Allow qube to reboot upon its request

[ben-grande]

Fixes: QubesOS/qubes-issues#8196
Requires: QubesOS/qubes-core-libvirt#53

---

TODO:

• Some method to make qmemman hold the memory of the domain and not redistribute it (until timeout is reached).
• Check if threshold of is good enough or there are better alternatives

[codecov]

Codecov Report

❌ Patch coverage is 37.83784% with 46 lines in your changes missing coverage. Please review.
✅ Project coverage is 70.62%. Comparing base (747cff1) to head (c89e8fe).

Files with missing lines	Patch %	Lines
qubes/vm/qubesvm.py	35.89%	25 Missing ⚠️
qubes/app.py	32.00%	17 Missing ⚠️
qubes/tools/qmemmand.py	0.00%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #810      +/-   ##
==========================================
- Coverage   70.75%   70.62%   -0.13%     
==========================================
  Files          61       61              
  Lines       14456    14501      +45     
==========================================
+ Hits        10229    10242      +13     
- Misses       4227     4259      +32     

Flag	Coverage Δ
unittests	70.62% <37.83%> (-0.13%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ben-grande]

Besides the time threshold to allow a consecutive reboot, if we are worried about revisions, there could be an "ask/prompt" mode, that when a qube wants to reboot, it shutsdown, and a dom0 prompts asks the user if they allow a qube restart to happen.

[rustybird]

Could rebootable and rebootable_threshold fall back to a global default, like qrexec_timeout etc.?

[ben-grande]

Yes.

[rustybird]

Nice. I might be too paranoid about this, but I'll probably want to disable it globally on my system (except for a few VMs) in case there's ever some mass infection event of VMs with a Qubes OS specific wiper discarding revisions overnight (when even an hours long threshhold would not be enough).

[ben-grande]

I haven't decided on the default yet. This is difficult, cause there is no good way to prevent throwing up all volumes, without sacrificing usability. Let's say you have rebootable=True and rebootable_threshold=999999999999999999999, then you are able to reboot once until the next qubesd restart (I actually should change last_reboot_time to be reset on every domain-shutdown event), cause that value is too big. If you have a low threshold, the qube can reboot several times while you are away from the computer.

Now let's say we'd want to limit by revisions_to_keep, considering the default value of 2, we are we can only reboot once, and still, a malicious qube can ask to be rebooted once, and on the next start, make the qube shutdown again, either by asking for shutdown, or reboot (which would shutdown and skip the startup part), then you have wasted 2 volumes.

But on Windows installation, at least a dozen reboots happened.

[rustybird]

revisions_to_keep, considering the default value of 2

Generally it's 1, although the installer overrides it to 2 for the LVM layout's default pool (so indeed for most people 2 turns out to be the default in practice): QubesOS/qubes-issues#10152 (comment)

Edit: oh you had already commented in that thread, I forgot.

But on Windows installation, at least a dozen reboots happened.

Haha wow.

[ben-grande]

But on Windows installation, at least a dozen reboots happened.

I meant to write half a dozen, but still, more than anyone would set for revisions_to_keep, as it would be expensive mainintaining many revisions, especially of large volumes.

[ben-grande]

PipelineRetryFailed

[ben-grande]

openQArun TEST=system_tests_misc PR_LABEL=openqa-group-1