔻 ( previous job: 87141.00, degradation: 92.08%)
  • fedora-42-xfce_volatile_rnd4k_q1t1_read 3:read_bandwidth_kb: 8368.00 🔻 ( previous job: 8804.00, degradation: 95.05%)
  • debian-13-xfce_dispvm (mean:6.67): 80.05
  • debian-13-xfce_dispvm-gui (mean:7.389): 88.67 🟢 ( previous job: 119.40, improvement: 74.26%)
  • debian-13-xfce_dispvm-concurrent (mean:3.337): 40.04
  • debian-13-xfce_dispvm-gui-concurrent (mean:3.831): 45.97 🟢 ( previous job: 64.59, improvement: 71.17%)
  • debian-13-xfce_dispvm-dom0 (mean:7.171): 86.05
  • debian-13-xfce_dispvm-dom0-gui (mean:8.223): 98.67 🟢 ( previous job: 127.44, improvement: 77.43%)
  • debian-13-xfce_dispvm-dom0-concurrent (mean:3.633): 43.60
  • debian-13-xfce_dispvm-dom0-gui-concurrent (mean:4.129): 49.55 🟢 ( previous job: 65.60, improvement: 75.54%)
  • debian-13-xfce_dispvm-preload (mean:3.745): 44.94
  • debian-13-xfce_dispvm-preload-gui (mean:4.312): 51.74
  • debian-13-xfce_dispvm-preload-concurrent (mean:2.679): 32.15
  • debian-13-xfce_dispvm-preload-gui-concurrent (mean:3.444): 41.33
  • debian-13-xfce_dispvm-preload-dom0 (mean:3.832): 45.98
  • debian-13-xfce_dispvm-preload-dom0-gui (mean:5.462): 65.54
  • debian-13-xfce_dispvm-preload-dom0-concurrent (mean:3.454): 41.45
  • debian-13-xfce_dispvm-preload-dom0-gui-concurrent (mean:3.706): 44.47
  • debian-13-xfce_dispvm-api (mean:7.105): 85.27
  • debian-13-xfce_dispvm-gui-api (mean:8.409): 100.91 🟢 ( previous job: 127.48, improvement: 79.16%)
  • debian-13-xfce_dispvm-concurrent-api (mean:3.6): 43.19
  • debian-13-xfce_dispvm-gui-concurrent-api (mean:4.105): 49.26 🟢 ( previous job: 65.39, improvement: 75.32%)
  • debian-13-xfce_dispvm-preload-api (mean:3.95): 47.39
  • debian-13-xfce_dispvm-preload-less-api (mean:6.42): 77.05
  • debian-13-xfce_dispvm-preload-more-api (mean:3.981): 47.78
  • debian-13-xfce_dispvm-preload-gui-api (mean:5.413): 64.96
  • debian-13-xfce_dispvm-preload-concurrent-api (mean:3.052): 36.63
  • debian-13-xfce_dispvm-preload-gui-concurrent-api (mean:3.895): 46.74
  • debian-13-xfce_vm (mean:0.049): 0.59
  • debian-13-xfce_vm-gui (mean:0.056): 0.67 🟢 ( previous job: 7.40, improvement: 9.09%)
  • debian-13-xfce_vm-concurrent (mean:0.025): 0.30
  • debian-13-xfce_vm-gui-concurrent (mean:0.034): 0.41 🟢 ( previous job: 7.33, improvement: 5.58%)
  • debian-13-xfce_vm-api (mean:0.041): 0.49
  • debian-13-xfce_vm-gui-api (mean:0.043): 0.51 🟢 ( previous job: 2.17, improvement: 23.68%)
  • debian-13-xfce_vm-concurrent-api (mean:0.03): 0.36
  • debian-13-xfce_vm-gui-concurrent-api (mean:0.032): 0.38 🟢 ( previous job: 1.82, improvement: 20.88%)
  • fedora-42-xfce_dispvm (mean:7.066): 84.79 🟢 ( previous job: 111.99, improvement: 75.71%)
  • fedora-42-xfce_dispvm-gui (mean:8.221): 98.65 🟢 ( previous job: 131.63, improvement: 74.95%)
  • fedora-42-xfce_dispvm-concurrent (mean:3.83): 45.96 🟢 ( previous job: 57.25, improvement: 80.28%)
  • fedora-42-xfce_dispvm-gui-concurrent (mean:4.534): 54.41 🟢 ( previous job: 74.72, improvement: 72.81%)
  • fedora-42-xfce_dispvm-dom0 (mean:7.922): 95.06 🟢 ( previous job: 124.92, improvement: 76.10%)
  • fedora-42-xfce_dispvm-dom0-gui (mean:9.152): 109.82 🟢 ( previous job: 147.17, improvement: 74.62%)
  • fedora-42-xfce_dispvm-dom0-concurrent (mean:3.9): 46.80 🟢 ( previous job: 64.09, improvement: 73.02%)
  • fedora-42-xfce_dispvm-dom0-gui-concurrent (mean:4.748): 56.97 🟢 ( previous job: 75.59, improvement: 75.37%)
  • fedora-42-xfce_dispvm-preload (mean:4.13): 49.56 🟢 ( previous job: 69.72, improvement: 71.08%)
  • fedora-42-xfce_dispvm-preload-gui (mean:4.903): 58.84 🟢 ( previous job: 79.21, improvement: 74.28%)
  • fedora-42-xfce_dispvm-preload-concurrent (mean:3.036): 36.44 🟢 ( previous job: 49.89, improvement: 73.04%)
  • fedora-42-xfce_dispvm-preload-gui-concurrent (mean:3.942): 47.31 🟢 ( previous job: 69.08, improvement: 68.48%)
  • fedora-42-xfce_dispvm-preload-dom0 (mean:4.35): 52.20 🟢 ( previous job: 72.35, improvement: 72.15%)
  • fedora-42-xfce_dispvm-preload-dom0-gui (mean:5.731): 68.77 🟢 ( previous job: 91.39, improvement: 75.25%)
  • fedora-42-xfce_dispvm-preload-dom0-concurrent (mean:3.506): 42.08 🟢 ( previous job: 57.13, improvement: 73.65%)
  • fedora-42-xfce_dispvm-preload-dom0-gui-concurrent (mean:4.144): 49.73 🟢 ( previous job: 67.89, improvement: 73.26%)
  • fedora-42-xfce_dispvm-api (mean:7.78): 93.36 🟢 ( previous job: 128.15, improvement: 72.85%)
  • fedora-42-xfce_dispvm-gui-api (mean:9.154): 109.84 🟢 ( previous job: 149.03, improvement: 73.71%)
  • fedora-42-xfce_dispvm-concurrent-api (mean:3.943): 47.32 🟢 ( previous job: 66.32, improvement: 71.34%)
  • fedora-42-xfce_dispvm-gui-concurrent-api (mean:4.593): 55.11 🟢 ( previous job: 77.33, improvement: 71.27%)
  • fedora-42-xfce_dispvm-preload-api (mean:4.391): 52.69 🟢 ( previous job: 73.95, improvement: 71.25%)
  • fedora-42-xfce_dispvm-preload-less-api (mean:7.21): 86.52 🟢 ( previous job: 116.39, improvement: 74.33%)
  • fedora-42-xfce_dispvm-preload-more-api (mean:4.517): 54.20 🟢 ( previous job: 71.33, improvement: 75.99%)
  • fedora-42-xfce_dispvm-preload-gui-api (mean:5.973): 71.68 🟢 ( previous job: 92.06, improvement: 77.86%)
  • fedora-42-xfce_dispvm-preload-concurrent-api (mean:3.797): 45.56 🟢 ( previous job: 61.60, improvement: 73.97%)
  • fedora-42-xfce_dispvm-preload-gui-concurrent-api (mean:4.214): 50.57 🟢 ( previous job: 77.66, improvement: 65.12%)
  • fedora-42-xfce_vm (mean:0.025): 0.30 🟢 ( previous job: 9.19, improvement: 3.25%)
  • fedora-42-xfce_vm-gui (mean:0.026): 0.31 🟢 ( previous job: 9.01, improvement: 3.47%)
  • fedora-42-xfce_vm-concurrent (mean:0.011): 0.13 🟢 ( previous job: 8.88, improvement: 1.45%)
  • fedora-42-xfce_vm-gui-concurrent (mean:0.017): 0.21 🟢 ( previous job: 9.15, improvement: 2.26%)
  • fedora-42-xfce_vm-api (mean:0.04): 0.47 🟢 ( previous job: 2.24, improvement: 21.18%)
  • fedora-42-xfce_vm-gui-api (mean:0.041): 0.49 🟢 ( previous job: 2.33, improvement: 20.83%)
  • fedora-42-xfce_vm-concurrent-api (mean:0.03): 0.37 🟢 ( previous job: 1.62, improvement: 22.63%)
  • fedora-42-xfce_vm-gui-concurrent-api (mean:0.028): 0.34 🟢 ( previous job: 2.20, improvement: 15.53%)
  • whonix-workstation-17_dispvm (mean:7.522): 90.26 🟢 ( previous job: 123.87, improvement: 72.87%)
  • whonix-workstation-17_dispvm-gui (mean:8.603): 103.24 🟢 ( previous job: 148.68, improvement: 69.44%)
  • whonix-workstation-17_dispvm-concurrent (mean:4.249): 50.99 🟢 ( previous job: 77.00, improvement: 66.23%)
  • whonix-workstation-17_dispvm-gui-concurrent (mean:5.05): 60.59 🟢 ( previous job: 89.18, improvement: 67.94%)
  • whonix-workstation-17_dispvm-dom0 (mean:8.472): 101.67 🟢 ( previous job: 135.24, improvement: 75.18%)
  • whonix-workstation-17_dispvm-dom0-gui (mean:9.538): 114.46 🟢 ( previous job: 159.23, improvement: 71.88%)
  • whonix-workstation-17_dispvm-dom0-concurrent (mean:4.355): 52.27 🟢 ( previous job: 76.91, improvement: 67.96%)
  • whonix-workstation-17_dispvm-dom0-gui-concurrent (mean:4.937): 59.24 🟢 ( previous job: 87.45, improvement: 67.74%)
  • whonix-workstation-17_dispvm-preload (mean:7.674): 92.08 🟢 ( previous job: 124.31, improvement: 74.07%)
  • whonix-workstation-17_dispvm-preload-gui (mean:8.384): 100.61 🟢 ( previous job: 138.71, improvement: 72.53%)
  • whonix-workstation-17_dispvm-preload-concurrent (mean:4.071): 48.85 🟢 ( previous job: 66.00, improvement: 74.01%)
  • whonix-workstation-17_dispvm-preload-gui-concurrent (mean:4.616): 55.40 🟢 ( previous job: 77.46, improvement: 71.52%)
  • whonix-workstation-17_dispvm-preload-dom0 (mean:4.729): 56.75 🟢 ( previous job: 81.24, improvement: 69.86%)
  • whonix-workstation-17_dispvm-preload-dom0-gui (mean:6.359): 76.31 🟢 ( previous job: 102.71, improvement: 74.29%)
  • whonix-workstation-17_dispvm-preload-dom0-concurrent (mean:4.162): 49.94 🟢 ( previous job: 72.84, improvement: 68.56%)
  • whonix-workstation-17_dispvm-preload-dom0-gui-concurrent (mean:4.701): 56.41 🟢 ( previous job: 87.14, improvement: 64.74%)
  • whonix-workstation-17_dispvm-api (mean:8.136): 97.64 🟢 ( previous job: 140.50, improvement: 69.49%)
  • whonix-workstation-17_dispvm-gui-api (mean:9.443): 113.32 🟢 ( previous job: 157.40, improvement: 71.99%)
  • whonix-workstation-17_dispvm-concurrent-api (mean:4.243): 50.91 🟢 ( previous job: 76.06, improvement: 66.94%)
  • whonix-workstation-17_dispvm-gui-concurrent-api (mean:4.92): 59.04 🟢 ( previous job: 87.18, improvement: 67.72%)
  • whonix-workstation-17_dispvm-preload-api (mean:4.728): 56.74 🟢 ( previous job: 84.09, improvement: 67.47%)
  • whonix-workstation-17_dispvm-preload-less-api (mean:7.671): 92.05 🟢 ( previous job: 126.04, improvement: 73.03%)
  • whonix-workstation-17_dispvm-preload-more-api (mean:5.279): 63.35 🟢 ( previous job: 89.12, improvement: 71.08%)
  • whonix-workstation-17_dispvm-preload-gui-api (mean:6.207): 74.49 🟢 ( previous job: 101.72, improvement: 73.23%)
  • whonix-workstation-17_dispvm-preload-concurrent-api (mean:4.122): 49.47 🟢 ( previous job: 71.58, improvement: 69.11%)
  • whonix-workstation-17_dispvm-preload-gui-concurrent-api (mean:4.629): 55.55 🟢 ( previous job: 88.24, improvement: 62.95%)
  • whonix-workstation-17_vm (mean:0.045): 0.54 🟢 ( previous job: 9.27, improvement: 5.82%)
  • whonix-workstation-17_vm-gui (mean:0.058): 0.70 🟢 ( previous job: 9.82, improvement: 7.12%)
  • whonix-workstation-17_vm-concurrent (mean:0.031): 0.37 🟢 ( previous job: 8.93, improvement: 4.11%)
  • whonix-workstation-17_vm-gui-concurrent (mean:0.031): 0.37 🟢 ( previous job: 9.38, improvement: 3.97%)
  • whonix-workstation-17_vm-api (mean:0.056): 0.67 🟢 ( previous job: 2.56, improvement: 26.13%)
  • whonix-workstation-17_vm-gui-api (mean:0.04): 0.48 🟢 ( previous job: 2.53, improvement: 18.82%)
  • whonix-workstation-17_vm-concurrent-api (mean:0.028): 0.34 🟢 ( previous job: 1.81, improvement: 18.61%)
  • whonix-workstation-17_vm-gui-concurrent-api (mean:0.029): 0.35 🟢 ( previous job: 2.57, improvement: 13.64%)

This was referenced Sep 5, 2025
Open
Open
Merged
Open
Open
Open
Draft
@marmarek marmarek force-pushed the id-arg branch 3 times, most recently from 3a47e12 to 160f863 Compare September 6, 2025 21:38
This was referenced Sep 9, 2025
Merged
Merged
@marmarek
Add device info to qrexec call argument
e9f8bbf 
This allows setting policy for individual devices, not only device
types. It relies on USB qube (or wherever the device is connected)
giving accurate device info, but since it's going to be granted at least
partial control it needs to be trusted to some degree anyway.

Build the device info based on type/vendor/product/revision (the PRODUCT
property) and physical location (USB controller + port in case of USB
device). The latter can be disabled, to build a policy that allows
given device in any port.

Fixes QubesOS/qubes-issues#3604
This was referenced Sep 12, 2025
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Closed
Merged
Merged
Merged
@marmarek marmarek merged commit e9f8bbf into QubesOS:main Sep 17, 2025
2 of 3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
openqa-pending
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

input-proxy: ability to blacklist/whitelist specific devices
2 participants
@marmarek @qubesos-bot