Does Kicksecure block receiving connections via qvm-connect-tcp?

gasull · April 30, 2026, 9:26am

I asked on the Qubes OS Forum, but this seems to be specific to Kicksecure. Maybe this is intended by design. Is it?

Patrick · April 30, 2026, 5:40pm

Some Qubes RPC are blocked in Kicksecure sysmaint session.

github.com/Kicksecure/user-sysmaint-split

usr/share/user-sysmaint-split/qubes-rpc-blocks

master

qubes.OpenURL
qubes.TemplateDownload
qubes.PdfConvert
qubes.TemplateSearch

github.com/Kicksecure/user-sysmaint-split

usr/libexec/user-sysmaint-split/sysmaint-boot

master


      
          while read -r rpc_config_file; do
             cp -- '/usr/libexec/user-sysmaint-split/qubes-rpc-block' "/run/qubes-rpc/${rpc_config_file}"
          done < /usr/share/user-sysmaint-split/qubes-rpc-blocks

github.com/Kicksecure/user-sysmaint-split

usr/libexec/user-sysmaint-split/qubes-rpc-block

master

#!/bin/bash

## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

set -o errexit
set -o nounset
set -o errtrace
set -o pipefail

rpc_config_file="$(basename -- "$0")" || rpc_config_file=''
if [ -z "$rpc_config_file" ]; then
  rpc_config_file='UNKNOWN'
fi
msg="Qrexec action '${rpc_config_file}' is prohibited when booted into 'PERSISTENT Mode - SYSMAINT Session'."

printf '%s\n' "${msg}"
if command -v notify-send >/dev/null 2>/dev/null; then
  notify-send --app-name='user-sysmaint-split' 'Qrexec action blocked!' "${msg}"
fi

This file has been truncated. show original

There aren’t relevant mention of qvm-connect-tcp in Kicksecure’s source code. See also:
Search the Source Code

So no, Kicksecure at the time of writing doesn’t block qvm-connect-tcp. At least not through any mechanism that is intentional or coming to mind.

gasull · May 2, 2026, 6:59am

Can anybody tell me how to debug this problem?