Use rpc-config for running qubes.VMRoot* services as root

[marmarek]

Don't require setting user=root in each policy line for them

Fixes QubesOS/qubes-issues#9939

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 71.10%. Comparing base (8a5e873) to head (1c538af).
Report is 7 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #579   +/-   ##
=======================================
  Coverage   71.10%   71.10%           
=======================================
  Files           3        3           
  Lines         481      481           
=======================================
  Hits          342      342           
  Misses        139      139           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[qubesos-bot]

OpenQA test summary

Complete test suite and dependencies: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2025062101-4.3&flavor=pull-requests

Test run included the following:

• Add Arch packaging qubes-core-admin-client#332 (QubesOS/qubes-core-admin-client@40487bc)
• Preload dispvm dom0 feat qubes-core-admin-client#360 (QubesOS/qubes-core-admin-client@2447603)
• vmupdate: answer "yes" to the import key question qubes-core-admin-linux#194 (QubesOS/qubes-core-admin-linux@5ee0faa)
• Handle global disposable preload feature qubes-core-admin#686 (QubesOS/qubes-core-admin@f13be7a)
• tests: adjust audio tests for changed recording stream behavior qubes-core-admin#688 (QubesOS/qubes-core-admin@4571c3f)
• empty PR #578 (66cbadf)
• Use rpc-config for running qubes.VMRoot* services as root #579 (1c538af)
• qubes-core-agent: remove conflict with firewalld #581 (bd9945f)
• Add handler for internal feature qubes-desktop-linux-menu#55 (QubesOS/qubes-desktop-linux-menu@933d7d3)
• Include 'pointer' in the qubes input device name qubes-gui-agent-linux#235 (QubesOS/qubes-gui-agent-linux@e14dc2e)
• pulse: connect recording stream only when recording is allowed qubes-gui-daemon#164 (QubesOS/qubes-gui-daemon@f596c69)
• Automatically accept test-signed driver installation qubes-installer-qubes-os-windows-tools#6 (QubesOS/qubes-installer-qubes-os-windows-tools@0b6a52a)
• Ignore RemoteVM for now qubes-manager#398 (QubesOS/qubes-manager@679eff4)
• Add disposable preload setting to advanced settings qubes-manager#425 (QubesOS/qubes-manager@16f7bd0)
• Show (Manager App) Icons for Wayland/KDE qubes-manager#427 (QubesOS/qubes-manager@773a734)

New failures, excluding unstable

Compared to: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2025061004-4.3&flavor=update

• system_tests_dispvm

  • TC_20_DispVM_debian-12-xfce: test_013_dvm_run_preload_gui (failure)
    ^... AssertionError: None is not true

  • TC_20_DispVM_fedora-42-xfce: test_013_dvm_run_preload_gui (failure)
    ^... AssertionError: None is not true

  • TC_20_DispVM_whonix-workstation-17: test_013_dvm_run_preload_gui (failure)
    ^... AssertionError: None is not true

• system_tests_qwt_win10@hw13

  • windows_install: Failed (test died)
    # Test died: command 'script -e -c 'bash -x /usr/bin/qvm-create-win...

• system_tests_qwt_win10_seamless@hw13

  • windows_clipboard_and_filecopy: unnamed test (unknown)
  • windows_clipboard_and_filecopy: Failed (test died)
    # Test died: no candidate needle with tag(s) 'windows-Edge-address-...

• system_tests_qwt_win11@hw13

  • windows_install: Failed (test died)
    # Test died: command 'script -e -c 'bash -x /usr/bin/qvm-create-win...

• system_tests_audio@hw1

  • TC_20_AudioVM_Pulse_debian-12-xfce: test_222_audio_rec_unmuted_pulseaudio (failure)
    AssertionError: only silence detected, no useful audio data

• system_tests_guivm_vnc_gui_interactive

  • gui_filecopy: unnamed test (unknown)
  • gui_filecopy: Failed (test died)
    # Test died: no candidate needle with tag(s) 'disp-text-editor' mat...

Failed tests

15 failures

• system_tests_extra

  • TC_00_QVCTest_whonix-workstation-17: test_010_screenshare (failure)
    AssertionError: 1 != 0 : Timeout waiting for /dev/video0 in test-in...

• system_tests_dispvm

  • TC_20_DispVM_debian-12-xfce: test_013_dvm_run_preload_gui (failure)
    ^... AssertionError: None is not true

  • TC_20_DispVM_fedora-42-xfce: test_013_dvm_run_preload_gui (failure)
    ^... AssertionError: None is not true

  • TC_20_DispVM_whonix-workstation-17: test_013_dvm_run_preload_gui (failure)
    ^... AssertionError: None is not true

• system_tests_kde_gui_interactive

  • gui_keyboard_layout: wait_serial (wait serial expected)
    # wait_serial expected: "echo -e '[Layout]\nLayoutList=us,de' | sud...

  • gui_keyboard_layout: wait_serial (wait serial expected)
    # wait_serial expected: qr/JmOTS-\d+-/...

  • gui_keyboard_layout: Failed (test died + timed out)
    # Test died: command 'echo -e '[Layout]...

  • gui_keyboard_layout: wait_serial (wait serial expected)
    # wait_serial expected: "# "...

• system_tests_qwt_win10@hw13

  • windows_install: Failed (test died)
    # Test died: command 'script -e -c 'bash -x /usr/bin/qvm-create-win...

• system_tests_qwt_win10_seamless@hw13

  • windows_clipboard_and_filecopy: unnamed test (unknown)
  • windows_clipboard_and_filecopy: Failed (test died)
    # Test died: no candidate needle with tag(s) 'windows-Edge-address-...

• system_tests_qwt_win11@hw13

  • windows_install: Failed (test died)
    # Test died: command 'script -e -c 'bash -x /usr/bin/qvm-create-win...

• system_tests_audio@hw1

  • TC_20_AudioVM_Pulse_debian-12-xfce: test_222_audio_rec_unmuted_pulseaudio (failure)
    AssertionError: only silence detected, no useful audio data

• system_tests_guivm_vnc_gui_interactive

  • gui_filecopy: unnamed test (unknown)
  • gui_filecopy: Failed (test died)
    # Test died: no candidate needle with tag(s) 'disp-text-editor' mat...

Fixed failures

Compared to: https://openqa.qubes-os.org/tests/142375#dependencies

10 fixed

• system_tests_splitgpg

  • TC_10_Thunderbird_whonix-workstation-17: test_000_send_receive_default (failure)
    dogtail.tree.SearchError: descendent of [application | Thunderbird]...

  • TC_10_Thunderbird_whonix-workstation-17: test_010_send_receive_inline_signed_only (failure)
    dogtail.tree.SearchError: descendent of [application | Thunderbird]...

  • TC_10_Thunderbird_whonix-workstation-17: test_020_send_receive_inline_with_attachment (failure)
    dogtail.tree.SearchError: descendent of [application | Thunderbird]...

• system_tests_extra

  • TC_10_Thunderbird_whonix-workstation-17: test_000_send_receive_default (failure)
    dogtail.tree.SearchError: descendent of [application | Thunderbird]...

  • TC_10_Thunderbird_whonix-workstation-17: test_010_send_receive_inline_signed_only (failure)
    dogtail.tree.SearchError: descendent of [application | Thunderbird]...

  • TC_10_Thunderbird_whonix-workstation-17: test_020_send_receive_inline_with_attachment (failure)
    dogtail.tree.SearchError: descendent of [application | Thunderbird]...

• system_tests_audio

  • TC_20_AudioVM_Pulse_debian-12-xfce: test_252_audio_playback_audiovm_switch_hvm (failure)
    AssertionError: only silence detected, no useful audio data

  • TC_20_AudioVM_Pulse_whonix-workstation-17: test_225_audio_rec_unmuted_hvm (failure)
    AssertionError: too short audio, expected 10s, got 7.95233560090703...

• system_tests_guivm_vnc_gui_interactive

  • simple_gui_apps: unnamed test (unknown)
  • simple_gui_apps: Failed (test died)
    # Test died: no candidate needle with tag(s) 'vm-settings-applicati...

Unstable tests

Performance Tests

Performance degradation:

8 performance degradations

• whonix-gateway-17_socket: 8.69 🔺 ( previous job: 7.85, degradation: 110.61%)
• whonix-workstation-17_exec-data-duplex-root: 98.59 🔺 ( previous job: 86.00, degradation: 114.63%)
• dom0_root_rnd4k_q32t1_write 3:write_bandwidth_kb: 521.00 :small_red_triangle: ( previous job: 1091.00, degradation: 47.75%)
• dom0_root_rnd4k_q1t1_read 3:read_bandwidth_kb: 2197.00 :small_red_triangle: ( previous job: 11086.00, degradation: 19.82%)
• dom0_root_rnd4k_q1t1_write 3:write_bandwidth_kb: 21.00 :small_red_triangle: ( previous job: 1840.00, degradation: 1.14%)
• dom0_varlibqubes_seq1m_q8t1_write 3:write_bandwidth_kb: 76287.00 :small_red_triangle: ( previous job: 122848.00, degradation: 62.10%)
• dom0_varlibqubes_seq1m_q1t1_write 3:write_bandwidth_kb: 88510.00 :small_red_triangle: ( previous job: 167872.00, degradation: 52.72%)
• dom0_varlibqubes_rnd4k_q32t1_write 3:write_bandwidth_kb: 7446.00 :small_red_triangle: ( previous job: 8874.00, degradation: 83.91%)

Remaining performance tests:

64 tests

• debian-12-xfce_exec: 5.40 🟢 ( previous job: 8.63, improvement: 62.63%)
• debian-12-xfce_exec-root: 29.54 🔺 ( previous job: 29.44, degradation: 100.37%)
• debian-12-xfce_socket: 8.56 🔺 ( previous job: 8.50, degradation: 100.67%)
• debian-12-xfce_socket-root: 8.03 🟢 ( previous job: 8.31, improvement: 96.52%)
• debian-12-xfce_exec-data-simplex: 65.85 🔺 ( previous job: 65.51, degradation: 100.51%)
• debian-12-xfce_exec-data-duplex: 72.83 🟢 ( previous job: 73.55, improvement: 99.03%)
• debian-12-xfce_exec-data-duplex-root: 72.30 🔺 ( previous job: 70.01, degradation: 103.26%)
• debian-12-xfce_socket-data-duplex: 148.03 🟢 ( previous job: 161.35, improvement: 91.74%)
• fedora-42-xfce_exec: 9.07
• fedora-42-xfce_exec-root: 59.24
• fedora-42-xfce_socket: 8.27
• fedora-42-xfce_socket-root: 8.58
• fedora-42-xfce_exec-data-simplex: 79.32
• fedora-42-xfce_exec-data-duplex: 75.69
• fedora-42-xfce_exec-data-duplex-root: 103.35
• fedora-42-xfce_socket-data-duplex: 139.71
• whonix-gateway-17_exec: 6.22 🟢 ( previous job: 7.34, improvement: 84.78%)
• whonix-gateway-17_exec-root: 39.36 🟢 ( previous job: 39.57, improvement: 99.45%)
• whonix-gateway-17_socket-root: 8.00 🔺 ( previous job: 7.89, degradation: 101.35%)
• whonix-gateway-17_exec-data-simplex: 78.97 🔺 ( previous job: 77.76, degradation: 101.55%)
• whonix-gateway-17_exec-data-duplex: 78.73 🔺 ( previous job: 78.39, degradation: 100.45%)
• whonix-gateway-17_exec-data-duplex-root: 94.49 🔺 ( previous job: 90.74, degradation: 104.13%)
• whonix-gateway-17_socket-data-duplex: 168.80 🔺 ( previous job: 161.95, degradation: 104.23%)
• whonix-workstation-17_exec: 8.41 🔺 ( previous job: 8.27, degradation: 101.69%)
• whonix-workstation-17_exec-root: 58.31 🔺 ( previous job: 57.61, degradation: 101.22%)
• whonix-workstation-17_socket: 8.91 🟢 ( previous job: 8.97, improvement: 99.38%)
• whonix-workstation-17_socket-root: 8.40 🟢 ( previous job: 9.46, improvement: 88.80%)
• whonix-workstation-17_exec-data-simplex: 66.44 🟢 ( previous job: 74.54, improvement: 89.13%)
• whonix-workstation-17_exec-data-duplex: 68.69 🟢 ( previous job: 74.84, improvement: 91.78%)
• whonix-workstation-17_socket-data-duplex: 157.16 🟢 ( previous job: 160.20, improvement: 98.10%)
• dom0_root_seq1m_q8t1_read 3:read_bandwidth_kb: 478364.00 :green_circle: ( previous job: 289982.00, improvement: 164.96%)
• dom0_root_seq1m_q8t1_write 3:write_bandwidth_kb: 124985.00 :green_circle: ( previous job: 101988.00, improvement: 122.55%)
• dom0_root_seq1m_q1t1_read 3:read_bandwidth_kb: 120171.00 :green_circle: ( previous job: 14284.00, improvement: 841.30%)
• dom0_root_seq1m_q1t1_write 3:write_bandwidth_kb: 65006.00 :green_circle: ( previous job: 32696.00, improvement: 198.82%)
• dom0_root_rnd4k_q32t1_read 3:read_bandwidth_kb: 16773.00 :small_red_triangle: ( previous job: 17102.00, degradation: 98.08%)
• dom0_varlibqubes_seq1m_q8t1_read 3:read_bandwidth_kb: 332037.00 :green_circle: ( previous job: 289182.00, improvement: 114.82%)
• dom0_varlibqubes_seq1m_q1t1_read 3:read_bandwidth_kb: 394943.00 :small_red_triangle: ( previous job: 433654.00, degradation: 91.07%)
• dom0_varlibqubes_rnd4k_q32t1_read 3:read_bandwidth_kb: 102194.00 :small_red_triangle: ( previous job: 108760.00, degradation: 93.96%)
• dom0_varlibqubes_rnd4k_q1t1_read 3:read_bandwidth_kb: 8331.00 :green_circle: ( previous job: 6356.00, improvement: 131.07%)
• dom0_varlibqubes_rnd4k_q1t1_write 3:write_bandwidth_kb: 4699.00 :green_circle: ( previous job: 4420.00, improvement: 106.31%)
• fedora-42-xfce_root_seq1m_q8t1_read 3:read_bandwidth_kb: 382971.00
• fedora-42-xfce_root_seq1m_q8t1_write 3:write_bandwidth_kb: 151388.00
• fedora-42-xfce_root_seq1m_q1t1_read 3:read_bandwidth_kb: 313381.00
• fedora-42-xfce_root_seq1m_q1t1_write 3:write_bandwidth_kb: 36955.00
• fedora-42-xfce_root_rnd4k_q32t1_read 3:read_bandwidth_kb: 89829.00
• fedora-42-xfce_root_rnd4k_q32t1_write 3:write_bandwidth_kb: 2402.00
• fedora-42-xfce_root_rnd4k_q1t1_read 3:read_bandwidth_kb: 8379.00
• fedora-42-xfce_root_rnd4k_q1t1_write 3:write_bandwidth_kb: 858.00
• fedora-42-xfce_private_seq1m_q8t1_read 3:read_bandwidth_kb: 345153.00
• fedora-42-xfce_private_seq1m_q8t1_write 3:write_bandwidth_kb: 154608.00
• fedora-42-xfce_private_seq1m_q1t1_read 3:read_bandwidth_kb: 328604.00
• fedora-42-xfce_private_seq1m_q1t1_write 3:write_bandwidth_kb: 46472.00
• fedora-42-xfce_private_rnd4k_q32t1_read 3:read_bandwidth_kb: 93043.00
• fedora-42-xfce_private_rnd4k_q32t1_write 3:write_bandwidth_kb: 4779.00
• fedora-42-xfce_private_rnd4k_q1t1_read 3:read_bandwidth_kb: 8992.00
• fedora-42-xfce_private_rnd4k_q1t1_write 3:write_bandwidth_kb: 337.00
• fedora-42-xfce_volatile_seq1m_q8t1_read 3:read_bandwidth_kb: 346293.00
• fedora-42-xfce_volatile_seq1m_q8t1_write 3:write_bandwidth_kb: 136927.00
• fedora-42-xfce_volatile_seq1m_q1t1_read 3:read_bandwidth_kb: 233952.00
• fedora-42-xfce_volatile_seq1m_q1t1_write 3:write_bandwidth_kb: 75276.00
• fedora-42-xfce_volatile_rnd4k_q32t1_read 3:read_bandwidth_kb: 84438.00
• fedora-42-xfce_volatile_rnd4k_q32t1_write 3:write_bandwidth_kb: 4699.00
• fedora-42-xfce_volatile_rnd4k_q1t1_read 3:read_bandwidth_kb: 7891.00
• fedora-42-xfce_volatile_rnd4k_q1t1_write 3:write_bandwidth_kb: 912.00