Qubes 4.3 `sdw-admin` fails on `qvm-shutdown` due to preloaded disposables (Qubes 4.3)

[deeplow]

Description

sdw-admin --apply does shutdown all securedrop-workstation-tagged qubes. But on Qubes 4.3 this also includes preloaded disposable qubes.

The problem is that once these are shut down, new ones will pop up. (update: what is happening is that qvm-shutdown does not work for preloaded disposables. The command exits as qvm-shutdown: errror: Failed to shut down: disp1125)

Steps to Reproduce

Qubes 4.3 from #1373

Expected Behavior

No errors during sdw-admin --apply.

Actual Behavior

Running "qvm-shutdown --wait -- disp1582 disp4575 sd-app sd-base-bookworm-template sd-devices sd-devices-dvm sd-gpg sd-large-bookworm-template sd-log sd-proxy sd-proxy-dvm sd-small-bookworm-template sd-viewer"
usage: qvm-shutdown [--verbose] [--quiet] [--help] [--version] [--all] [--exclude EXCLUDE] [--wait] [--timeout TIMEOUT] [--force] [--dry-run] [VMNAME ...]
qvm-shutdown: error: no such domain: 'disp4575'
Traceback (most recent call last):
  File "/usr/bin/sdw-admin", line 131, in run_cmd
    subprocess.check_call(args)
    ~~~~~~~~~~~~~~~~~~~~~^^^^^^
  File "/usr/lib64/python3.13/subprocess.py", line 419, in check_call
    raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['qvm-shutdown', '--wait', '--', 'disp1582', 'disp4575', 'sd-app', 'sd-base-bookworm-template', 'sd-devices', 'sd-devices-dvm', 'sd-gpg', 'sd-large-bookworm-template', 'sd-log', 'sd-proxy', 'sd-proxy-dvm', 'sd-small-bookworm-template', 'sd-viewer']' returned non-zero exit status 2.

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/bin/sdw-admin", line 576, in <module>
    main()
    ~~~~^^
  File "/usr/bin/sdw-admin", line 542, in main
    provision_and_configure()
    ~~~~~~~~~~~~~~~~~~~~~~~^^
  File "/usr/bin/sdw-admin", line 101, in provision_and_configure
    configure(
    ~~~~~~~~~^
        "Configure all SecureDrop Workstation VMs with service-specific configs",
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        [q.name for q in Qubes().domains if "sd-workstation" in q.tags],
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/usr/bin/sdw-admin", line 171, in configure
    run_cmd(["qvm-shutdown", "--wait", "--"] + targets)
    ~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/bin/sdw-admin", line 133, in run_cmd
    raise SDWAdminException(f"Error while running {' '.join(args)}")
SDWAdminException: Error while running qvm-shutdown --wait -- disp1582 disp4575 sd-app sd-base-bookworm-template sd-devices sd-devices-dvm sd-gpg sd-large-bookworm-template sd-log sd-proxy sd-proxy-dvm sd-small-bookworm-template sd-viewer

Comments

Solutions:

• temporarily disable preloaded disposables

[ben-grande]

See reply on Matrix, ignore qube from the configure() if getattr(q, "is_preload", False)

[deeplow]

We're in sync! That was my plan as well. And good to know getattr call is also your suggestion. I had done some peeking at Qubes' code on monday to see if there was a more standard way but this seems to be "the way". Otherwise, I'd have to check if it's a disposable first to call the other preload-checking method.

[ben-grande]

The failure was on line 171, so it must be before this line:

securedrop-workstation/files/sdw-admin.py

Line 171 in 5756a39

run_cmd(["qvm-shutdown", "--wait", "--"] + targets)

I meant to ignore getattr(q, "is_preload, False) on this list generator:

securedrop-workstation/files/sdw-admin.py

Line 103 in 5756a39

[q.name for q in Qubes().domains if "sd-workstation" in q.tags],

So you don't have to exclude it inside the configure() function.

Also, I recommend not looping through all domains unless necessary, it may take some time on systems with an enormous amount of qubes to check each qube property.

# In the beginning of "def configure()"
targets = [t for t in targets if not getattr(t, "is_preload", False)]

This would be a fallback if you don't want to worry about that when composing the configure() call.

As states should not be applied to preloaded disposables, they will be applied automatically after the disposable template shuts down and refreshes the preloaded disposable.

https://qubes-doc--1554.org.readthedocs.build/en/1554/developer/services/disposablevm-implementation.html#preloaded-disposable-s-management

Updating the volumes of a template or disposable template will refresh;

Not merged so you couldn't have known, but check out the whole page of that PR for more info.

[deeplow]

Also, I recommend not looping through all domains unless necessary, it may take some time on systems with an enormous amount of qubes to check each qube property.

Thanks for the advice. It's kind of hard to avoid, many times. Do you have a specific alternative? In this case, we do know in advance which ones we expect to be preloaded, but not the individual dispXXXX names. Even qvm-ls has to resort to this querying. Personally on this issue I'm a bit more inclined towards caching solutions like QubesOS/qubes-issues#9362, so that we don't have to think too much about the executssion cost, if that makes sense.